I have below log format using search query I want to extract json string starting from category field and want automatically make key value pair attributes. Here twist is I dont have access to change conf files. 2016-08-22 08:35:12,914 +00:00 [INFO] [XXXXXX] {"category":"XXXX","source":"XXXX","type":"ApplicationLaunch","referrer":"XXXXX","dateLogged":"2016-08-22 08:35:12,914 +00:00","args":{"topUrl":"XXXXXX"}} Please help me if splunk provides such feature to extract json string using search query. ... View more

Hi, I have requirement where I have to monitor a directory containing files whose creation time is no longer than 15 minutes. I have to a get list of files every time with creation time so I can generate alerts based on that. ... View more

Hi , I want to know if the Google Maps Add-on for Splunk Enterprise is supported in Splunk 6.3? ... View more

Hi, I have single file where I am writing all my logs and its size reached to 300 MB. I am seeing that some logs that present in log file are not seeing in splunk. Here my question is size of log file is impact anyway to splunk to monitor same file ? ... View more

I have installed Cisco Security Suite app with all add-ons supported for it. However, I am getting the exception below in every report under Security Suite. Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'cisco:wsa:w3c' and lookup table 'cisco_wsa_proxy_action_lookup I also checked that CSV file is available with name cisco_wsa_proxy_action_lookup under the WSA add-on. Please suggest how could I resolve this ? ... View more

Hi Team, Currently we are facing a high CPU utilization issue on our indexer because of Splunk's high usage. To resolve this we are planning to upgrade our server in two ways. 1) Upgrade same server with high performance hardware. 2) Divide indexer with multiple servers. ... View more

Hi, I have installed the Website Monitoring app in Splunk, however i could give access to a normal user to add a new website. It's only possible with admin role right now. Could you please share me which capabilities i have to assign to the user role to give that access ? ... View more

Hi, I have an issue with percentile functions provided by SPLUNK. Example: I am getting count by last 7 days as : 11,12,13,14,16,18,22 If I am asking for 90th perc of above value, it's always showing me 22 as a value, not in between like 20 or 21, or if I expect the 80th percentile, it's giving me 18, not 19 or 20. This means it's taking data from the result set, not in between and I'm expecting exact percentiles. Could you please help me to know how we could achieve this in splunk ? I tried all functions provided by Splunk like perc , p , exactperc etc. but results are not changing. ... View more

Hi, I am creating a search that will take date range from datetime field that I have created above. However, inside that search I am using a subsearch which needs last week's avg data. To get that, I have to fetch last week data and make an average for it. How do I apply last week's time range for the subsearch? Kindly assist. ... View more

Hi, I have created reports for last month by comparing weeks. However, when I hover my mouse cursor on the previous week, it shows the current week's date. Why is this happening and how do I fix it? ... View more

Hi, In my Java application, I am printing logs in JSON format. Here in JSON "message" field I am logging a value as key-value pair format (shown below). message: {"TOKEN_ID":"5122b288-9201-4826-93e0-325ad7f2aa00","Result":"SUCCESS","Method":"validateToken()","DATE":"Thu Feb 26 04:42:30 CST 2015","REALM":"LDAP_AD","EMPLOYEE_ID":"999999"} However SPLUNK parser is not able to parse them as SPLUNK fields like Result=SUCCESS, EMPLOYEE_ID=99999 etc. Please help me in this issue. { [-] context: default level: INFO logger: com.wm.ocs.driverSecurity.service.impl.TokenValidationServiceImpl message: {"TOKEN_ID":"5122b288-9201-4826-93e0-325ad7f2aa00","Result":"SUCCESS","Method":"validateToken()","DATE":"Thu Feb 26 04:42:30 CST 2015","REALM":"LDAP_AD","EMPLOYEE_ID":"999999"} thread: WebContainer : 3 timestamp: 2015-02-26T04:42:30.456Z } ... View more

Hi, I have configured DB Connect to get latest data from database to get latest device status like Online/Offline. I have more then 12k devices and same data coming from the database each minute. At the time of creating the SPLUNK report, I have to find the latest event coming from each device to get latest device status. Please could you help me how I can achieve this? ... View more