Hello, We are looking to create a search that will return when two similar events occur within 1 second of each other. Sample log search results: 2022-04-19 18:42:39,210 INFO [stdout] (default task-43) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:39:31,142 INFO [stdout] (default task-43) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:35:38,403 INFO [stdout] (default task-41) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:35:38,371 INFO [stdout] (default task-42) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:34:01,696 INFO [stdout] (default task-40) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:30:36,450 INFO [stdout] (default task-39) [core.service.RestService] ==============POST Send Family============= 2022-04-19 16:57:39,144 INFO [stdout] (default task-36) [core.service.RestService] ==============POST Send Family============= 2022-04-19 14:01:42,904 INFO [stdout] (default task-153) [core.service.RestService] ==============POST Send Family============= 2022-04-19 13:46:00,629 INFO [stdout] (default task-153) [core.service.RestService] ==============POST Send Family============= 2022-04-19 13:42:39,944 INFO [stdout] (default task-153) [core.service.RestService] ==============POST Send Family============= 2022-04-19 13:32:59,488 INFO [stdout] (default task-145) [core.service.RestService] ==============POST Send Family=============   We would like a query to be able to return results when events occur, like the following times, since they are so close together: 2022-04-19 18:35:38,403 INFO [stdout] (default task-41) [core.service.RestService] ==============POST Send Family============= 2022-04-19 18:35:38,371 INFO [stdout] (default task-42) [core.service.RestService] ==============POST Send Family============= Is there a way we can generate a query that would find something like that?   Thanks!     ... View more

We have an issue where for some reason, Splunk stops reading a log file in a particular Data Input folder. The log is set to roll hourly. If we disable the Data Input, and then Re-Enable it, it starts reading the log again (which is probably the next log). We have a scheduled task that runs every hour to determine if it has captured any data in the past hour. If it has not, we receive an email letting us know it is hung up and we have to Disable/Enable again. Is there a way to do so via a script? We are working to figure out what is wrong and have a case open, but are looking for an intermediary solution. Thanks. ... View more

Hello, By default: Splunk Enterprise decompresses archive files before it indexes them. It can handle these common archive file types: tar, gz, bz2, tar.gz, tgz, tbz, tbz2, zip, and z. (http://docs.splunk.com/Documentation/Splunk/6.1.6/Data/Monitorfilesanddirectories) Is it possible to configure Splunk to not do this? Or another way to handle our scenario? We have a Windows directory input path that we are indexing *.log files. The problem is, there are .zip files in that folder that also contain *.log files, but we want to ignore those. Thanks in advance. ... View more

We are trying to create a Timechart showing the number of occurrences of 2 strings. Here is the search: index="prodXlogs" "socket write error" OR "java.sql.SQLException" | timechart count(eval("socket write error")) AS SWE, count(eval("java.sql.SQLException")) AS JSE The results are inaccurate. For example, on 1/27/2016, there are 6 events that match java.sql.SQLException, with 0 matching "socket write error". On 1/26/2016 there are 31 events that match java.sql.SQLException, with 4 matching "socket write error". The results we are getting for each _time appears to be the total occurences for that day, not the individual totals: _time SWE JSE 2016-01-24 0 0 2016-01-25 35 35 2016-01-26 35 35 2016-01-27 6 6 Also, in the visualization, it is showing 2 charts, not 1. What are we doing wrong? Thanks! ... View more