I generate a log file with one line per server with the time of the run as the splunk date.. something like 2013-05-30 12:04 UTC host=billybob activesessions=5 2013-05-30 12:04 UTC host=thelmalou activesessions=3 2013-05-30 12:05 UTC host=billybob activesessions=18 2013-05-30 12:05 UTC host=thelmalou activesessions=6 This repeats every 5 seconds. I would like a timechart of how many sessions i had for the entire system. right now i do something like index=sessioncount | timechart span="5s" sum(activesessions) AS "Concurrent Sessions" this only works for about 40 minutes before i start losing data. i would like to generate this for hours if not days. The key problem is that for every 5 seconds i need sum the values, then for every span find the max of the sum. IE i want the max number of concurrent sessions, not the total number of sessions in that span. so in the above example i sum the first 5 second window to 8, then the second which is 24, then in the chart for that hour (assuming span is 1h) use 24 for that data point. All records for that run are imported at the exact time together as the key. thanks ... View more

I have an event being imported with a custom source type. in that source type i have NO_BINARY_CHECK=1 CHECK_FOR_HEADER=false LEARN_SOURCETYPE=false SHOULD_LINEMERGE=false However splunk is still truncating my log lines and then generating a new event with the rest of the line (potentially broken up again) generating incorrect data. Is there a way i can tell splunk to import the whole log line into one event? The event log line can be up to 128k. I am fine with it being truncated in the display but not in the indexed data. alternatively i am fine with any one field being limited to a certain size (such as 4k) but as it stands now any fields after the really long field is missing. thanks, rob ... View more

I am using splunk 4.3.1 and have a custom sourcetype props.conf [vlf] REPORT-a=voxeo-vlf TRANSFORMS-a = voxeo-vlf-index NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT=%Y.%m.%d.%H.%M.%S.%Q TIME_PREFIX=\t\d+\t\d{1,2}\t MAX_DAYS_AGO=400 DATETIME_CONFIG=NONE transforms.conf [voxeo-vlf] DELIMS="\t" FIELDS=accountid,subaccountcode,sessionid,parentsessionid,machinecode,calledid,callerid,calltype,actionid,sessionstatus,eventtime,dummy,actionnum,int2,int3,int4,string1,string2,string3,string4,sessiondata [voxeo-vlf-index] REGEX=^(\d+)\t FORMAT = accountid::$1 WRITE_META = TRUE And get the following error messages in the log 04-13-2012 18:16:00.040 -0400 WARN DateParserVerbose - A possible timestamp match (Sun Feb 21 08:42:06 1999) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.041 -0400 WARN DateParserVerbose - A possible timestamp match (Sun Feb 21 08:42:06 1999) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.042 -0400 WARN DateParserVerbose - A possible timestamp match (Thu Jun 27 06:35:29 2019) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.042 -0400 WARN DateParserVerbose - A possible timestamp match (Wed Sep 9 05:01:32 1998) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.043 -0400 WARN DateParserVerbose - A possible timestamp match (Wed Sep 9 05:01:32 1998) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.043 -0400 WARN DateParserVerbose - A possible timestamp match (Mon Jul 27 01:34:29 1998) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. 04-13-2012 18:16:00.046 -0400 WARN DateParserVerbose - A possible timestamp match (Mon Jul 27 01:34:29 1998) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. However i can NOT find what logs or events those log messages are talking about. Is there any debug i can turn on in log.cfg to track where it thinks its getting the date time problem from? Also, considering i have TIME_PREFIX and TIME_FORMAT can i have splunk stop trying to find the timestamp in my event since i told it exactly where it is? i tried DATETIME_CONFIG=NONE, but that imported everything with todays date. here is an example (tab separated) log line 42623 95465 984307d59a744e15086d0dafb479b02c host1 8001112222 4075551212 CCX 9 0 2012.04.13.18.58.59.246 0 32 0 7355882050237585344 <features></features> 0-13c4-4f88774e-8d539a74-876-1ced91b8 127.0.0.1:5060 (AppID=95465)(OutDial=) When i get the error message the log line above it is 04-13-2012 18:15:59.711 -0400 INFO ArchiveProcessor - reading path=/Users/rgreen/vlf/d/PopData-12978817080590142-8b31.vlf.gz (seek=164144 len=164144) so i am assuming its complaining about data in that file, but if i do a search for source= i get back the same number of records that are in that file. Spot checking the date/time everything looks ok. Is this just a spurious error message? thanks, rob ... View more

Hello, I have onbox Communigate logs i am trying to get imported into splunk for the PBXApp application. It logs multiline data where the "sender" is unique until it changes. for example 00:00:00.423 5 SIP [a.b.c.d]:5060 <- [a.b.c.d]:5060 inp(527): BYE sip:[email protected] SIP/2.0\r\nVia: SIP/2.0/UDP a.b.c.d. would be time loglevel sender message Maybe i am over thinking this or maybe splunk can't do this, but i want all logs with "sender" being the same until it changes to be one event. I have the data below (and extra line breaks to show where i want the event data split). 00:00:00.423 5 SIP [a.b.c.d]:5060 <- [a.b.c.d]:5060 inp(527): BYE sip:[email protected] SIP/2.0\r\nVia: SIP/2.0/UDP a.b.c.d 00:00:00.423 2 SIPDATA-270876 inp: req [a.b.c.d]:5060 <- udp[a.b.c.d]:5060 BYE(527 bytes) sip:[email protected] 00:00:00.423 5 SIPDATA-270876 inp: BYE sip:[email protected] SIP/2.0 00:00:00.423 5 SIPDATA-270876 inp: Via: SIP/2.0/UDP a.b.c.d:5060;branch=z9hG4bKilja01002gqh1gg0v6o1sd0000010.1 00:00:00.423 5 SIPDATA-270876 inp: From: <sip:[email protected]>;tag=SD6m3gc99-6006245088712893_c1ba.b.c.d0415929401.0_15699560_51184391 00:00:00.423 5 SIPDATA-270876 inp: To: <sip:[email protected]>;tag=000000000035888-46281E9F-1B5CE480 00:00:00.423 5 SIPDATA-270876 inp: Call-ID: [email protected] 00:00:00.423 5 SIPDATA-270876 inp: Max-Forwards: 68 00:00:00.423 5 SIPDATA-270876 inp: CSeq: 2 BYE 00:00:00.423 5 SIPDATA-270876 inp: Content-Length: 0 00:00:00.423 5 SIPDATA-270876 inp: Route: <sip:a.b.c.d:5060;lr> 00:00:00.423 5 SIPDATA-270876 inp: Route: <sip:rev.23009616.dialog.cgatepro;lr> 00:00:00.423 5 SIPDATA-270876 inp: 00:00:00.423 4 SIPDATA-270876 Hash=2017930222 00:00:00.423 4 SIPDATA-270876 self-route removed: <sip:a.b.c.d:5060;lr> 00:00:00.423 4 SIPDATA-270876 special route detected: sip:rev.23009616.dialog.cgatepro;lr 00:00:00.423 2 SIPDATA-270876 created SIPS-408676 00:00:00.423 4 ACCOUNT(pbx) taken from cache 00:00:00.423 4 ACCOUNT(pbx) placed in cache 00:00:00.424 2 SIPDATA-270877 out: rsp [a.b.c.d]:5060 -> udp[a.b.c.d]:5060 200-BYE(424 bytes) 00:00:00.424 5 SIPDATA-270877 out: SIP/2.0 200 OK 00:00:00.424 5 SIPDATA-270877 out: Via: SIP/2.0/UDP a.b.c.d:5060;branch=z9hG4bKilja01002gqh1gg0v6o1sd0000010.1 00:00:00.424 5 SIPDATA-270877 out: From: <sip:[email protected]>;tag=SD6m3gc99-6006245088712893_c1ba.b.c.d0415929401.0_15699560_51184391 00:00:00.424 5 SIPDATA-270877 out: To: <sip:[email protected]>;tag=000000000035888-46281E9F-1B5CE480 00:00:00.424 5 SIPDATA-270877 out: Call-ID: [email protected] 00:00:00.424 5 SIPDATA-270877 out: CSeq: 2 BYE 00:00:00.424 5 SIPDATA-270877 out: Server: CommuniGatePro/5.2.11 00:00:00.424 5 SIPDATA-270877 out: Content-Length: 0 00:00:00.424 5 SIPDATA-270877 out: 00:00:00.424 5 SIP [a.b.c.d]:5060 -> [a.b.c.d]:5060 out(424): SIP/2.0 200 OK\r\nVia: SIP/2.0/UDP a.b.c.d:5060;branch=z9hG4bKilja01002gqh1g 00:00:00.424 2 SIPDATA-270878 out: req [a.b.c.d]:5060 -> udp[a.b.c.d]:5060 BYE(570 bytes) sip:[email protected]:5060 Once the "sender" changes then there is no going back.. Said another way, the log lines are not interspersed. Is this possible? A side question but of lesser importance is that the "date" of the log line is in the filename, is there a way to extract it from it? i.e. the above contents would be a in a file called 2012-04-09.log. thanks, rob ... View more

I am having a heck of a time trying to debug advanced xml so i am wondering if maybe i am just missing something. Basically i have a view with advanced xml in it, i have to do this modify the xml bin/splunk restart (not just restart splunkweb) reload ui and re login browse to my app and load the view if it doesn't work goto step 1 is there an easier way for modifying the xml is the first question, and the second question are there logs i can look at that tells me why my view isn't working? usually my panel is blank with no reason as to why. even things like search query being bad doesn't display in the messages panel. I am using an xml editor so the xml is well-formed. rob ... View more

We have our logs always generate a sessionid but each host has a separate sessionid with a link to the original as parentsessionid. I am trying to get a splunk query for when a session id is entered it will return back all the logs for all the hosts following the child parent relationship. something like this hostA: sessionid=aaa parentsessionid=null name=value name2=value2 hostB: sessionid=bbb parentsessionid=aaa name=valuexx name2=value2 hostC: sessionid=ccc parentsessionid=bbb name=valueyy name3=value3 if someone enters aaa i would like all three sessions to be returned in the query in order (as the session is running on all 3 at roughly the same time and in general one event on one host causes another event on a different host) rob ... View more