I was just curious about this since I couldn't find anything on it in the following page: https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTcluster Thanks in advance. ... View more

Hello all, I currently have a search that checks to see if a sourcetype is coming for specific hosts tagged with a custom tag (example below). The issue is that you'll have to include the current day in the time picker for it to display the "success" message. A user requested to have it as a historical search to display if any host had any "fail" message for not forwarding their "my_srctype" log. I tried looking into using metadata search but that doesn't narrow down to the custom tag we have. Was wondering if you guys have any suggestions in creating a new search where it'll display an additional time-date column if the host failed to send the "my_srctype" data if the user want to perform a historical search for previous month etc.? Thank you in advance. Current search for the panel: index=my_index custom_tag=tag sourcetype="my_srctype" | stats latest(_time) AS Latest by host sourcetype | eval check1hour=(now()- Latest)/3600 | eval status=if(check1hour>1,"fail","success") | eval LastIngestionTime=strftime(Latest, "%Y/%m/%d %H:%M:%S %Z") | rename LastIngestionTime as "Last Ingestion Time" | table host sourcetype "Last Ingestion Time" status | sort - _time Example result: host sourcetype Last Ingestion Time status host01 my_srctype 2019/12/30 00:00:00 EST success ... View more

Hello all, I just came onto a new job and we're trying to figure out the daily indexing rate broken down by sourcetypes. Then we're going to get the average for X days. Is there another search that can list the throughput of each sourcetype within an index? I like the search below for per_sourcetype_thruput, but it doesn't list the indexes. I tried looking at the per_index_thruput to figure it out too but am now stuck trying to see if there are other commands out there that can help. index=_internal component=Metrics per_sourcetype_thruput | eval mb=kb/1024 | timechart span=1d sum(mb) by series useother=f limit=150 index=_internal component=Metrics per_index_thruput | eval mb=(kb/1024) | timechart span=1d sum(mb) by series useother=f limit=100 Thank you for your time, take care. ... View more

Hello all, I'm currently working on figuring how to create a list of as mentioned in the title with the last seen field. This field will show when the host was last seen in our logs. It's kind of similar to the solution below but will only list last seen time for all hosts. Thank you in advance for your assistance. https://answers.splunk.com/answers/332987/how-to-search-the-list-of-devices-that-have-sent-l.html ... View more

Hello all, I am relatively new to Splunk and creating dashboard with XML, so any recommendations and tips are greatly appreciated. So I have a dashboard with a drop-down menu with a list of sources - I did this because we a have a weekly CSV report so the user can pick a file based on its date within the file name. When the panel relying on the "source" token to do the search, it's missing a backslash to work properly. The source code and explanation below. Drop-down menu: <input type="dropdown" token="source_csv" searchWhenChanged="true"> <label>Select a report week:</label> <prefix>source=</prefix> <default>*</default> <choice value="*">All</choice> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query> index="example_reports" | chart count by source </query> </search> </input> So when a panel with the search below is done, nothing shows up because it's missing a backslash. host="example_host" index="example_index" $source_csv$ | stats distinct_count(ip) The search query comes out as: host="example_host" index="example_index" source=D:\example\report-2018-12-25.csv | stats distinct_count(ip) The issue is that the source value needs two backslashes for it to work: source=D:\example\report-2018-12-25.csv Is there anyway to get the token to have two backslashes to the directory with the token or search query? Thank you in advance. I did search for solutions on this by adding |s$ and search string, but couldn't get it to work right... ... View more