36,03/26/20,13:12:04,Packet dropped because of Client ID hash mismatch or standby server.,IP,,B88584ADE973,,0,6,,,,,,,,,0 36,03/26/20,13:12:04,Packet dropped because of Client ID hash mismatch or standby server.,IP,,B88584ADE973,,0,6,,,,,,,,,0 11,03/26/20,13:12:04,Renew,IP,Oscarphone8,B841A4B2E9C8,,2541188417,0,,,,,,,,,0 11,03/26/20,13:12:04,Renew,IP,Oscarphone8,B841A4B2E9C8,,2541188417,0,,,,,,,,,0 31,03/26/20,13:12:04,DNS Update Failed,IP,xxx.jp,,,0,6,,,,,,,,,2 30,03/26/20,13:12:04,DNS Update Request,IP,xxx.jp,,,0,6,,,,,,,,,0 11,03/26/20,13:12:04,Renew,IP,xxx.jp,105BADA1EB91,,999576276,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0 31,03/26/20,13:12:04,DNS Update Failed,IP,xxx.jp,,,0,6,,,,,,,,,2 30,03/26/20,13:12:04,DNS Update Request,IP,xxx.jp,,,0,6,,,,,,,,,0 ... View more

So I have to update my datetime.xml file in Splunk because timestamp extraction problem after 1jan 2020. According to splunk we have to override new file provided from them to existing file. Now my question: I have 10I, 20SH, 2HF, 1000's of UF. Do i need to update datetime.xml on just my Heavy forwarders? Do i need to update new datetime.xml on all indexers as well? If yes, Please help me how to push configuration from master. Thanks ... View more

SPL: "(index=3y OR index=3mon) (host=x OR host=y) name="RegisteredUserLog" actionType=egg pointGet=true (platform=0 OR platform=1) | eval earned_date=strftime(_time, "%Y-%m-%d") | stats count by event_id earned_date | rename event_id as easy_id | table easy_id earned_date" Notes - The data I am seeing today is different from when i saw and exported same data before 1 moth providing same date range. - To give you idea, I am seeing 20K less results as compared to 1L events before one month for exact SPL and exact time range. - Retention of index is not issue - Date range is not issue Please help Thanks ... View more

2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic - 2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic - 2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic - 2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic - 2019-11-06 16:13:21,886 [9] DEBUG B005_01_01BusinessLogic - Please write the LINE_BREAKER for these events, i know splunk will automatically do it for these events but these are not the only events I have. I cannot share share those events here. However every time stamp starts like this. If there is additional info to be written in props.conf. Please write Thanks ... View more

I have a sourcetype named "abc" It is configured to CHARSET=UTF_8 When I see the events, some events split because of no reason and when i check those particular events, they have encoding of utf-16. What do I do? ... View more

We had to stop an indexer and add new one into cluster. Splunk generally automatically handles bucket replication but I am getting error. Please help ... View more

Hi Please help me understand what will this saved search do? index=os sourcetype=splunk_health_check |eval value=delay_status |eval message=if(status=="OK","",status) |eval status=if(status=="OK",status,"NG") |eval score=if(value==99,-1,value) |table _time sh status score message |rename sh to searchhead |search score<5 AND status!="OK" message!="*No error" AND message!="Proxy Error" source is a script. for HOST in ${HOSTS} do URI=http://${HOST}:80 count=99 result= /opt/splunk/bin/splunk search "index=${INDEX} sourcetype=${SOURCETYPE} SPLUNK_HEALTH_CHECK |stats count" -earliest_time ${EARLIEST} -latest_time ${LATEST} -uri ${URI} -auth ${USER}:${PASS} -preview F -output csv -timeout ${TIMEOUT} 2>&1 |grep -v count |tr -d '\n' |sed 's/"//g' if expr $result : '[0-9]*' > /dev/null 2>&1; then count=$result result="OK" fi date +"%Y-%m-%d %T sh=${HOST} status=\"${result}\" delay_status=$count" done ... View more

If we write the script, how do we pass authentication in bash? ... View more

Normally if run a query on SPLUNK and go to visualization with line chart. The query is simple count of logs indexed in one particular index per day. Normal days: Graph is normal This problem day: Line chart is doing lot of ups and downs(to almost zero). and then rising back. How to I troubleshoot this. What could be the problem? ... View more