I think a summary index would be a good idea to retrieve results faster. http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Usesummaryindexing This should help you. ... View more

http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorChangestoYourFileSystem- Monitor file system [fschange:] signedaudit = false index=_audit ... View more

yes this should work too if you jusr monitoring the changes to a file- http://docs.splunk.com/Documentation/Splunk/6.4.0/Data/MonitorChangestoYourFileSystem ... View more

can you provide a sample event for the same, if its not the timestamp then it must be another field which is corresponding to "last updated time". ... View more

I thought that was your issue, the csv file having an older date. I am sorry can you provide more details on what exactly you are running into. ... View more

why not after doing an append add this to the existing lookup file with command "|outputlookup csvfilename.csv " this will create a new CSV whenever the search runs, so you dont need a big timescale to be searched ~1 hour. I was running into a similiar issue and I solved by using this technique. If this works please accept the answer,. ... View more

Have a search query running lets say every hour and appending the results to an existing lookup table with time added - | inputlookup append=true . Now since you have a time field in the table in your search string put filters for filtering using this time field. ... View more

index=abc earliest=-60m latest=-31m |table _time IP |eval Group=First | join _time [search index= abc NOT [search index=abc earliest=-60m latest=-31m |dedup IP| table IP] earliest=-30m latest=now |table _time IP|eval Group=Second]| table _time Group This should give you result from group 2 avoiding IP's from first group. ... View more

you can get sid using -| rest /services/search/jobs count=0 | search isDone=1 isSavedSearch=1 | table label sid | loadjob $sid$ normally an sid look like this - search_id='scheduler_nobody_U3BsdW5rX1NBX0NJTQ_RMD5eddd0618b168fff8_at_1457648640_1115' 1457648640 -is the epoch execution time , use a token to be passed to convert your time into epoch and append that to sid. ... View more

for saved searches you can either delete them from savedsearches.conf or change owner, You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta. Determine the app that the savedsearch (or tag or eventtype etc) belongs to. Edit the file $SPLUNK_HOME/etc/apps/[appname]/metadata/local.meta Find the item(s) that need to be changed, and update the owner field. [savedsearches/mysearch] export = none owner = admin version = 6.2.3 modtime = 1394164870.793299000 or you want it to be done using CLI - https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html ... View more

I assume the Splunk server you erbuilt was an Indexer and now you want all data from log files which were earlier indexed prior to the issue. For that please remove everything from splunkforwarder/var/lib/splunk/fishbucket in the Splunk forwarder and it should restart monitoring as new and resend everything ... View more

Try this : Logic - So the sub search does this - when eventA occures we get the time for that and compute earliest as {_time - 1 hour and 2 minutes} and latest as {_time - 1 hour} index=abc sourcetype=xyz [ search index=abc sourcetype=xyz "EventA" | eval earliest=_time-3720 | eval latest=_time-3600 | fields src_ip earliest latest | FORMAT "(" "(" "" ")" "OR" ")" ] ... View more

For sure you might have some process running which creates again files and dirs you just deleted. Run the below and please provide the result: cd /opt/splunk ; df . ... View more

telnet fails which means either of the below : 1. Indexer port 9997 is not open 2. Splunkd service at the indexer is down ... View more

what user are you logged in as, do you have permissions to delete it. Try doing a sudo su - root before using the rm command. ... View more

This could be possible due to many reason, and some of them are: 1. The indexer cluster is down 2. Forwarder is not able to connect to the Indexer (network issues) 3. Indexer port is queued Do you see this time increasing - like in your sample log it says blocked for 100 sec, does it increment further to 200, 300 ... First try doing a telnet from your forwarder to the indexer : telnet indexerIP 9997 ... View more

Add | bucket _time span=1h| to your first search string to get hourly changes, and for daily do | bucket _time span=1d| host=somehostnames* sourcetype="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" | bucket _time span=1h | stats count(eval(EventCode="21")) AS "Logons", count(eval(EventCode="23")) AS "Logoffs" by _time | eval Difference = (Logons - Logoffs) | table _time Difference ... View more