Hi @anantdeshpande, the only way to monitor a remote wineventlog is WMI, it isn't possible to configure something like you tried. My hint was different: did you tried to install a not supported UF 7.x on your Windows 2003 server? probably it runs and you have your wineventlogs. This is the last try before WMI. Ciao. Giuseppe ... View more

Did you implement this? Can you please share the script?  ... View more

A different solution if we consider your time resolution is in seconds: base_search | rename "time_of_down" as time_down, "time_of_up" as time_up | sort time_down | eval start=strptime(time_down, "%d/%m/%Y %H:%M:%S") | eval end=strptime(time_up, "%d/%m/%Y %H:%M:%S") | eval duration=end-start | table start,end,duration |eval magic=mvrange(start,end) | stats dc(magic) as magic |eval result=toString(magic,"duration") ... View more

Hi, Thanks for the reply. I am indexing file from Web UI. I created props.conf and transforms.conf in default directory as mentioned. Restarted Splunk. Then, when I select sourcetype as" testSourceType", I see transforms name in Advance but the right hand side prieview still shows large events and not discarding lines after 10. ... View more

Hi DalKeanis, I do have a same requirement of calculating downtime duration withing overlaping events. As per below data, downtime start at ( 09:05:41.031) and ends at (09:14:16.802). Basically I want to skip those UP events if any other Service goes down before it. Could you please help to build the query? 2019-03-27 09:05:41.031 Service_1 DOWN 2019-03-27 09:05:43.783 Service_2 DOWN 2019-03-27 09:06:13.332 Service_3 DOWN 2019-03-27 09:07:32.118 Service_1 UP 2019-03-27 09:07:34.742 Service_1 DOWN 2019-03-27 09:07:40.743 Service_2 UP 2019-03-27 09:07:41.594 Service_1 UP 2019-03-27 09:07:45.288 Service_1 DOWN 2019-03-27 09:07:51.441 Service_1 UP 2019-03-27 09:08:33.786 Service_1 DOWN 2019-03-27 09:09:22.265 Service_1 UP 2019-03-27 09:14:10.797 Service_4 DOWN 2019-03-27 09:15:39.382 Service_3 UP 2019-03-27 09:14:16.802 Service_4 UP ... View more

Thank you. ... View more

That depends on what you want to achieve, which is still a bit unclear to me. My suggestion to do a stats dc() might be an alternative, but it may not be the calculation you're after. Can you perhaps post some sample data + mockup of the expected outcome? That might clarify a bit more what you are actually trying to calculate. ... View more

%Y-%d-%mT%H:%M:%S%3N%:z try that. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables ... View more

Hi Nilay, I do have a same requirement of calculating downtime duration withing overlaping events. As per below data, downtime start at ( 09:05:41.031) and ends at (09:14:16.802). Basically I want to skip those UP events if any other Service goes down before it. Could you please help to build the query? 2019-03-27 09:05:41.031 Service_1 DOWN 2019-03-27 09:05:43.783 Service_2 DOWN 2019-03-27 09:06:13.332 Service_3 DOWN 2019-03-27 09:07:32.118 Service_1 UP 2019-03-27 09:07:34.742 Service_1 DOWN 2019-03-27 09:07:40.743 Service_2 UP 2019-03-27 09:07:41.594 Service_1 UP 2019-03-27 09:07:45.288 Service_1 DOWN 2019-03-27 09:07:51.441 Service_1 UP 2019-03-27 09:08:33.786 Service_1 DOWN 2019-03-27 09:09:22.265 Service_1 UP 2019-03-27 09:14:10.797 Service_4 DOWN 2019-03-27 09:15:39.382 Service_3 UP 2019-03-27 09:14:16.802 Service_4 UP ... View more

This works perfect for json data, at least for me: [sourcetype] INDEXED_EXTRACTIONS=json JSON_TRIM_BRACES_IN_ARRAY_NAMES=true CHARSET = AUTO MAX_DIFF_SECS_AGO = 604800 MAX_EVENTS = 10000 NO_BINARY_CHECK = 1 TRUNCATE = 0 ... View more

|makeresults |eval Failure=52 | sendemail to="abc@gmail.com" format="html" server=smtp.gmail.com:143 use_tls=1 subject="Using splunk 7.1.1 version" message="Splunk Alert \n Test Link: http:\\localhost:8000 .\n My Test Alert from URL: www.google.com ." ... View more

Hi all, I am able to club two dashboards using drop down tokens and depends clause in simple XML. ... View more

My main purpose of the question is to know if Splunk Universal Forwarder can be used for MQ reading purpose. I do not have permission to use Heavy forwarder. ... View more

Sounds like a new question, so please create one. While you do that, also test if your calcfield works. ... View more

That's too bad. Joins are expensive and getting rid of them could have earned you a bonus. 🙂 There are some small optimizations you can make. Move the dedup command before eventstats . Consider moving the 'search PAYROLL_STATUS ="PENDING"' command and it's associated eval as close to the beginning of the search as you can. With some tweaking you may be able to include it in the base search and reduce the number of rows read. ... View more

Hi anantdeshpande, in your question there is a visualization problem of the regex, you have to format your search as Code. Every way, you can build your search in this way: index= idx_prod sourcetype=SRC1 OR sourcetype=SRC2 OR sourcetype=SRC3 OR sourcetype=SRC4 OR (sourcetype=SRC5 "$TXN_ID$") OR (sourcetype=SRC6 "$TXN_ID$") | rex "regex1" | rex "regex2" | rex "regex3" | rex "regex4" | search TXN_ID = "$TXN_ID$" | ... Bye. Giuseppe ... View more

Right right - we can map multiple roles to the same app, as we do with the power user (to the same app as the regular user). Meaning roles to app is N:1. So, all should be just fine with your design ; -) ... View more

I agree. What is the point of decreasing the size of the log files if they are all indexed with a max size of 1/2 TB anyway? ... View more

The Splunk (Universal) forwarder on the failed-over node will re-read whole file data after switch over. This is the default behavior (all data would be monitored) as that node has never monitored the file before. This is controlled by a property called followTail on the inputs.conf file on forwarder. This is 0 (false) by default means monitoring starts at the beginning of the file. See this (search for followTail ) for more details. https://docs.splunk.com/Documentation/Splunk/latest/Admin/inputsconf One option would be to manually set the followTail in inputs.conf to 1 / true so that monitoring starts at the end of the file (like tail -f). Please note that this is an advanced setting and should be used for temporary purpose only. Excerpt From inputs.conf * WARNING: Use of followTail should be considered an advanced administrative action. * Treat this setting as an 'action': * Enable this setting and start the Splunk software. * Wait enough time for the input to identify the related files. * Disable the setting and restart. * DO NOT leave followTail enabled in an ongoing fashion. * Do not use followTail for rolling log files (log files that get renamed as they age), or files whose names or paths vary. ... View more

Thanks. Referred the same. Will try to implement incremental logic in UNIX shell script same as Python. Any document for shell script will help. ... View more

We are not using any mongodb on the system. Warnings is from splunk mongod.log. Do you know why this mongod coming in picture. We are using HF for DB2 connect for ORACLE DATABASE. /export/apps/splunk/var/log/splunk/mongod.log bash-4.1$ numactl --interleave=all ./mongod ./mongod: error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory bash-4.1$ numactl --interleave=all /export/apps/splunk/bin/mongod /export/apps/splunk/bin/mongod: error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory ... View more

Thanks Sjohnson for the reply. However I am still searching for the initial hardware requirement (CPU?MEM?DISK?). I found below from splunk.docs when HF will be used with full capability. But I am going to install only DB2 connect on this HF, no parsing, indexing. So below configuration is far more than reality. Does anyone has configured HF in this way? Heavy Forwarder Intel 64-bit chip architecture 4 CPUs, 2 cores per CPU, at least 2 Ghz per core 12 GB RAM 2 x 300 GB, 10,000 RPM SAS hard disks, configured in RAID 1 Standard 1Gb Ethernet NIC, optional 2nd NIC for a management network Standard 64-bit Linux or Windows distribution ... View more

I have the same problem... In my case I am trying to have both a "dry run" and "update" option to the search. 1) I tried disabling / enabling the panel "view" but that did not work. https://answers.splunk.com/answers/639048/how-to-make-panel-depend-on-token-value.html 2) I also tried changing the function of my "final Search" (last line in my search query) to a "dry run: dummy search string" and the "update: append to lookuptable". It seems that since this changes the "search query itself" -- the panel search query gets rerun -- even though the "Submit" button has not been selected. All other form input fields (note: 'search on change' is disabled for all) simply change variables rather than search queries themselves though. On my dropdown input, it seems explicitly stating searchWhenChanged="false" does help. <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="input-dryrunORupdate" searchWhenChanged="false" > <label>DryRun or Update</label> <choice value="DryRun">DryRun</choice> <choice value="Update">Update</choice> <change> <condition value="DryRun"> <set token="tokFinalSearch">eval x=y | fields - x</set> </condition> <condition value="Update"> <set token="tokFinalSearch">outputlookup append=true access-events.csv</set> </condition> </change> <default>DryRun</default> <initialValue>DryRun</initialValue> </input> <!-- ... more inputs ... --> </fieldset> The last line of my panel search query is: | $tokFinalSearch$ ... View more