cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
rdschmidt
Explorer
Member since: ‎07-06-2012
‎06-05-2020
Community Statistics
Posts 6
Solutions 0
Karma Given 0
Karma Received 5
Member Since ‎07-06-2012
Activity Feed
View All

Re: Why is parsing taking so long even with basic ...

by in Splunk Search
‎08-04-2014 06:58 AM
‎08-04-2014 06:58 AM
Linux CentOS ... View more

Why is parsing taking so long even with basic sear...

by in Splunk Search
‎07-31-2014 12:12 PM
4 Karma
‎07-31-2014 12:12 PM
4 Karma
I am having an issue with our Splunk Server. Every search you run, no matter all the filters, or if you create it basic, the search will say "Parsing" for almost 100 - 120 seconds before it searches. Sometimes if i search a block of records for 7 days and it contains 300,000 records it will parse for 120 seconds and the search will only take 80 seconds. I have this running on a Virtual Machine that has 8 CPU and 16 GB of RAM dedicated. I cant find that this is a CPU or Memory Issue. Any Help would be greatly Appreciated. ... View more

Re: Pull Timestamp from Field in Raw Data

by in Getting Data In
‎07-31-2013 09:07 AM
1 Karma
‎07-31-2013 09:07 AM
1 Karma
The above time_prefix did fix our TimeStamp issues on our AAA records. We are still working on the CSOFTX3000. The issue is we are using 450 byte CDRs and the app is built for 350 byte. ... View more

Re: Pull Timestamp from Field in Raw Data

by in Getting Data In
‎07-11-2013 10:59 AM
‎07-11-2013 10:59 AM
Here is my search : x@wireless.com | convert ctime(Event_Time) as TIME I just want to make the TIME field automatically show up as the timestamp. Thanks, Riley ... View more

Re: Pull Timestamp from Field in Raw Data

by in Getting Data In
‎07-11-2013 10:59 AM
‎07-11-2013 10:59 AM
Raw Data: 213|2|0|1|0|x||x.x.x.x|x@wireless.com|0782A8FC|07784722|0|0|x.x.x.x|x.x.x.x|x.x.x.x|0083|0|0|0|59|0|0|0|0|0|2|1|3|0|0|9747835|197309|0|1373498910|2019|0|0|0|0|0|211465|0|0|10|0|0|0|0|0||10026|2|0|1|541|3539|6668|1|07784722|0|0|0|24|x|0104000102040001|875560960||0|0|0|0||1373498539||0|311650|0|0|0|0|0|0|0|0|0||0|0|0|-1|||| timestamp: 7/10/13 6:54:51.000 PM Derived Fields: | Event_Time=1373498910 | TIME=07/10/2013 18:28:30 ... View more

Pull Timestamp from Field in Raw Data

by in Getting Data In
‎07-11-2013 09:38 AM
‎07-11-2013 09:38 AM
Can anyone tell me how to configure my Props.conf to use a defined field "Event_Time" (Which is in Epoch Time) for the timestamp (_time) instead of pulling the time when the file was saved? Currently i have this configured: TIME_FORMAT = %b %d %H:%M:%S ctime(Event_Time) MAX_TIMESTAMP_LOOKAHEAD = 32 TZ = US/Central Thanks, Riley ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from