Very smart! Thanks! ... View more

richgalloway's solution works, it was just missing one line of code. Try something like this: | bin indexlag as bin bins=100 | stats min(indexlag) as starting_value count BY bin | sort starting_value | fields - starting_value   ... View more

This works very nicely! ... View more

what limit is that? ... View more

Were you able to get this issue resolved? I'm seeing this issue on a log that is generated on the search head, no forwarder involved. The lines themselves are thousands of characters long so I think I have the same issue as you. ... View more

Yes, his question pertains to mine. Wish I could find something official. Thanks! ... View more

Right, but are there scenarios that cause the default ordering to break? ... View more

The problem with this is that it's very slow as splunk still has to pull all of the events from the disk and then compare them against the lookup. If you use the sub search splunk can use the bloom filters to determine if a bucket is in or out. ... View more

I just came across this gem via a co-worker. do: dedup Order_Number| search NOT[ |inputlookup Order_Details_Lookup.csv |stats values(Order_Number) AS Order_Number] |table Order_Number That will make the subsearch return a single row with a multi-value field containing all of the order numbers but the individual values will get passed along correctly into the base search. ... View more

Using top fixed it for me. Thanks! ... View more

You need to edit the function that calculates the canvas length on the js code for the visualization. ... View more

I think you might be right, this looks like it could be a bug. Yesterday I gave each exec stanza in the inputs.conf file a slightly different source value and it stopped mixing the output from the instances. I previously had 6 separate scripts but in an attempt to make this a more "elegant" solution I consolidated into a single script and this is when this issue reared it's head. ... View more

That's not working 😞 The drop-down only has one option available. ... View more

Nice, all the details are buried in that post. I had missed them on the first skim. : ) ... View more

Thanks. I had previously scoured through these docs trying dig out tstats idiosyncrasies when using datamodels. ... View more

I can't tell you why but I can tell you how I would troubleshoot it: Monitor another file in a different directory and confirm that you are able to index it. One by one, change the attributes of new file to mimic the file you can't index. For example you could: Copy the contents from the snmptrap file into the new file Set the same permissions Copy the file over to the directory where snmptrap is stored. You'll know that the issue is related to the last change you made when the new file stops being indexed. ... View more

Cool blog post! Thanks! ... View more

That's reassuring. Is there any documentation that shows how this "losslessness" works? Thanks! ... View more

Yes, we're using an universal forwarder and doing the filtering on the indexer. Only 5% of the logs in the logfile are relevant. The problem is not the filtering, though. When you rotate a 50GB file weird things start to happen as contention becomes and issue. The issue at the heart of this is that having a single file accumulate 50GB of data in a single day is a bad practice. I found a few posts stating that the upper limit of a log file is a few GB before a forwarder starts to have issues. I got together with the application developer and the person that wrote the log rotation script and they're going to have to redesign the logging to add more structure (have separate files for unrelated events) and change the way the file is being rotated. Thanks! ... View more