Checkout alternative workaround. https://community.splunk.com/t5/Knowledge-Management/Solutions-quot-Splunk-could-not-get-the-description-for-this/td-p/694752 ... View more

Unfortunately, there is no answer to the issue I experienced. Removed my splunk install completely and re-installed the latest version as a fresh install. I only kept my transforms and props.conf files. Everything else is brand new. And the filter is working. I suspect Ayn was on the right track. Something in my configuration was not right. Thanks for the help! ... View more

You could also use the transaction command to some effect, by determining standard start and end points and find any events which do not fit the part. ... View more

Jamesdon, Good luck with this. I don't think you will always see the same error as in the logs... normally the logs would be for a "techie" and the web errors in a more human readable manner (for the general user)... As you probably already know 😛 Regards, MHibbin ... View more

On the latest Splunk versions 6.0+ you will want to have the Splunk_TA_Windows installed on the Forwarder and Indexer/Search Head tiers. This TA will extract the Event Code fields for you from Windows Event Logs. Don't forget to also turn on auditing and domain policies for the specific events you want to collect. Check out the Splunk Blog post about Windows Event Filtering http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/ ... View more

The key is the -K parameter. In my case I used -K ascii /usr/sbin/snort -K ascii -c /etc/snort/snort_eth2.conf -l /var/log/snort_internet -i eth2 ... View more

Thank you very very very much. ... View more

Yes, but you'd have to create such a view yourself. It would actually be a very simple view. I have updated above with an example that would render as a chart, but you could make a similar one with a table, etc. ... View more

Ok here is what I am seeing in the web_service.log 871 ERROR module:59 - Splunkd daemon is not responding: ('[Errno 24] Too many open files',) It appears that there is a limit to open files? Where would I go to modify this limit? thanks ... View more

... a bar chart type entry starting at "start time" and going on until "end time". Maybe I am being too particular. I will give your suggestion a go and it will probably give me good enough results. Again many thanks for your help here. ... View more