I have a sourcetype of data that I've listed below. How can I put a dot on my Splunk Google Map plugin with the longitude/latitude coordinates that I get? I have the data extracted into 4 fields of (latitude, longitude, date, time). sourcetype=longlat: "50.052060";"-80.485100";"01/14/2015 12:21 AM" ... View more

How can I get splunk to count the number of times an ID appears and to list the last date it was found? Splunk Data: Jan 19 21:35:27 score="9.3", ip=192.168.2.1, id=123, name="blahblah1" Jan 19 21:35:28 score="1.0", ip=192.168.2.2, id=456, name="blahblah2" Jan 19 21:35:29 score="2.5", ip=192.168.2.3, id=789, name="blahblah3" Jan 19 21:35:30 score="9.3", ip=192.168.2.4, id=123, name="blahblah1" What I want to see is an output that looks like: COUNT ID NAME SCORE DATE ------------------------------------------- 2 123 blahblah1 9.3 Jan 19 21:35:30 (note the last date) 1 456 blahblah2 1.0 Jan 19 21:35:28 1 789 blahblah3 2.5 Jan 19 21:35:29 What I've been doing is running: searchstring | stats count by id name score and that gets me most of what I need, but I can't seem to incorporate the latest Date without it screwing up everything. Any suggestions? Thanks, ... View more

I'm trying to have a Splunk Alert kick off an email (to an email script) and depending on the search query it should email Address1 or Address2. How do you I create this type of variable? Should I setup a where statement like | where search=Apples | eval email="address1" |where search=Oranges | eval email="address2" ???? Example: [search yields Apples] | eval email="address1" [search yields Oranges] | eval email="address2" ... View more

I have a FreeBSD box and I ran (./splunk enable boot-start) and got the following message: Init script installed at /etc/rc.d/splunk. Init script is not configured to run at boot. What in this file (/etc/rc.d/splunk) needs to be configured to boot? And does anything need to be set in the rc.conf file to kick it off when it boots? ... View more

I think I'm having a brain fart. I want to chart each data point by an address. I don't want (avg, sum, max, min, etc). I want a point on a chart for each dataset. What command am I'm missing? I tried | chart values(DATA) by address ...and all I get is all the data in a block per address. Thanks, data address 1 address-a 2 address-a 3 address-a 1 address-b 2 address-b 3 address-b ... View more

When trying to figure out bandwidth, which search string makes more sense? | eval MBs=(bytes*8/1024/1024) | timechart sum(MBs) as "MB/s" or | eval MBs=(bytes*8/1024/1024) | chart sum(MBs) as "MB/s" by _time ... View more

I'm having the following issue getting (splunkweb) to start running. In the web_service.log file it gives the following error below. This is from a fresh install of v6.1 on a FreeBSD box. 2014-05-27 09:36:58,327 INFO [538494f9e78045de150] init:161 - Using default logging config file: /opt/splunk/etc/log.cfg 2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk level=INFO 2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver level=INFO 2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers level=INFO 2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers.proxy level=INFO 2014-05-27 09:36:58,329 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.lib level=WARN 2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:729 - Unable to start splunkweb 2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:730 - [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules' Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 110, in from controllers.top import * File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 13, in from admin import AdminController File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in from splunk.appserver.mrsparkle.controllers.appinstall import AppInstallController File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 9, in from splunk.appserver.mrsparkle.lib import cached, module File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 460, in moduleMapper = ModuleMapper() File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 79, in init self.installedModules = self.getInstalledModules() File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 24, in helper return f(*a, **kw) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 443, in getInstalledModules mods = self.getModuleList(root) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 33, in helper return f(*a, **kw) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 211, in getModuleList for (app_name, module_name, module_path) in local_apps.getAllModules(): File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 195, in getAllModules self.refresh(False) File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 121, in refresh 'modules' : self._scanSystemModules() File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 150, in _scanSystemModules for module_dir in os.listdir(self.system_modules_path): OSError: [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules' ... View more

I just downloaded a new 6.1 copy of Splunk for FreeBSD. After a wget download and running (tar zxvf splunk-6.1.1-207789-freebsd-7.3-amd64.tgz), I felt I was ready to start Splunk. So I ran ( /opt/splunk/bin/splunk start) and this happened < SEE BELOW >. Any ideas of what might be going on with the ca.pem file issue? I recently upgraded openssl to v1.0.1g. Could that be causing me issues? Or is there some step I've overlooked during the install? Thanks, Splunk> Like an F-18, bro. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary Done New certs have been generated in '/opt/splunk/etc/auth'. Checking filesystem compatibility... Done Checking conf files for problems... Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Starting splunkweb... Generating certs for splunkweb server Generating a 1024 bit RSA private key .....++++++ ...........................++++++ writing new private key to 'privKeySecure.pem' Signature ok subject=/CN=DOMAIN.NAME/O=SplunkUser Error opening CA Certificate ca.pem 34377709224:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('ca.pem','r') 34377709224:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400: unable to load certificate Command failed (ret=1), exiting. ... View more