Hi, You can use code below to "sort" events in more granular way to overcome default timestamp ingranularity (no milliseconds). Verified, it works. Field "_cd" is an internal field in a format of :. Each event belows to a bucket and has offset (position) in raw data file) sourcetype="mssql:errorlog" | rex field=_cd "(?<bucket>\d+):(?<address>\d+)" | sort _time, address Output example: 2018-11-25 14:03:19.**19** Server Microsoft SQL Server 2016 (SP1-CU3) (KB4019916) - 13.0.4435.0 (X64) Apr 27 2017 17:36:12 Copyright (c) Microsoft Corporation Standard Edition (64-bit) on Windows Server 2012 R2 Standard 6.3 <X64> (Build 9600: ) (Hypervisor) 2018-11-25 14:03:19.19 Server UTC adjustment: 1:00 2018-11-25 14:03:19.19 Server (c) Microsoft Corporation. 2018-11-25 14:03:19.19 Server All rights reserved. 2018-11-25 14:03:19.19 Server Server process ID is 2460. 2018-11-25 14:03:19.19 Server System Manufacturer: 'VMware, Inc.', System Model: 'VMware Virtual Platform'. 2018-11-25 14:03:19.19 Server Authentication mode is MIXED. 2018-11-25 14:03:19.19 Server Logging SQL Server messages in file 'E:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Log\ERRORLOG'. 2018-11-25 14:03:19.19 Server The service account is 'EZCORP\Y1017783'. This is an informational message; no user action is required. 2018-11-25 14:03:19.19 Server Registry startup parameters: -d E:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\DATA\master.mdf -e E:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\Log\ERRORLOG -l E:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\DATA\mastlog.ldf 2018-11-25 14:03:19.**19** Server Command Line Startup Parameters: -s "MSSQLSERVER" --tm ... View more

Thank you! The %Y was the culprit. ... View more

Thanks I suspected so. Time to do some replacements! ... View more

Thanks, guys, I figured so, just wanted a second opinion. ... View more

You could do a transaction by the ip or a session/cookie id if you have it. Transaction will give you the duration of a group of events tied by your field of choice. http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction ... View more

The colours appear in the displayed raw events. ... View more

That's true, "short-circuit" evaluation for OR means you stop evaluating once you've found one true branch. However, that's checked per event. Once an event is found to match the first branch of the OR, there's no need to check the second branch because the overall result already is true. That doesn't affect other events. Note, this isn't exactly the same search as yours. If an event matches both conditions, your append search would return it twice while my OR search would return it once. If your question is solved, do mark it as such by pressing the check mark to the left. ... View more

Please accept this answer if it solves your problem. ... View more

You can get it, now. "Hobbes3 WebGL Globe" I've had a terrible time getting it to render outside the App. It's beautiful inside the App, though. The limitations in the search commands are bad though, only "...| geostats count" works for me. Nothing else renders inside the App on my install. [6.2.1] Hopefully, that gets expanded. ... View more

That script there only looks for data with new time stamps that previously entered in data file. I chose to use the time stamp over the hash method becuase my datafile was getting to large to store in memory and became very slow. The has and dictionary portion are really easy to do. ... View more

Hi, you can control the session time outs. Here is the link to the docs: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Configureusertimeouts ... View more

Awesome, thanks for the help: sourcetype=squid | stats sum(bytes_in) as bytes, by src, dest_host | eval MB = round (bytes/1024/1024, 2) | fields - bytes Removing the top command helps. Thanks again ... View more

After checking splunkd.log and a little troubleshooting, I was able to get the tcp-ssl port to listen and receive ssl encrypted traffic from a third party device. I used the following steps: Generate certs: mkdir /opt/splunk/etc/certs export OPENSSL_CONF=/opt/splunk/openssl/openssl.cnf /opt/splunk/bin/genRootCA.sh -d /opt/splunk/etc/certs /opt/splunk/bin/genSignedServerCert.sh -d /opt/splunk/etc/certs -n splunk -c splunk -p **Note: It will ask you to enter a password In inputs.conf, I used the following: [tcp-ssl://6514] Sourcetype = <your source type here> [SSL] rootCA = $SPLUNK_HOME/etc/certs/cacert.pem serverCERT = $SPLUNK_HOME/etc/certs/splunk.pem password = <The password that was used in the genSignedServerCert> You may want to use netstat -an | grep :6514 to make sure the port is listening after a restart. If not, check /opt/splunk/var/log/splunkd/splunkd.log again for errors. Hope that helps! ... View more

Agreed - we also send to a centralized syslog server running a heavy forwarder. This allows us to do per-event filtering, since our network admins want to keep way more firewall logs than we actually wanted to index in Splunk (or have the licensing for!) ... View more

Hi, thanks for the reply! This trick works, but only if the user's role has "license_edit" capabilities. Did you find a way for a user to just view the license usage, with no rights to edit or delete licenses? ... View more

Thanks lguinn, will give it a shot. ... View more

Hi, Can I hide the App menu for just one App or maybe one user? ... View more

Is there any filtration possible on the control scripts running on the AS/400 server? Production is currently outputting close to 24 Gigs a day ! ... View more

Anyone aware if there is a open source version of syslog agent for AS400.. Seems developing a bespoke syslog tool (as mentioned by southeringtonp ) or using the licensed ones is only option? ... View more