The instruction came from on-high to clean up indexes, now I'm going through and noticing indexes that I have not created. Is there a way to tell who created a specific index? ... View more

I'm trying to detect times when my devices are having trouble roaming from AP point to AP point. The application running on the devices is logging times when it loses connection (usually when it wakes up after having gone to sleep, or someone presses the button to put it to sleep). The pattern is: Try 1, Try 2, Try 3...then repeat those three tries until success. I'm trying to find the times when the retries go five or more times, or those instances where the total time spent in the 3x retry ends up taking more than 15 minutes. I'm thinking it can be done with nested buckets. Follow: first bucket will look for "tryCounter:1", "tryCounter:2", and "tryCounter:3", all happening as a single item. The trick is to catch this bucket as all coming from the same host, without specifying which host...but it has to match all three tries to the same host name, so it knows they are all related, and all happening within the same retry set. Then, a second bucket will "catch" these first bucket trios, and count up to 4 sets before triggering and counting the 5th set of three as a single Occurence. Again, the trick here is to make sure that all 5 are from the same host. Originally I had counted them all by host, just looking for 15 or more events in the same time period, but I've been told that search is not what they're looking for. Now, my final product of the search must detect when a single host has experienced 5 or more 3xRetry conditions. Eventually, I'd like to know how long the entire experience took, and pick out the ones which take 10 or more minutes to complete the entire retry sequence. So - anyone feel like taking a crack at this? Dataset is below... 1/21/19 11:30:00.000 AM 2019-01-21 11:32:10.6999 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:10.7624 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:10.7845 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:18.9323 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:18.9792 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:19.0170 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:23.7838 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:23.8373 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:23.8685 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:30.3701 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:30.4079 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:30.4391 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:32.9580 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:32.9958 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:33.0426 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:37.7179 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:37.7713 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:32:37.7869 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1783C-P3G index = DeviceLogs source = C:\Users\slate1783c\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:37:17.3361 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414SP-SJC index = DeviceLogs source = C:\Users\slate414sp\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:37:17.3906 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414SP-SJC index = DeviceLogs source = C:\Users\slate414sp\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:37:17.4363 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414SP-SJC index = DeviceLogs source = C:\Users\slate414sp\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:41:59.1037 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:41:59.1037 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:41:59.1378 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:02.0996 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:02.1151 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:02.1307 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:16.8706 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:16.8987 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:17.5561 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:17.5759 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:17.5903 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:19.4224 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:19.4602 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:40.2953 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:40.2953 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:40.3264 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:48.8086 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:48.8243 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:51.0919 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:51.1232 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:53.3145 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:53.3457 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:59.5192 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:42:59.5414 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE1610R-S7J index = DeviceLogs source = C:\Users\slate1610r\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:44:08.9076 exception catched - tryCounter:1 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:44:08.9214 exception catched - tryCounter:2 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:44:08.9381 exception catched - tryCounter:3 - No IPEndpoints were found for host DeviceServer.constoso.msft. host = SLATE414F-QS3 index = DeviceLogs source = C:\Users\slate414f\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:44:45.6185 No IPEndpoints were found for host DeviceServer.constoso.msft.-System.ServiceModel.EndpointNotFoundException System.ServiceModel.EndpointNotFoundException: No IPEndpoints were found for host DeviceServer.constoso.msft. at Void System.ServiceModel.Channels.SocketConnectionInitiator+<ConnectAsync>d__9.MoveNext() + 0x2ed --- End of stack trace from previous location where exception was thrown --- at Void System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task) + 0x5d at Void System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task) + 0x33 Show all 189 lines host = SLATE216H-LN7 index = DeviceLogs source = C:\Users\slate216h\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet 1/21/19 11:30:00.000 AM 2019-01-21 11:44:45.6585 No IPEndpoints were found for host DeviceServer.constoso.msft.-2nd catch -System.ServiceModel.EndpointNotFoundException System.ServiceModel.EndpointNotFoundException: No IPEndpoints were found for host DeviceServer.constoso.msft. at Void System.ServiceModel.Channels.SocketConnectionInitiator+<ConnectAsync>d__9.MoveNext() + 0x2ed --- End of stack trace from previous location where exception was thrown --- at Void System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task) + 0x5d at Void System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task) + 0x33 Show all 189 lines host = SLATE216H-LN7 index = DeviceLogs source = C:\Users\slate216h\AppData\Local\Packages\DeviceLogs\LocalState\nLog.txt sourcetype =DeviceLogs_dotnet ... View more

I'm trying to time an event. The event occurs within a burst of log events, which arrive at my Splunk server and usually end up being contained as one Splunk event. This burst of log events contains date-time stamps for each individual transaction, so I'm rex'ing in an attempt to both isolate both the beginning and the end of the subsection I'm interested in, as well as the times for beginning and end. Then I convert those strings to epoch, so I can get the total time it took to complete that part. (...with some help from other people on this community to create the rex string.) So here is both the beginning event and the rex string: 1206 090527 (3185) 3 SparkPostOutConnector: Log initialized rex "^(?<log_i>.+?)\s\(3185\)\s3\sSparkPostOutConnector:\sLog\sinitialized" And here is the end event, and the rex string: 1206 090528 (3185) 3 SparkPostOutConnector: EMail Sent Successfully!! Accepted recipients: 2 rex "^(?<job_m>.+?)\s\(3185\)\s3\sSparkPostOutConnector:\sEMail\sSent\sSuccessfully" And the good news it that it works...sometimes. For instance, sometimes I get the value I'm looking for: log_i = 1204 102211 job_m = 1204 102212 And other times...maddeningly...it absolutely ignores what is supposed to be an obvious start and end to the event, it completely ignores them. For instance, in this log entry...it will not find the start and end section: 1206 090526 (1719) 2 JobBegin:servicerequest=RestInput 1206 090526 (1726) 3 Collect Event:ReceiptData < servicerequest=RestInput 1206 090526 (5026) 3 Sender of job set to: 1206 090526 (1730) 3 preproc message:ReceiptData < servicerequest=RestInput 1206 090526 (1731) 3 Doing message:ReceiptData < servicerequest=RestInput 1206 090526 (1739) 3 Process:ProcessingEngine_New_job_1_exstream (v. 1) > PDFOutput(null) 1206 090527 (0089) 2 EX001012W (1) The system key expires in 58 days on 2019-02-01. Send an email to "software.keys@opentext.com" for information on updating your key or contact OpenText Customer Support if email is unavailable. 1206 090527 (0089) 2 EX002522W (1) The locale is not set for this application. The language and locale will be set to default. 1206 090527 (0089) 3 EX002697I (1) Data aggregation has been enabled due to XML end tag processing. 1206 090527 (0089) 3 EX001800I (1) >>>>>>>>>>>> Driver File: opening the customer driver file named ReceiptData. <<<<<<<<<<<< 1206 090527 (0089) 3 EX001000I (1) ********************* Customer 1: Starts at input record 3 (byte 144) 1206 090527 (0089) 1 EX004108E (1) The PNG pass-through file ($$CNT$$k7iFrf4NoInN9jSQT9WfcQ==) for variable RES MANAGER FILE is not a supported file or is damaged. File is ignored. 1206 090527 (0089) 1 EX004108E (2) The PNG pass-through file ($$CNT$$J+jQzJSMMF_9TsTKtJIJrg==) for variable RES MANAGER FILE is not a supported file or is damaged. File is ignored. 1206 090527 (0089) 2 EX004146W (1) Table rows set to split across pages are not supported in UDL output types. Rows will print on a single page and may cause output inconsistencies. 1206 090527 (0089) 2 EX004146W (2) Table rows set to split across pages are not supported in UDL output types. Rows will print on a single page and may cause output inconsistencies. 1206 090527 (0089) 2 EX004146W (3) Table rows set to split across pages are not supported in UDL output types. Rows will print on a single page and may cause output inconsistencies. 1206 090527 (0089) 2 EX004146W (4) Table rows set to split across pages are not supported in UDL output types. Rows will print on a single page and may cause output inconsistencies. 1206 090527 (0090) 2 OpenText Exstream Engine exited with exit code 8. 1206 090527 (5105) 3 Receiver of created document set (Document, reciever):E1C4B98A-04E6-3646-9FA7-7CBA2721A97E, 1206 090527 (5105) 3 Receiver of created document set (Document, reciever):17F9CFC3-D762-AA43-AB81-AA86DAA6CB77, 1206 090527 (3185) 3 SparkPostOutConnector: Log initialized 1206 090527 (0576) 3 Queue item E1C4B98A-04E6-3646-9FA7-7CBA2721A97E with external ID '' completed successfully. 1206 090527 (3185) 3 SparkPostOutConnector: There are 2 attachments 1206 090527 (3185) 3 SparkPostOutConnector: DataItem: id=9FFE7869-1511-F44C-A5CC-82520E4B30E9name=HTMLImage9.png, type=attachment, contentType=image/png 1206 090527 (3185) 3 SparkPostOutConnector: DataItem: id=FDC3FF95-E8C3-C24F-864A-4E66830E9F77name=RTGLogo2.png, type=attachment, contentType=image/png 1206 090527 (3185) 3 SparkPostOutConnector: Processing a request 1206 090528 (3185) 3 SparkPostOutConnector: EMail Sent Successfully!! Accepted recipients: 2 1206 090528 (0576) 3 Queue item 17F9CFC3-D762-AA43-AB81-AA86DAA6CB77 with external ID '' completed successfully. 1206 090528 (5105) 3 Receiver of created document set (Document, reciever):FD540AAC-0978-A146-8E85-331926BA46C7, 1206 090528 (1723) 2 JobEnd:servicerequest=RestInput 1206 090528 (0576) 3 Queue item 8B552D3D-97B6-0A46-881B-282137BFDF92 with external ID '' completed successfully. 1206 090528 (0576) 3 Queue item FD540AAC-0978-A146-8E85-331926BA46C7 with external ID '' completed successfully. 1206 090528 (0572) 3 Tracker 'B27EF624-8FF2-5C46-B408-3327A2B4D5A3' (StrsID 5207606, external ID '') completed successfully. Executing this search comes up with nada: index=foo "1719" "0572" | rex "^(?<log_i>.+?)\s\(3185\)\s3\sSparkPostOutConnector:\sLog\sinitialized" | rex "^(?<job_m>.+?)\s\(3185\)\s3\sSparkPostOutConnector:\sEMail\sSent\sSuccessfully" | eval job_start_epoch = strptime(log_i, "%m%d %H%M%S") | eval job_end_epoch = strptime(job_m, "%m%d %H%M%S") | eval job_dur_in_sec = job_end_epoch - job_start_epoch | table job_start_epoch, job_end_epoch, job_dur_in_sec If I manage to get any results out of this search, the statistics table will put the begin event on one line, end event on another line, and absolutely refuses to do the eval for the duration between the two. (So that's another problem.) I'm stumped. Ideally, what I'd like the table to show (on the same line) would be the begin time, the end time, and the time it took (in seconds) to complete the sub-transaction within the larger transaction. Oh, and if at all possible, to eliminate cases where there were incomplete events (because these do happen). I know my rex's work...because if I break down the search to only look for that single event, I can get it occasionally - so SOMETHING about them works (and I developed it on regex101). What I can't figure out is why it won't work every time. Assuming the data is consistent, the only thing I can figure is that my rex is faulty. Anyone feel like telling this newb where he went wrong? ... View more

In serverclass.conf ... I'm creating different classes, for deployment. I've inherited this setup, and the previous guy got pretty fancy, so I can't use the GUI to edit any more. I have multiple stanzas within my serverclass.conf , and now I'm trying to split out my tablets into different indexes (and applications). So, I have a class of devices called tablets, which incorporates every tablet that has been released into the enterprise. Now they are rolling out a sub-class of tablets, which are using a different model tablet with Windows 10. Up until now, tablets have been released with an unpopulated deploymentclient.conf: [deployment-client] [target-broker:deploymentServer] targetUri= 10.10.12.12:8089 The new tablets are being released with a populated deploymentclient.conf [deployment-client] SLATE-$HOSTNAME [target-broker:deploymentServer] targetUri= 10.10.12.12:8089 So I inserted a pair of stanzas into my serverclass.conf , to cover the new tablets using Windows 10: ######### Original tablets stanza [serverClass:MYAPP_TABLETS] whitelist.0 = SLATE* blacklist.0 = SLATE549G2 [serverClass:MYAPP_TABLETS:app:_server_app_MYAPP_TABLETS] restartSplunkWeb = 0 restartSplunkd = 1 stateOnClient = enabled ######### New tablets stanza [serverClass:MYAPP_TABLETS10] whitelist.0 = SLATE-* whitelist.1 = SLATE*-*.stores.roomstogo.rtg blacklist.0 = SLATE549G2 [serverClass:MYAPP_TABLETS10:app:_server_app_MYAPP_TABLETS10] restartSplunkWeb = 0 restartSplunkd = 1 stateOnClient = enabled ...and restarted the deployment server (for all apps). ...and got jack. None of the new tablets decided to bite on the new setup. So my question is, is there an order of precedence in serverclass.conf? Since all my tablets have been using the first stanza, will they simply ignore the second stanza? Or is there a problem with my white/blacklisting? Is it an issue with the deployment client? Open to suggestions... ... View more