Seems to have something to do with the use of current_only = 1. I removed that and everything started working again. ... View more

create $SPLUNK_HOME/etc/system/local/indexes.conf and add these lines: [_audit] homePath = $SPLUNK_DB/audit/db coldPath = $SPLUNK_DB/audit/colddb thawedPath = $SPLUNK_DB/audit/thaweddb tstatsHomePath = volume:_splunk_summaries/audit/datamodel_summary Change the paths as you wish. Stop splunk, copy/move the files to the new location, start splunk. ... View more

Try this: index=_internal sourcetype=splunkd | stats count by log_level ... View more

Simple (but inefficient) solution: index=ili_imaging_index earliest=-1d@d latest=@d | stats count Somewhat more complex but much faster solution: run this scheduled search at midnight every day: | metadata type=hosts index=ili_imaging_index | stats sum(totalCount) as totalCount Enable summary indexing for this search, then use the difference between the totalCount values for two consecutive days to calculate how many events were indexed. ... View more

As in most cases, the answer is "It Depends". Particularly on what type of props.conf parameters you are talking about. Perhaps a look here can help; http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings /Kristian ... View more

this answers the question http://splunk-base.splunk.com/answers/4661/why-is-my-sourcetype-auto-classified-as-too_small ... View more

A much quicker and more efficient approach would be to use the metadata command instead (if these sourcetypes you define have gotten events at least at some point). | metadata type=sourcetypes | search sourcetype="PROD_FIC_NJ_OMNI_LOG" OR sourcetype="PROD_HODA_MN_OMNI_LOG" OR sourcetype="PROD_HODA_PA_OMNI_LOG" OR sourcetype="PROD_NBCAP_OMNI_LOG" | where lastTime<now()-14400 ... View more

Events indexed in last 7 days earliest=-7d@d latest=@d index=_internal source="*metrics.log" group="per_index_thruput" | timechart span=1d sum(ev) by series | fields - VALUE_* Top 5 sourcetypes in last 7 days earliest=-7d@d latest=@d index=_internal source="*metrics.log" group="per_sourcetype_thruput" NOT (series=splunk* OR series=searches OR series=audittrail OR series=stash OR series=scheduler) | top limit=5 series Top 5 alerts emailed in last 7 days index=_audit action=alert_fired | top limit=5 ss_name Getting this by sourcetype doesn't make sense. Alerts are not bound by sourcetypes, they're orthogonal concepts. Conditions for alerts are independent of the sourcetype, unless you specify it in the alert search Choose a visualization you like from the samples, replace the search with the ones above and away you go .. Because my simplexml-fu is weak Example : <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>Throughput Summary</label> <row> <chart> <searchString>index=_internal source="*metrics.log" group="per_index_thruput" | timechart span=1d sum(ev) by series | fields - VALUE_*</searchString> <earliestTime>-7d@d</earliestTime> <latestTime>@d</latestTime> <title>Indexed Events</title> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> </chart> </row> <row> <table> <searchString>index=_internal source="*metrics.log" group="per_sourcetype_thruput" NOT (series=splunk* OR series=searches OR series=audittrail OR series=stash OR series=scheduler) | stats sum(ev) as Events by series | sort -count | head 5 | rename series as Sourcetype</searchString> <earliestTime>-7d@d</earliestTime> <latestTime>@d</latestTime> <title>Top 5 Sourcetype by Volume</title> </table> </row> <row> <table> <searchString>index=_audit action=alert_fired | top limit=5 ss_name | rename ss_name as "Saved Search" count as Alerts | fields - percent</searchString> <earliestTime>-7d@d</earliestTime> <latestTime>@d</latestTime> <title>Top 5 Alert Generating Searches</title> </table> </row> </dashboard> And because advanced XML is better <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>Throughput Summary</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="HiddenSearch" layoutPanel="panel_row1_col1_grp1" group="Indexed Events" autoRun="True"> <param name="earliest">-7d@d</param> <param name="latest">@d</param> <param name="search">index=_internal source="*metrics.log" group="per_index_thruput" | timechart span=1d sum(ev) by series | fields - VALUE_* | fillnull value=0</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> <module name="HiddenChartFormatter" layoutPanel="panel_row1_col1_grp1"> <param name="charting.chart">column</param> <param name="charting.chart.stackMode">stacked</param> <module name="JSChart"/> </module> <module name="HiddenPostProcess"> <param name="search">addtotals | fields _time Total </param> <module name="SimpleResultsTable" layoutPanel="panel_row1_col1_grp2"> <param name="displayRowNumbers">off</param> </module> </module> </module> </module> </module> <module name="HiddenSearch" layoutPanel="panel_row2_col1_grp1" group="Top 5 Sourcetypes by Volume" autoRun="True"> <param name="earliest">-7d@d</param> <param name="latest">@d</param> <param name="search">index=_internal source="*metrics.log" group="per_sourcetype_thruput" NOT (series=splunk* OR series=searches OR series=audittrail OR series=stash OR series=scheduler) | stats sum(ev) as Events by series | sort -Events | head 5 | rename series as Sourcetype</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1_grp1"> <param name="charting.chart">pie</param> <param name="charting.chart.sliceCollapsingThreshold">0</param> <module name="JSChart"/> </module> <module name="SimpleResultsTable" layoutPanel="panel_row2_col1_grp2"> <param name="displayRowNumbers">off</param> </module> </module> </module> </module> <module name="HiddenSearch" layoutPanel="panel_row3_col1_grp1" group="Top 5 Saved Searches by Alert Generation" autoRun="True"> <param name="earliest">-7d@d</param> <param name="latest">@d</param> <param name="search">index=_audit action=alert_fired | top limit=5 ss_name | rename ss_name as "Saved Search" count as Alerts | fields - percent</param> <module name="JobProgressIndicator"> <module name="EnablePreview"> <param name="display">False</param> <param name="enable">True</param> <module name="HiddenChartFormatter" layoutPanel="panel_row3_col1_grp1"> <param name="charting.chart">pie</param> <param name="charting.chart.sliceCollapsingThreshold">0</param> <module name="JSChart"/> </module> <module name="SimpleResultsTable" layoutPanel="panel_row3_col1_grp2"> <param name="displayRowNumbers">off</param> </module> </module> </module> </module> </view> ... View more

this works index = ili_imaging_index| eval latency =_time - _indextime| stats sum(latency) by host ... View more

There is another answer on this: http://splunk-base.splunk.com/answers/517/how-to-search-recent-alerts-fired-by-splunk index=_audit action=alert_fired | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity ... View more

eper Splunk support, not possible ... View more

a fix to the regex of vm\d\d to VM\d\d fixed the issue ... View more