All answers querying for all sources from metadata had the same typo.   Use : |metadata type=sources index=* ... View more

You need to extract json part of your log message and pass it to spath to get the fields extracted automatically. Try this - based on your sample data above your base search |rex field=_raw "^(?:[^ \n]* ){5}(?P<my_json>\{\"\w+\":\"\w+\",\"\w+\":\"\w+\",\"\w+\":\"\w+\",\"\w+\":\"\w+\",\"\w+\":\"\d+\-\d+\-\d+\s+\d+:\d+:\d+,\d+\s+\+\d+:\d+\",\"\w+\":\{\"\w+\":\"\w+\"\}\})"|fields my_json|spath input=my_json Above filed extraction is taken from Splunk field extraction and needs to be tuned for your specific requirement ... View more

Hi ramehlpatel, have a look at this app https://splunkbase.splunk.com/app/2776/ which provides a way to get the information you asked for. cheers, MuS ... View more

It's not supported. And in the vast majority of case you're better off using the built-in maps in Splunk 6. But if you want to know whether it works, then the answer is probably yes. There are still a few narrow edge cases dealing with large result counts and/or Advanced XML dashboards where it may make sense to use Google maps. Just remember you're going to be largely on your own if it breaks later. It won't work out of the box if you're using SSL, but you may be able to fix it with the following code at line 29 of $SPLUNK_HOME/etc/apps/maps/appserver/modules/GoogleMaps/GoogleMaps.js if (window.location.protocol == 'http') { s.src = "http://maps.google.com/maps/api/js?sensor=false&version=v3.6&callback=_gmapsOnLoad"; } else { s.src = "https://maps.google.com/maps/api/js?sensor=false&version=v3.6&callback=_gmapsOnLoad"; } ( This is a slightly updated duplicate of https://answers.splunk.com/answers/146459/google-maps-not-working-after-upgrade-to-6-1-2.html ) ... View more

Did you check the splunkd.log file for error or warning messages? ... View more

Will Splunk ever fix this? ... View more

No problem, thanks for clarifying! ... View more

Thanks, its now working. ... View more

You don't have a very complex setup as bmacias84 mentioned... and yet you mention a 20% increase in volume. Was that 150GB per day and it's now gone beyond to 180? Anything less than that might be helped by adding an indexer but it will just be diluting the problem not solving it. You mention high performance hardware (mem? CPU? etc...) Unnaturally High CPU usage can = something like bad disk. Indexer IO is quite intensive... so if it's hammering around trying to manage buckets, you're going to see CPU go through the roof. And if there are bad spots and good spots... it won't be consistent. This is a great reason to request support as there are many tools they can use to help you narrow down what might be the problem. Check out this page here http://docs.splunk.com/Documentation/Splunk/6.2.4/Troubleshooting/Collectpstacks Create a diag of each component. $SPLUNK_HOME/bin/diag and open a support ticket. Upload the diag and results of pstack (or if on windows follow info on collecting stack bits) ... View more

Tried Chrome, same results. ... View more

I'm pretty sure that both perc() and exactperc() use the Nearest Rank method: https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method The difference appears to be that for high-cardinality fields perc() might not be accurate for sake of performance so you can use exactperc() to force Splunk to be accurate (within the Nearest Rank method) without regard for expensive computations. ... View more

You can set the inner time range using explicit earliest and latest : outer search ... [search earliest=-w latest=now inner search ...] ... That will override the outer time range for the inner search. ... View more

done and upvoted 🙂 ... View more

This is happening because the timewrap command overlays all previous weeks over the current week. Look at the Statistics tab showing you the data underneath the graph in a table, you'll see rows for this week and columns for each week - essentially, the previous weeks are just different data series for this week. ... View more

something like this? | extract pairdelim=",", kvdelim=":" it will treat the field _raw only for all i know ... View more

you can try like this: index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status) by device_id] ... View more

If you're trying to parse that at index time, use this in props.conf: TIME_FORMAT = %s%3N If you're trying to format that into a readable date at search time, use this: ... | eval readable_date = strftime(STARTTIME/1000, "%F %T.%3N") ... View more

All of your configured DBConnect queries are stored in the inputs.conf. Depending on how, and where, you created these, they will be in $splunk_home/etc/apps/dbx/local/inputs.conf If you have created these specifically in different APP space, you will need to check there. Additionally, btool is your friend. $splunk_home/bin/splunk btool inputs list --debug Search that for your db queries, and it will tell you which file it is stored in. Cheers ... View more

Part of the LDAP configuration process is to (manually) map roles to LDAP group attributes, but you determine what the group attribute you are mapping against is. ... View more

Try this BREAK_ONLY_BEFORE=^\d{2}:\d{2}:\d{2}\s\| ... View more

For cleaning and re-indexing refer this link http://answers.splunk.com/answers/1203/why-wont-splunk-re-index-my-data In this link Yann has given 3 nice options to re-index a file. Just like my earlier comment renaming is one of the options http://answers.splunk.com/answers/46780/reset-splunkforwarder-to-re-read-file-from-beginning ... View more