Help vote up these new feature ideas ..   which is for Splunk to create an app or feature within to product to schedule reoccurring disablement of certain scheduled searches/alerts/reports. https://ideas.splunk.com/ideas/EID-I-181 https://ideas.splunk.com/ideas/EID-I-654   ... View more

Awesome search!     Thank you VERY much.  ... View more

We found a solution that worked in our case. We have windows servers in two different data centers, in different time zones. The application log files in each are using the local time zone for the timestamp.   We were going to switch based on hostname BUT that introduced problems where log file like IIS which are in UTC, everywhere.  We found in the documentation for props.conf that if TZ for a sourcetype stanza is NOT specified, it will default (use) the servers local time stamp.  That worked for us.    TZ = <timezone identifier> * The algorithm for determining the time zone for a particular event is as follows: * If the event has a timezone in its raw text (for example, UTC, -08:00), use that. * If TZ is set to a valid timezone string, use that. * If the event was forwarded, and the forwarder-indexer connection uses the version 6.0 and higher forwarding protocol, use the timezone provided by the forwarder. * Otherwise, use the timezone of the system that is running splunkd. * Default: empty string   ... View more

Hello,  We have a similar but slightly different situation.    Will implementing the host:: stanza impact ALL sourcetypes from the host caught by the filter?      We have for example IIS logs which are in UTC and then application logs based on datacenter timezones,  CSTCDT  or ESTEDT.    We tried host:: based on hostname/datacenter/location.  But now our IIS logs are coming in, in the future.    Any suggestions?  ... View more

For our case, we found success with; 1) Found and copied this driver file from Intersystems instance to Splunk, /opt/splunk/etc/apps/splunk_apps_dbconnect/drivers/cache-jdbc-2.0.0.jar 2) Configured /opt/splunk/etc/apps/splunk_apps_dbconnect/local/db_connection_types.conf as follows (generalized) [intersystems_ cache] displayName = Cache jdbcDriverClass = com.intersys.jdbc.CacheDriver serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcUrlFormat = jdbc:Cache://:/ ui_default_catalog = [relevant catalog name] port= [relevant port number] database = [relevant database name] serviceClass = com.splunk.dbx2.DefaultDBX2JDBC came from this answers post; https://answers.splunk.com/answers/591704/unable-to-load-netezza-driver.html ... View more

This is great! However, it returns a ton of information. Is there any way to limit the scope of returned values? To perhaps certain attributes? or specific app context? ... View more

Thank you so much! I will give this a try and report back. ... View more

Yes, while I like this answer and have used it many times in the past. Sometimes I have not control over the input and in this case it is better to read the .out file with mixed inputs rather than not. I totally understand and it is a better approach to make the timestamps consistent and the log file more pure than mixed. See the second answer posted to this question. I will be giving it a try and report back. ... View more

I think trigger conditions is the way to go. ... View more

thought I had map working .. as a second search but it's not working .. I get 10000 stats and think I'm running Splunk into the ground. My basic point is this, I want to create an alert based on a count of something (that works) but then I want to send my ops team more details about the alert, hostname, ldap server, etc, fields that I already have defined. Maybe put that in a report and tie that to the alert using map? ... View more

Using the "map" command worked, in this case triggering second search if threshold of 2 or more is reached. index= source= host="something*" | stats distinct_count(host) as distcounthost | eval tokenForSecondSearch=case(distcounthost>=2,"true") | map search="search index= source= host="something*" | stats count by host,source | sort - count" ... View more

I think what I need is this https://answers.splunk.com/answers/614705/how-to-trigger-second-search-based-on-first-search.html So first search and alert on the distinct number of hosts (with my condition) then trigger a second search that give more details. I'll give it a try and report back. ... View more

Thank you for the reply! The first suggestion works, sort of. I get a table with a columns, host, count, and distinctCount. distinctCount for each host is "1". When I add the where condition it doesn't work. I have to move where distinctCount > 0 to get any table. ... View more

Is a Splunk restart required after making this call? ... View more

Is a Splunk restart required after making this call? ... View more

This is very helpful. But I need to scrub savesearches.conf for any scheduled search with an email alert action and provide a report, so we can show and eventually update email addresses. Each stanza in savedsearches.conf can be different. It would be great to have a configurable view of savedsearches.conf with output to csv. This sounds like a feature request for splunk or a series of scripts. ... View more