Unfortunately our installation of the AMQP Modular Messaging Input App stops running because of not enough memory every night. To workaround here, we set up a trigger, which should start a script that restarts the Splunk app. Is there a way to restart a splunk app via CLI? ... View more

Hi all, some times we see warnings on the top of the page, that say [object Object]. We did not do any configurations before. They just pop up, when logging in and navigating through Splunk. Please see the following picture: Can you help us here? What does it mean? Best, Yannic ... View more

Hi all, we have an ELK-cluster in our company and now we want to have the data, we have in ELK, as well in Splunk. Installing splunk Forwarders on the servers to monitor is not an option unfortunately. We don't want to query Kibana from Splunk and import those results into Splunk; we want the raw logs. Has anyboy of you experiences with configuring logstash-forwarders, to send the data as well to the Splunk Indexers? We are thinking as well of shipping the logs to a file on a syslog-server where a UF can pick them up and forward them to the indexers - but maybe there is something more elegant? Thanks, Yannic ... View more

Hi, searching for a specific sourcetype I get the message ### ERROR FETCHING EVENT FROM SEARCH PEER ### What can I do with this error? It only occurs at a certain time range (before sept 24, 7 pm). Maybe someone has an idea about what this error tells me? I didn't find anything yet. The whole search query is sourcetype=mysourcetype Best regards, Yannic ... View more

Hi, I'm looking for a function to cumulate previous values in a timechart. Means that I can see a real-time development of a software roll-out - distincted by a UID. The result should look as a ramp. My search string looks like this: sourcetype="foo" devicetype="Bob" | timechart dc(uid) as totale by boxsw | addtotals This table as an example of the desired results: Time # events w/ new sw cumulated Day 1 128 128 128 Day 2 230 102 230 Day 3 220 78 308 So at Day 3 in the example, there are 308 devices with the new software AND it is clear to see, that it doesn't depend primary on how many events where registered. I just tried streamstats like mentioned in the first comment (that was made according to a badly formulated question...), but it doesn't give me the result I need. (As a first step I would be happy, if there where any cumulated results) So, I'm looking forward to seeing an instructive answer to my question 🙂 Regards 😉 ... View more