Hi Friends, We have old 2003 Windows server where we can not install UF anymore. So we want to read EventLogs from Win 2003 server from another Win 2016 server where UF is running. I have below monitor stanza in Win 2016 server. But not working. Any suggestions.  [WinEventLog://\\<win2003_hostname>\config\Security] ... View more

Hi, Please help me to calculate service availability of the system. Method Time of down Time of up A 01/01/2019 15:00:00 01/01/2019 15:05:00 B 01/01/2019 15:08:00 01/01/2019 15:11:00 C 01/01/2019 15:09:00 01/01/2019 15:12:00 D 01/01/2019 15:09:00 01/01/2019 15:10:00 E 01/01/2019 15:15:00 01/01/2019 15:20:00 Total Duration 20 Min Down duration 17 min (currently) Down duration 14 min (required) If any method is down, the complete service is down. Total duration will be the sum of downtime duration between each method. But there are overlapping time of methods going down. The Method C goes down before Method B comes up and method C comes up after B comes up. So downtime duration= up time of C - down time of B. Also Method D goes down and comes up between method B & C. So should skip that duration calculation. The normal stats command calculates downtime duration as 17 min where as I want only 14 min. Please help to build the query. ... View more

Hi, I have many events of 500 lines. Only first 10 lines are important. How to truncate or discard or ignore the remaining lines before indexing? When I use MAX_EVENTS in props.conf, Splunk breaks event after 10 lines and creats new event. Tried using BREAK_ONLY_BEFORE, LINEBREAK but nothing seems working. Please suggest props.conf entry to index only 10 lines from event. ... View more

hello, Short background.. One of the application populates some ids for deletion of multiple types like type A, B, C, D. There are four different applications to delete each type of ids. I am interested in finding only the D type of ids. So I created a KVStore to store all ids for deletion. Then using lookup I am searching type D ids. Till this point everything works fine. But as data volume is huge, I want to delete the old records from KVStore which are already searched and displayed on dashboard. Please help me to build the last KVStore deletion query. index=xyz STATUS="DELETED" | lookup scheduled_lookup SCHE_ID AS DEL_ID OUTPUT SCHE_ID AS DELETED_ACCT | stats count(DELETED_ACCT) as DELETED_ACCT I want to build a query like below (please ignore syntax) |inputlookup scheduled_lookup |eval key=_key |where NOT key=[index=xyz |fields DEL_ID] |outputlookup scheduled_lookup ... View more

Hi team, there are three fields in source "app1.csv" (CUST_ID,ACCT_ID,SUBSCRIP_ID). There is no other field in this table to differentiate these fields. I want to showcase count of each ID field separately. index="test" | eval SCHEDULED_DELETIONS=case( source="app1.csv" AND ACTION="SCHEDULED" AND isnotnull(CUST_ID),"CUSTOMER_ID", source="app1.csv" AND ACTION="SCHEDULED" AND isnotnull(ACCT_ID),"ACCOUNT_ID", source="app1.csv" AND ACTION="SCHEDULED" AND isnotnull(SUBSCRIP_ID),"SUBSCRIPTION_ID" source="app2.csv" AND ACTION="TO_DELETE","SUBSCRIPTION_ID", source="app3.csv" AND APP_UNUMBER="U-500","ACCOUNT_ID", source="app4.csv" AND STATUS="N","CUSTOMER_ID",) | eval APPLICATION=case(source="app2.csv","APP2",source="app1","APP1") | chart count over APPLICATION BY SCHEDULED_DELETIONS usenull=f Issue: When I do chart, the APP1 shows only CUSTOMER_ID count and ignores ACCOUNT_ID and SUBSCRIPTION_ID count. Also I doubt that isnotnull() is of any is here. ... View more

Team, In my JSON data, there is below line which I want to be my event time (_time). "eventDateTime" : "2017-24-08T05:19:54.500-05:00", My props.conf has below entry. I am not sure what to write for last (-05:00). Please help. TIME_FORMAT=%Y-%d-%mT%H:%M:%S.3N TIME_PREFIX="eventDateTime" : ... View more

Hi team, I am not able to index below JSON data in Splunk 6.2 with below props.conf attributes. Its breaking at every line and treating as separate event with no field extraction. When I add the same file from Search head using add data option and selects _json as source type, the fields are correctly extracted. But do not work when mention same attributes and customized sourcetype name in props. Please suggest. Data: { "messageId" : "VIPJAPAN40001JCOMPLETE2017220818015450", "messageType" : "EVENT", "sendingAppId" : "P1", "sendTimeStamp" : "2017-22-08T17:09:27.526-05:00", } Props: [APP1_INOUT_App2] INDEXED_EXTRACTIONS = json KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured disabled = false DATETIME_CONFIG = CURRENT ... View more

Hi, I am using Splunk 6.2. My Email alert body looks like below. Is it possible to provide hyperlink to each count in STATUS field. So that if the person wants to see more details about those transactions. We have given drill down in dashboard, but is it also possible from email alert body? CLIENT COUNTRY TRANSACTION DATE STATUS1 STATUS2 STATUS3 SUCCESSFUL FAILED PENDING ABC INDIA 27-JUL-17 100 110 155 50% 50% 0% XYZ JAPAN 27-JUL-17 105 200 54 45% 35% 20% MNP CHINA 27-JUL-17 107 55 200 80% 10% 10% QRS AUS 27-JUL-17 98 400 60 70% 5% 25% ... View more

Hi, I am using Splunk 6.2 version. I have created two dashboards. One for incoming transactions and other for outgoing transactions. The search criteria (tokens) and query for both dashboards is completely different. I do not want two separate dashboards now. Can we do something using simple XML to club these two dashboards in one (Something like LinkSwitcher unfortunately which is not available in 6.2 version)? Single click should change my dashboard. ... View more