Hi all! I am using splunk ver5.0.5 on RHEL 5 and appreciate if you can answer to my question. I have set up srchJobsQuota in authorize.conf and confirmed it had worked by the log. [role_operation] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 rest_apps_management = disabled rest_apps_view = disabled rest_properties_get = disabled rest_properties_set = disabled rtSrchJobsQuota = 2 search = enabled srchDiskQuota = 500 srchIndexesAllowed = _internal srchIndexesDefault = main srchJobsQuota = 2 srchMaxTime = 0 07-22-2014 13:24:35.970 +0900 WARN DispatchCommand - Search not executed: Your maximum number of concurrent searches has been reached. usage=2 quota=2 user=operation. SearchId=1406003074.82 My understanding is that the search that was not executed is discarded instead of going into the waiting queue and wait till the earlier search is done. Is my understanding correct? Thanks, Yu ... View more

Hi! I would like to ask question related to following thread. http://answers.splunk.com/answers/8107/return-only-the-first-matching-event Similar situation but bit different. I have a search index=A | lookup Pack OUTPUT status | where status="updated" | stats first(fieldA) by Pack If I execute above search , result is fine but it keeps searching until end of indexA. I want to stop the search after all the first() are returned. Is this possible? Thanks, Yu ... View more

Hi! I would like have some advice with the search command. If I have 3 records like below and each record contains some fields A,B _time A B 5/13/2014 05:00 5/13/2014 00:00 4 5/13/2014 01:00 5/13/2014 03:00 3 5/11/2014 00:00 5/12/2014 01:00 2 Above records is in summary index. My goal is to search 3 of field B where the time of field A is the latest. And want to implement this in search command. I know I can do this by changing the _time to A So, index=xxxx | eval _time = strptime(xxxxxx) | stats latest(B) But I already have a stat using the current _time index=xxxx | stats sum(B) Somehow I want to combine two stat in very effective manner. So if something like vlookup of excel is possible it would be easy but its not possible. index=xxxx | stat latest(A) | lookup [latest(A)] OUTPUT field B <- Dont want to create the lookup table. Any idea of how to implement this with splunk ver 5.0.5? Thanks, Yu ... View more

Hi! I would like to get advice for search command. I have a search that looks like below. index=A | MySearch1 .... | join type=outer fieldA [ search index=B | MySearch2 .... ] | join type=outer fieldA [ search index=A | MySearch3 .... ] | join type=outer fieldA [ search index=C | indexMySearch4 .... ] I also have a list of fields which I want to search for. The list includes about 20,000 values Fields A B C D E ... I want to use this list as a input and filter the result with just above values. I understand that my choices are 1.Use Map, 2.Use inner join ,3. Use subsearch But none of seems to work out... I appreciate if someone can share experience of how to filter with thousands of values. Thanks, Yu ... View more

Hi ! I would like to ask question regarding to the order of processing of subsearch. If I write as index=A [ search hoge ] | join type=inner fieldA [ search test] Will the search hoge will be executed first? Thanks, Yu ... View more

Hi all! I would like to ask question regarding to search. I have a search including couple of joins. index=A *1 | join xxxx [ index=B ] *2 | join xxxx [ index=C ] *3 | join xxxx [ index=D ] *4 each index has more than 20 million records. According to the search.log, when I execute the search once it processes as *2->*3->*4->*1 it went back to *2 and then processes same flow. I have confirmed this in search.log in dispatch directory. I found a line in the log that says, Stats Processor - reached limit max_mem_usage_mb=200 , results may be incomplete but couldn't confirm if this is related. Is this a natural operation for splunk? I appreciate if someone can give me advice. Thanks, Yu ... View more

Hi! I would like to know how does the mode function behave in the stats command in following situation. fieldA fieldB fieldC Date a 1 1 1/2/2014 0:0:0 1 2 1/3/2014 1:0:0 b 1 1 1/4/2014 0:0:0 c 1 1 1/5/2014 0:0:0 If I execute xxxx | stats mode(fieldC) by fieldA I expect the mode to return "2" . However, in some cases , it returns "1". What will be the correct behavior? Should it return the most earliest value if the occurence is the same? Thanks, Yu ... View more

Hi! I would like to know if it is possible to add outputlookup and inputlookup in same search. My purpose is to create a table dynamically and use it in other sub searches. I thought this can be possible by using subsearches but bit struggling with it. index=hoge [ sub search outputlookup return "" ] [ | inputlookup xxxxx] but alsways the inputlookup runs before the outputlookup. Any suggestions ? Thanks, Yu ... View more