Hi, We deployed the Splunk Add-On for Unix & Linux on a few AIX & Netezza servers as noticed a few issues with missing metrics. NETEZZA: All df metrics are not being returned (error message in _internal index shows the following Splunk_TA_nix/bin/df_metric.sh" df: unrecognized option '--output=source,fstype,size,used,avail,pcent,itotal,iused,iavail,ipcent,target' AIX Following IOstat metrics are not being returned. iostat_metric.rReq_PS iostat_metric.wReq_PS   Thanks, AKN ... View more

Hi, We have installed the Splunk Universal forwarder on a VIOS server and pushed the TA-metricator-for-nmon. However, we are unable to get any metrics. A look at the internal logs shows the following error: /splunkforwarder/var/log/metricator/var/nmon_repository/fifo1/nmon_timestamp.dat: A file or directory in the path name does not exist. Is this an install issue or some configuration changes that need to be made? Thanks, AKN @guilmxm  ... View more

Hi, I have managed to get Process, Memory, LogicalDisk and a few other perfmon counters working. However I can't get the ASP.NET & Paging File to work. Played around with the stanza a bit, but no luck. Has anyone managed to get these working? ## ASP.NET [perfmon://ASP.NET] counters = Requests Queued;Requests Rejected index = windows_metrics disabled = 0 instances = * interval = 60 mode = single object = ASP.NET sourcetype = PerfmonMetrics:ASP _meta = entity_type::Windows_Host useEnglishOnly=true ## Paging File [perfmon://Paging File] counters = % Usage index = windows_metrics disabled = 0 instances = * interval = 60 mode = single object = Paging File sourcetype = PerfmonMetrics:PagingFile _meta = entity_type::Windows_Host useEnglishOnly=true   ... View more

Hi, I'm having an issue with the Template for Citrix XenApp. The Environment Overview page shows Machines & Application count as 250. Rebuilding the lookup doesn't make any change either. I have tried to disabling the following, but doesn't help.  Lookups > Lookup definitions > siteHosts > Advanced options > uncheck Case sensitive match. The lookup_sites.csv just seems to stuck at 250 Machines.   Thanks, AKN ... View more

Hi, I have deployed the Template for Citrix XenDesktop 7 with the TA-XD7-Broker add-on deployed on the brokers. However when I use the dashboards that display CPU, Mem & Disk, it doesn't show up anything. Other dashboards seem to work fine and able to display information. Upon looking at the underlying queries and removing the SiteName and running searches, it seems to work. I have already set the "uncheck Case sensitive match" for the siteHosts lookup definition. If I search the Index, I can see that I get a total of 20 sourcetypes, which includes the Perfmonmk: sourcetypes. However if I run the query xd_index SiteName="" (Ex: xd_index SiteName="ABCD"), it just returns the following 4 sourcetypes xendesktop:7:session xendesktop:7:machine xendesktop:7:application xendesktop:7:controller And this seems to be the reason why the dashboards fail as the Perfmonmk: sourcetypes are not available when using SiteName. Has anyone seen this issue before. Any idea why this may be happening? Thanks, AKN ... View more

Hi, Has anyone been able to successfully automate Splunk UF for Windows upgrades using Powershell? Thanks, AKN ... View more

Need some suggestion for field extraction. Take this as an example: I have a file path /opt/splunk/var/log/splunk/splunkd.log There is already a field extraction done for this called file_name. I would like to do a filed extraction with just the Directory path ( /opt/splunk/var/log/splunk/) and name dir_name. The problem arises when I try to do a new extraction, as the path is sort of already used by file_name and splunk mentions that I need "To highlight text that is already part of an existing extraction, first turn off the existing extractions" My doubt here is. If I turn of the existing extraction and then create one for dir_name, would I still be able to use file_name or does that get over-ridden by the new extraction? Thanks, AKN ... View more

Hi, Need some help with getting a correct Regex for CIDR exclusion. *(This is an example. Not the real IP range. ) Trying to exclude events that have ips in the 79.40.96.0/22 range. Following is the Regex that I was able to create using https://regex101.com/. It does match when I test with IPs from the range, in https://regex101.com. However it doesn't seem to work when I test it against events in Splunk. And the regex used is: ^79\.40\.(96\.([1-9]|[1-9]\d|[12]\d\d)|99\.([1-9]?\d|1\d\d|2[0-4]\d|25[0-4])|9[78]\.([1-9]?\d|[12]\d\d))$ (Looked like it didn't get pasted correctly when I posted initially.) Sample event would start with the ip. 79.40.96.12 ....... Thanks, AKN ... View more