Assuming this is a "standard" NC installation, the missing dashboards should "light up" after a certain amount of data has been retrieved. The default time period for the dashboards is 7 days, you could try to choose a shorter time period and see if the dashboards then populate. I know that some data doesn't populate if for example single sign-on is configured, but if that is not the case and you still don't see the dashboards light up, do get in touch. Defined users are the number of users you have created on the NC server (assuming you are using the built-in NC authentication methods) and active users is (I assume) the number of users that have been active on the NC server during a given time period. You can see the same data (but only in realtime, no historical data) if you log in as the NC admin on the NC server, then click the "icon" representing that user in the upper right corner. Now choose "Settings". A menu will appear on the left side, click on "System". ... View more

Based on the error message, my guess is that either the "curl" command isn't installed on the host where the scripts are, or the scripts can't load the curl command. So check for the curl command first. If it does exist, find the location (the "whereis" command is useful for that) and modify the scripts so the path precedes the curl command. ... View more

The missing data corresponds with the data which is pulled in with the Nextcloud Add-on (https://splunkbase.splunk.com/app/3397/). The Add-on contains two scripts which pull the data from some Nextcloud REST API endpoints. The install guide (link to which is in the Splunkbase entry for the Nextcloud App) explains how to configure the Add-on so the scripts can pull the information from your Nextcloud server. Once the Add-on is installed (or in case it is already installed, you may also wish to consult the “Other > App debugging” dashboard which contains information useful to understand why the scripts may not be working correctly. ... View more

The first line of SPL for the "Login activity over time" panel in the "User login activity" dashboard in v2.6.1 of the app looks like this: sourcetype=TERM(nextcloud-log) ncApp=admin_audit message="Login successful*" user="$userToken1$" user="$user$" url!=TERM(*/ocs/v2.php/apps/serverinfo/api/v1/info) and not like the line you have shown in your question. Was the dashboard that didn't work ever modified before installing the latest app? If that is the case, the modified dashboard takes precedence and the new dashboards in the latest version of the app will not be used. You could try to move the dashboards in the "local" directory to somewhere safe, then restart the Splunk server to see if the default dashboard then works. ... View more

Could you check which version of the add-on and which version of the app you have installed? I think you have an older version of the app, but the latest version of the add-on. In the latest version the query looks different. The EVAL-app = "nextcloud" statement is not a bug or mistake, but is there to make the data CIM compatible. CIM (Common Information Model) is a data model that enables for example Splunk ES to make use of the data, and CIM makes use of a field named "app". Instead, the latest app (and add-on) renames the field name to "ncApp". I guess the developer messed up by not making it clear when the add-on was updated that a requirement was that the app also be updated (assuming the above is the reason it isn't working for you). ... View more

Splunk Stream (https://splunkbase.splunk.com/app/1809/), a free Splunk supported app/add-on, can collect Netflow data, but in terms of analysing specifically the Netflow data there are no built-in dashboards. I have seen a number of different Netflow related dashboards made by customers to visualise the data. The Stream app can do a lot of things not possible with Netflow on its own, and the app does have dashboards out of the box for some of that capability. ... View more

Depending on your unix system (or Linux distro), most (all?) of that data will be found in for example auth.log. If it isn't you may need to change the verbosity level of the logging taking place. If you want more specific help, it would help to know what unix you are using. ... View more

Perform the cleanup in, say, a looping script that writes the cleaned up events to a separate log file and then have the UF pick up events from that log file? ... View more

It is impossible to figure out what the carbon footprint will be just based on the software you are using, how much electricity the process uses depends on the CPU, the disks, the power supplies (and all the other components) in the server where Splunk is installed. But here is a way to figure it out. First, find out what the baseline electricity use of the Splunk server is over a given period of time (maybe 24 hours?) without running the processes you want to know the carbon footprint for. Then run the processes for which you want to know what the carbon footprint is for the same period as you ran the Splunk server to discover the baseline use was. Again, measure the amount of electricity used during the measuring period. Subtract the value you just measured from the baseline. If there is little difference, make the measuring period longer. Find out how much carbon dioxide is produced per kWh by your electricity supplier. If your supplier has a lot of nasty old coal-fired power plants, the number is going to be high. If the supplier sources their electricity from lots of wind turbines, the number os going to be lower. Now do the maths. Lets assume that you find that the server uses 5 Wh of electricity more over a 24 hour period and that the carbon footprint of your supplier is 500 gram/kWh, the calculation would look something like this: 0.005 kWh * 365 days * 0.5 kg co2 = 0.9125 kg. That would be the carbon footprint for the process. However, how precise should this number be? Is the Splunk data stored in a SAN? If it is, maybe you should also find out how much extra electricity the SAN is using. Is the Splunk server a single instance or in a cluster? What about the database the data is being pulled from? What about the electricity used to send data from the Splunk server to the user when they access it? Now you are involving switches, maybe also routers and firewalls. Is the server in Seattle and the user in New York? How much electricity do the ISPs use to get the data from your data center to the user? ... View more

The write_splunk plugin is not a standard collectd plugin so if you've installed the standard collectd package for Ubuntu 16 you won't have that plugin and hence you might see the error message about an unknown plugin option. At least this is my guess. There are many ways to collect (no pun intended) collectd data and the write_splunk plugin is only one of them. If the write_splunk plugin is what you want to use, you will need to get it from a Splunk instance that has the Splunk App for Infrastructure (link text) installed. If you do install that, it can create a CLI script that will install and configure collectd for you. Alternatively I would suggest you look at the answer to this question as it has several links to more inforation that might provide the answer you need: link text If you are using the standard collectd package, one of the ways to collect data is using write_http, however as I recall the collectd package that came with Ubuntu 16 is too old to have the write_http plugin. ... View more

The above may be clear enough. I would add that several indexes can be "default" indexes, so as an example both the "main" and the "nextcloud" indexes can be default indexes. Any index that is a "default" index can be searched without specifying the "index=. ... View more

This is an old question, but the answer may be relevant for other similar situations. If you are a Splunk Cloud customer, request the latest version of the app to be installed on your Splunk Cloud instance via a service ticket. Unless there is something in the app which won't be allowed in Splunk Cloud, the cloud ops team should then (after some time) vet the app for Splunk Cloud. ... View more

I don't know if this will solve the problem for you. In a PoC I did with this app, all the throughput values were '0'. However, there are some other issues with the dashboard which may be solved by: -Clicking on the "Edit" button for the dashboard -Click on the pencil (Edit input) for the "VNX block Array" -Scroll down to "Search string" The search string defines index=vnx, change this to `vnx_index` (include the back-ticks!) -Click the pen (Format visualisation) in the "Heat Map - LUN Throughput (IOPs)" panel where you may need to change the number of categories which is set to 10, you may need to set it to 100. ... View more

Before going through the pin of converting epoch, maybe the "delta" command will do what you are looking to achieve. Delta will compute the difference between nearby results using the value of a specific numeric field. When used on the _time field it returns the difference in seconds. ... View more

First step could be to use the “psv” (pipe-separated value format) source type. When you add logs to Splunk, at the “Set Source Type” step, as source type choose “Structured > psv” or create your own source type (as you have done). If you create your own source type, when you are at the “Set Source Type” step, open “Advanced”, click on “New setting”, add “FIELD_DELIMITER” (without the quotes) as a new “Name” and as “Value” use the pipe (|) character. If you need to further split your data into key/value pairs, regex is the next step, but this is not as scary as it sounds. You can use the "Field Extractor" to show Splunk what you want extracted and Splunk will create the reggae for you. See here for the steps to follow: http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/ExtractfieldsinteractivelywithIFX ... View more

Migrating on-prem data: Speak to your Splunk rep. Anything requiring CLI access: Issue a jira ticket to the cloud ops team. Migrating apps: assuming the app is a self-made one, it needs to be vetted by the cloud team. for more information, see here: http://docs.splunk.com/Documentation/SplunkCloud/latest/User/GetSplunkCloudapps ... View more