can you give examples of filenames in the monitored directory? ... View more

What is the scripted input doing? ... View more

Can you successfully call the lookup using the inputlookup command? ... View more

Give this a try earliest=-5m@m index=<myindex> sourcetype=<mydata> | fields Timedelay Label | eventstats max(Timedelay) AS max_Timedelay by Label | stats avg(max_Timedelay) AS avg if you want the same results over a large window of time, you can do this earliest=-24h index=<myindex> sourcetype=<mydata> | fields Timedelay Label | bucket span=5m __time | eventstats max(Timedelay) AS max_Timedelay by Label _time | stats avg(max_Timedelay) AS avg by _time ... View more

I believe this will return what you're looking for index=<someindex> sourcetype=JobStatuses NOT [search index=<someindex> sourcetype=JobStatuses | rename JobId AS ParentJob | stats count by ParentJob | fields - count] ... View more

How do you identify a child job? ... View more

I've done this in the past from the file system find /opt/splunk/etc/apps/ -name 'savedsearches.conf' | xargs 'sed -i s/sourcetype=\"wineventlog:midwayusa\"/sourcetype=\"wineventlog:midwayusa\" OR sourcetype=httpErrorLog/g' That of course assumes you are using a Unix OS. The -i option in the sed command does a replace in file. You can create a backup of the original file by changing it to the following. sed -i.bak that will add a savedsearches.conf.bak for each file it changes. I suggest testing first. After you've updated, you will need to run a debug refresh on the Splunk instances the changes were made http://localhost:8000/en-US/debug/refresh <-- example. but replace localhost with your server of course. ... View more

The license usage logs identify your indexers by their guid, stored in the "i" field, so you will need to translate this into a hostname. The easiest way to do this is by hitting the "licenser/slave" endpoint on your license master and exporting the data to be used as a lookup table on the instance you're searching your license data. The example below assumes you are logged into the GUI on your license master and using the rest search command. | rest /services/licenser/slaves splunk_server=local | fields title label | rename title AS guid, label AS indexer This will generate a table to map guid to server name. Export this data using the export function or output it to a csv using loutputlookup or outputcsv commands. The end goal is to move it to your search instance as a lookup table, which will be used to enrich your license usage data. Once it is there, a search to determine the usage by indexer will be trivial. You can use the predict command for forecasting. earliest=-30d@d latest=-0d@d index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/license_usage.log" type=Usage | fields b | timechart span=1d sum(b) AS b | predict b future_timespan=365 I am no expert on the predict command, so I suggest reading the documentation for tuning purposes. http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Predict ... View more

https://validator.w3.org/check When I checked the validity of the HTML posted above, the validator found 148 errors. I suggest correcting them before trying again. ... View more

Ah, gotcha! The app uses css selectors for grabbing values from the HTML. Looking at your example, your best bet would be to use: .p5 font as your selector. That identifies the p5 class and the child font element. document.write("<tr><td class='p5'colspan=4><b>Hot Water:</b><font size='4'>ON <font face='Arial'></td></tr>"); That select will capture "ON" in the example above. ... View more

Hi Richard There is an app on Splunk Base called website input built for this purpose. https://splunkbase.splunk.com/app/1818/ I use for a similar purpose and it works great. ... View more

The information I have to go on is limited, but I think this will work. index=site_* (sourcetype=hashes_on_hosts OR sourcetype=fileinfo) | stats values(fileinfo_mime_type) AS fileinfo_mime_type values(file_info_date_created) AS file_info_date_created by host hash ... View more

| rest /servicesNS/-/-/admin/macros splunk_server=local | search title=<name of macro> ... View more

what does a cleared failure look like in the events? ... View more

Hi Brett What specifically isn't working for you? The command works as expected for me. ... View more

no problem, glad to help! ... View more

try this | rex field=domain max_match=10 "(?<top_level_domain>\b(?:com|net|edu|org)\b)" | stats count by domain top_level_domain | where count > 1 ... View more

If you don't already, you should start by adding time stamp configurations to your indexers/HWF for this particular source. props.conf [source::abcd.csv] TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%dT%T The time stamp in the event is telling us that it was generated in UTC, 2015-12-18T22:01:19Z <-- that is what the Z means there. Your indexers appear to be in pacific time, so the events are falling on the time line correctly ( _time = UTC-8 ). If these things are both true, then the timezone offset is correct. However, the events are appearing about 3 hours in to the future. 10791 seconds of positive difference between _time-_indextime. If this data is coming from a splunk forwarder that has a system time zone different to the indexer system time zone, then there will be time syncing issues. This does not appear to be the case here. If the forwarder is sending data that contains a time stamp from a different time zone than the forwarder system time zone, then there will be time syncing issues as well. In past experiences, dealing with similar problems, I am going bet that the forwarder system time is UTC+3 and some application is writing a csv log in UTC. If this is true, the best way to correct this issue is to change the forwarder system time to UTC. If you can do that, then the positive latency should be corrected. Basically, your indexers think this data is coming from an alternate UTC that exists 3 hours in the future. ... View more

index= sourcetype= | fields src signature | stats count by src signature | where count >= 2 ... View more

The search I provided you is giving a count of job_id's where the action of both start and end exists. A stats count is simply going to give you a count of events where either exist. ... | stats values(JobName) AS JobName by Action ^^ that doesn't return anything? ... View more

oops! sorry! replace the where with this | where isnotnull(mvfind(action,"start")) AND isnotnull(mvfind(action,"end")) ... View more