We've got some Java code running that was written by what appears to be a sailboat manufacturer posing as a huge software company. Occasionally (as in frequently), this Java code will spin out and generate huge (many gigabytes per hour) log files. This can show up in any number of locations and rarely hits the same file twice. As I said, they're a sailboat manufacturer - they only pretend to write software that actually works. The problem is, when the code isn't generating gigabytes of the same error over and over, the log files are of use and we like to Splunk them. Furthermore, we'd like some kind of early-warning alert that some badly-written Java component or another is freaking out so that we can address it before the people who have to depend on this horrid mess notice that something else has gone wrong again. So what I'm trying to figure out is a way to alert when ANY file generates more than N number of alerts per T time period. I'm pretty sure this is doable, but I've been much too busy putting out fires to even approach the method. ... View more

I've got a file being spooled out from a database one row at a time, couple of example lines: 10-01-12:02:50:02, 0, 0, 3, 6, 103, 2 10-01-12:02:51:01, 0, 0, 3, 6, 103, 2 Using the IFX I was able to get the columns parsed correctly and run against a custom event type which is just the name of the file the values are spooled out to. What I need is to get a timechart to display the values of each column in a stacked area graph, excluding the second to last ("Normal") column. Thus far, the closest I've come is a rolling average of same: eventtype="CustomEventType" | timechart avg(Code_Red) AS "Code Red" avg(Urgent) AS "Urgent" avg(Very_High) AS "Very High" avg(High) AS "High" avg(Low) AS "Low" There are a couple problems with this: First, I don't want the averages of the columns, I want their values. Second, the average has mysteriously stopped working: So how do I get past this rolling average hack to the real values? And why did the average just stop working? ... View more

I'm pretty sure this is incorrect: recursive = true blacklist = conc/out/* blacklist = reports/cache/* Would a correct line look more like this? blacklist = (conc/out/*|reports/cache/*) ... View more

I've set up a simple search for flapping interfaces on our switches, looks like so: LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host What I'd like to do is get an alert using a conditional ... stats count by host > 5 in fifteen minutes or something like that. When I try this out it returns no data: LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host > 5 How do I get from there to where I want to be? ... View more

I've got this useful-looking area chart on a dashboard and used XML to cause it to refresh every thirty seconds. What I'd really prefer for it to do would be to build from right to left without the whole thing blanking while the report runs. Is this doable? ... View more

I've got a scripted input that dumps a line like the following every minute: 2011-12-22 08:46:56,0,30,6 What I'd like to do is parse it for a stacked timechart as follows: Datestamp, Critical, Error, Warning I know the comma is my delimiter, but beyond that I'm kind of at a loss. Any help? ... View more