yes, this is very useful thank you. I have decided to retain the changes in the app to include the props.conf but to have a comment that the stanza needs to exist on the indexer. just in case the props.conf on the indexers i lost or overwritten, the app config will tell whoever how to get it working again. ... View more

That's weird - what happens when you remove the append like so? index=platform_logs sourcetype=UpdateLog earliest=-d@d latest=now "Download completed successfully" | timechart span=1d count You'll get two counts, split into today and yesterday. Also, your latest in the subsearch probably should have been @d rather than -1d. ... View more

Hi I can confirm that iptables -F works in a homelab. ... View more

Hi, Can you give an example of this? I have the same issue and its doing my head in. O.o 🙂 ... View more

Hi, It should work installing the Forwarder in the CentOS server, and sending the data to Splunk. You can find more details in the readme file in the app. Thank you! OPEN3S. ... View more

How long are your events? If your events are many lines long, or a single line is very long, you may need to increase some limits. Here is a great entry that covers this: Size limit for an event ... View more

derp dee derp Was using two different browsers to test permissions and such and tried editing the search in-app. I removed the "| gauge 0 25 75 100" from the end of the searchSstring string (while leaving the vizualization settings alone) Hey presto it works. C. ... View more

Some ideas: Search for something that you know is in the data over all time. Perhaps there is a timestamp problem, and the data is really in there, but not at the time you expect. Search index=* for that data. It shouldn't have happened, but what the heck. Is the data recent? If it is older, or has widely varying timestamps, you may need to set some rules in props.conf. Put them in props.conf on the indexer if you are using the Universal Forwarder. Look at the settings for MAX_DAYS_AGO , MAX_DAYS_HENCE , MAX_DIFF_SECS_AGO and MAX_DIFF_SECS_HENCE in props.conf ... View more

ok, well, you dont need math to achieve this space saving endeavor. using scientifc notation simply modifies the units via # notation. and, you dont save byte space simply by converting to scientific notation, you only save byte space if you roundoff/truncate. you can SEDCMD the input data and normalize it say to E+3 or E+6 (whatever, etc) then round/truncate. then perhaps do a custom field extraction and name it with units attached, eg "kB" or "MB" or whatever. you can roundoff/truncate/normalize with SEDCMD, etc. ... View more

(argh) Thank you 🙂 My error was in defining the chart to use two fields, not the conversion. ... View more

Thanks for your reply... I found alternate solution from your community for above problem.. On the Universal Forwarder side of the deployment you should have these files/folders : SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/bin/ SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/default/inputs.conf SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/default/app.conf SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/logs SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/local Then update your JMX configuration in SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/bin/config.xml Then manually enable the poll script in SplunkUniversalForwarder/etc/apps/SPLUNK4JMX/default/inputs.con* ... View more