Probably it's not chosen, it's just "lazy" coding for input checking and extractions. You could create an idea for fix this on ideas.splunk.com. Add: I actually create a new idea for it https://ideas.splunk.com/ideas/EID-I-2035 ... View more

Just add the following to the search you have so far: | timechart sum(cnt) by scanner_type ... View more

I'm sorry that I don't have the sample data. When I tried to solve the question I asked ,I used nomv() method and found that the single value's type is string. Therefore, I asked the following question. ... View more

Still doesn`t work, it should be splunk limit. https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond.html ... View more

I believe there is a minor bug here. In the Email settings page "Send mail as" field is optional, however on sendemail.py file, this field is required. It is being used without any null/none check on line 96. When i enter a valid sender address i get no error, if i dont enter i get "'NoneType' object has no attribute 'find' while sending mail to: ...." error. sendemail.py code; # make sure the sender is a valid email address if sender.find("@") == -1: sender = sender + '@' + socket.gethostname() if sender.endswith("@"): sender = sender + 'localhost'* I face this issue in; Splunk Version Splunk Light Version 6.4.1 Splunk Build debde650d26e ... View more

yeah, it is...you know nothing jon sno ... View more

I fixed this issue on my end by changing the mail host from mail.test.com:25 to mail.test.com Getting rid of the port fixed it for me. ... View more

Hi, Try this, LINE_BREAKER = ([\r\n]+)\[[^\]]+\]\[\d{4}\-\d{2}\-\d{2}\s++\d{2}\:\d{2}\:\d{2}\,\d{3}\]\[tid\: THat should break the events better for you ... View more

If you download the latest version (0.6) , you can now declare a charset to be applied in the DefaultMessageHandler for the decoding of the received byte payload from Kafka. ... View more

Could you add a bit more context? I'm specifically wondering about your use of the word target and whether that is implying a lot of context that I am missing. I've strictly worked with Splunk in the last couple of years and am at a disadvantage in recognizing some of the terminology assumed by users of the other platforms. Splunk can create a single search job that returns many events across multiple indexes. When it is reasonable to create custom fields at index time, these are very efficient to search at very high scale but come with lots of advisory notices since poor decisions on deploying these can be very troublesome to recover from. The most efficient such statistical search would be based on tstats, which works great for statistics assuming you do not require the search output to contain the full event text but just a summary of counts of events matching various conditions and the like. tstats can not be run using a Splunk real-time search so you would likely use a scheduled job with a historic search across a recent time frame that is within your tolerance level for processing latency. Configure index time field extractions: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-timefieldextraction tstats: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats ... View more

Some props configurations had to be in the SH and other had to be in the IDX, so you just need to configure the settings in the right place. Check this: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F Regards ... View more

If you want to see information about Splunk's annual user conference, go to http://conf.splunk.com Registration for this year's conference is open, and information about last year's conference is available. As Mitesh points out, the IOS app was designed for conference attendees to manage their schedules in October 2013. If you want to download Splunk apps, go to http://apps.splunk.com ... View more

perlish - You can find the details of the app here: link But the Splunk App for PCI Compliance is a premium app, so you'll need to contact your sales person to purchase it or to get a demo. There should be a "Contact Sales" button on that page I linked to. ... View more

I would start by reviewing this troubleshooting section of the documentation related to the Splunk App for AD. ... View more

The answer is no longer working on splunk db connect v2. Anyone have a solution for db connect v2? ... View more

Hi Icrielaa, I can not access the web server,I can only access the url,and I thought wget is not the best way,but it seems it's the only way to do that.I hope there's a APP to make it. Thanks for your reply. ... View more

Splunk server runs on a linux server, and I have disabled the iptables. ... View more

There are numerous answers to your question, here are some, but you should go and some more for a better understanding: bad timestamp extraction no timestamp extraction (splunk takes time from file date, or system time) different timezone (set for the sourcetype in props.conf, you have changed time settings on the indexer system, timezone set for the user viewing the events ) ... View more

spent too much time editing... ... View more

Fair enough but my point stands that this props.conf should be exported to every node that needs to modify the data (forwarders and indexers) and my suspicion is that it has not been so distributed. ... View more

The crash logs would be called 'crash-yyyy-mm-dd-HH:MM:SS.log'. ... View more