@Jaki001  You will probably get better responses if you open a new question with your problem. The question was probably asked fine, it's only that you need your own set of answers to this and that will happen by asking the question as a question instead of as a comment to this 6 year old thread. So, copy all that out, and start up a new "Ask a Question" and I'll bet you'll get some great answers! ... View more

It's mostly in the docs: https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/Installtheuniversalforwardersoftware and maybe https://docs.splunk.com/Documentation/Forwarder/8.2.5/Forwarder/Configuretheuniversalforwarder As to logrotate - that's all outside of Splunk.  Basic Linux maintenance on log files.  Any internet search engine is your friend here and all will lead to results that are useful. Best search may be though to get some "Splunk specific" search results, using a search like "splunk syslog" and read through a few of those best practices that will come up. ... View more

| inputlookup <lookup or filename> | stats max(<field that's the date field>) or | inputlookup <lookup or filename> | stats max(<field that's the date field>) BY displayName   And if you were wanting a more useful way base search here that returns regular data | lookup <lookupName> <fieldInLookup> AS <fieldInData> OUTPUT lastUpdate Which assuming you fix up the lookup name, double-check the fieldInLookup vs. fieldInData order (I always get those backwards!) and change the fieldname 'lastUpdate' to whatever it is in your lookup, will output the lastUpdate for each ... "field" you match on.  Perhaps displayName or something, whatever it is that should match. This might help: https://docs.splunk.com/Documentation/SplunkCloud/8.2.2107/SearchReference/Lookup   ... View more

Well, this is really a linux question, not a splunk question. You should be able to find a forwarder's installed splunk executable by a command similar to $ sudo find / -name splunk -type f Look for a line like /opt/splunk/bin/splunk or /opt/splunkforwarder/bin/splunk. And come to think of it, it's a rarity that it's outside of those two paths in a small environment like what yours sounds like. As to why it's not running?  That's a question with a zillion different answers. Possibly it's just not running (e.g. crashed, not set to autostart and the system got rebooted, someone issued a "splunk stop" command, etc...) and you can just start it up. Possibly it's not able to connect to your indexers  (upgrades to idx and the forward is just too old to talk to it, networking changes, gremlins. Maybe someone uninstalled the entire forwarder from it.  Disabled it.  Deleted the user it runs as. As mentioned, the reasons it's not running are nearly infinite, you'll have to just do a little basic troubleshooting.    ... View more

Well, that doesn't actually have "website" in it as a field. Still.  If you have that data ingested, and the fields that appear like they should be extracted are (total_time, content_md5, etc...), then ... OK, so I'm looking even closer at this.  How would you, like as a regular person using words in English, describe how you would manually use these 4 rows events to know if the site/page was up at the time?  Because, what I see is that it might be more effective to count where field timed_out=True (assumption that's it's value when it's not false). Or where response_code is 400 or higher (assuming these are http status codes, or similar, and that 300-level ones are redirects.  And if this is server code, my guess is problems will be in the error codes at 500 and above in that case. Either way... for a count of "not timed out" vs. "timed out"   <your base search here> | timechart span=1h count by timed_out   Or maybe you ONLY want the ones that timed_out, this way you can reserve the "by" clause in the timechart for "by title" to split it based on ... well, title.  You wanted server or web page, but I don't see that directly so this is my proxy for it.    <your base search here> timed_out=False | timechart span=1h count by title   Or maybe only where the status codes are 400+? <your base search here> status>400 | timechart span=1h count by status There are quite a few options. A lot of the options are pretty simple ones, leading me to suggest that you take Splunk Fundamentals 1. It's a free 6-10 hour on-line course from Splunk that covers a lot of fairly simple use cases like that, and a lot more.  Just search for it in ... oh they've changed things in Splunk education recently.  Try here: https://education.splunk.com/single-subject-courses and look at the ones that offer "free e-learning".  Many of those map to Splunk Fundamentals Part 1.     ... View more

Dumb question! Is this right, or should the minus and plus be reversed? | eval end=if(info_max_time=="+Infinity",now(),info_max_time)-432000 | eval beginning=if(info_min_time=="0.000",1604260193,info_min_time)+432000 Because a quick read of that seems to say you are taking the end and *subtracting* 432000 from it, and the beginning and *adding* 4320000 to it, then trying to find where _time was between those two. I think it might need to be | eval end=if(info_max_time=="+Infinity",now(),info_max_time)+432000 | eval beginning=if(info_min_time=="0.000",1604260193,info_min_time)-432000 Hopefully it's that simple of a facepalm, but let us know if it's not!   Also, you could try hardcoding some times in there for those to make sure it works right when you do that.  Might help narrow down where it might be going wrong. ... View more

This might be possible with the stats command, transaction command, or in a variety of other ways. What does your data look like?  Can you provide a few rows of that raw data as you see it in Splunk? ... View more

You could possibly just stick a | head 1000 or some other number right after the base search (before the first rex) and run it over a somewhat longer period (like 20 or 30 minutes in this case), if you had a reasonably predicable "count" you could go back to consistently. How would you, as an actual person looking at the data, describe what you mean by "only showing the last data".  I mean, how would you do that if you had this data in excel?  What would define the "last data," and how would that be split apart from the data that came before? I think with this answer we might be able to come up with something better.   On a side note, this search looks both really fragile, and also could be faster and better. Was the replace for 1H and 1E with UC1 skipped on purpose with the appendcols search? I think if that was just an omission or isn't important, that you could do this index=centreon check_command="Cisco-SNMP-Interfaces-Global-Status" service_description="Status_All-Interfaces" src_interface!="Ethernet*.*" src_interface!="Vlan*" src_interface!="mgmt*" src_interface!="port*" src_interface!="Null*" src_interface!="loopback*" | head 1000 | rex field=host "ZSE-(?<loc>\w+)-(?<room>\w+).*" | replace "1H" WITH "UC1"| replace "1E" WITH "UC1"| replace "2H" WITH "UC2"|replace "2F" WITH "UC2"| replace "6E" WITH "C6"| replace "6F" WITH "C6"| replace "6T" WITH "C6"| replace "4B" WITH "C4"| replace "4T" WITH "C4"| replace "4E" WITH "C4" | eval site=loc+"-"+room | stats count(src_interface) as tot_int, sum(eval(if(state_interface="up",1,0))) as tot_up by site | eval tot_free = tot_int - tot_up   I'm sure that probably needs tweaking, but the advantages in speed and non-duplicated SPL is very large - it's probably worth some time doing a thing like this.   ... View more

Could you explain what it is you are trying to actually accomplish?  I'm pretty sure we can find a way to get done what it is you need to get done if we only knew what it was you were trying to do, but you are still starting at the end of the process.  But maybe this is the answer you were looking for - There's no way to branch like that in SPL.  It is a linear pipeline from the beginning to the end (with a few weird fan-outs that aren't branches for the map command and a few others).  If you do a thing in step N-1 that removes field X, then in step N you can't reference field X because it's not there.  The *only* output it gives will be the output from step N, and that won't include what was removed in step N-1. So if outputlookup doesn't have a way to filter to a specific set of fields, the only way to filter it to a specific set of fields is in the step before the outputlookup, which means you lose that context. So either you run the search twice - once to get the alert and once to update the threshold, or you rethink *how you are doing this whole process* and make it so it'll all work like you want.  Which we'd love to help with, but we need to know what it is you are doing in order to help you with that.                 ... View more

If you only want "last_file_time" back in the MyFileThresholds.csv, then only *put* last_file_time in there. ... | table last_file_time | outputlookup append=false MyFileThresholds.csv  Of course, you didn't structure your search to only GIVE you a single last_file_time, but instead to give one per event, and an event in this case is ... probably ... possibly?... a list of filenames and last_file_time and some other fields? If you only wanted to update the last_file_time with the new information from your search, then it seems like that's what you are doing - though you hid that giant search inside the "it has to be a join" so we can't really see what it's doing.  Anyway! If you would like a better answer, please let us know what it is you are trying to do in English.  Just explain it. It feels like you are starting at the end of the process instead of at the beginning.   ... View more

OK, so assuming you strictly interpret the need here, and assume that it's only values of 600 and 900 and no others, and I took out one 600-value from the test data I built so I could confirm that if there's a 900 and NOT a 600, that it does what I expected. Then, with those caveats and this fragility, one could do the last two lines here. | makeresults | eval testdata = "cod:5678,status:600XXcod:9012,status:600Xcod:1234,status:600Xcod: 1234,status:900Xcod:4987,status:600Xcod:4987,status:900Xcod:3655,status:900" | makemv testdata delim="X" | mvexpand testdata | rex field=testdata "cod:\s*(?<cod>[^,]*),status:\s*(?<status>\d*)" | chart values(status) over cod by status | rename 600 AS Status1, 900 AS Status2 WHERE - the first 5 lines (run them all by themselves!) are just to build a test data set as a run-anywhere search. The chart command and the rename command - the last two lines - are the ones that do the work. And it assumes you have this data ingested in a way there are two fields for each record - a cod field and a status field.  Otherwise, really, you should go back and reingest the data and set that up. ... View more

Good News! It appears that in Splunk Enterprise 8.1 they have added this. Direct quote from authorize.conf for version 8.1+ (just search for it in there): srchIndexesDisallowed = <semicolon-separated list> * A list of indexes that this role does not have permission to search on or delete. * 'srchIndexesDisallowed' takes precedence over 'srchIndexesAllowed', 'srchIndexesDefault' and 'deleteIndexesAlowed'. If you specify indexes in both this setting and the other settings, users will be unable to search on or delete those indexes. * Follows the same wildcarding semantics as the 'srchIndexesDefault' setting. * If you make any changes in the "Indexes" Settings panel for a role in Splunk Web, those values take precedence, and any wildcards you specify in this setting are lost. * No default.   ... View more

And of course, the very next link I hadn't yet followed yet, was a answer by the inimitable Martin, https://community.splunk.com/t5/Archive/How-do-you-interpret-string-variable-as-SPL-in-Map-function/m-p/385353 which if you can create a macro do magic on your string, then this can be done. It's totally a hack, but at least it's something. ... View more

I was looking for an answer to the same sort of question, if one exists, and as I read this exchange I wanted to comment.  Partly as a "better but still very unsatisfactory answer" for folks, and maybe also for a bit of "let's see if anyone else comes up with a solution". I think the ask is really for - Is there a way to have a code path that either is or is not *executed* depending on some condition; a variable being set or not, or being of a particular value or whatever? In every example thus far, the code path executes regardless of the status of the variable.  You can test this yourself with a search/expression there that fails and fails *hard*.  Here's an example. On Splunk <any edition but free> this returns either your srchJobsQuota value, or the word "skipped" depending on if you flip the true to false.  To be clear, this works fine: | makeresults | eval results = if(false(), [| rest /services/authorization/roles/admin splunk_server=local | return $srchJobsQuota], "") But if I change my test box from my dev license to the Splunk Free license, since Splunk Free doesn't support that rest call *at all* (LOL - "Payment Required"), then no matter which way false/true is flipped, this fails. In both cases in Splunk Free, true and false, you get this same error: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ', "skipped")'. [subsearch]: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/authorization/roles/admin?count=0 from server=https://127.0.0.1:8089 - Payment Required So it's executing that code without regard to whether it's in the active path or not.  Because it's a subsearch, they run first. I thought maybe I could get around this using map, but all attempts so far that I've tried have failed because I can't find a way to run an arbitrary string (which can easily be created from an if like above) from map.  It looks almost like you should be able to, but either it just won't work or I haven't found the magic combination.  And I've tried quite a bit... I'll think on it some more, maybe there will be more suggestions from the peanut gallery too.  🙂 Happy Splunking, Rich   ... View more