Its not giving me exact results.. Its showing result as Values(key1) and values(value1) result. These fields are not showing in interested fields. Thanks for your quick help Output im getting below: test Key1 value1 test1 Date Mon Jul 17 23:56:36 EDT 2017 \t size 597 \tAttribute unmatched \tContent http test2 Date Mon Jul 17 23:56:36 EDT 2017 \tsize 597 \tAttribute unmatched \tContent http ... View more

Have you check out the DeploymentMonitor app. It ships with Splunk, but is not enabled by default. To enable it, go to Manager -> Apps and click 'enable' for the SplunkDeploymentMonitor Then you can choose DeploymentMonitor in the 'Apps' menu (it will not have much data to show right away, since it works with scheduled searches). You can set up alerts for 'quiet' or 'missing' forwarders. source will help: https://answers.splunk.com/answers/48209/best-way-to-alert-for-not-receiving-data-from-a-source.html ... View more

Also note that many people are saying that this error can come and go so this may not be the end-all solution. ... View more

In my case, I'm running a SQL query that reads a file 20 in 20 minutes. After a few hours automatically the operation created is disabled. The results of my query generates about 20 lines My stanza is configured as follows: [settings] splunkdConnectionTimeout = 1200 The problem still persists. Any suggestion? ... View more

Examples in our docs here - http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Top ... View more

Hi, you can try frozenTimePeriodInSecs, rotatePeriodInSecs options. Eg: frozenTimePeriodInSecs=3600 rotatePeriodInSecs=30 Also dpeneding on the data size you are receiving you can try other options maxTotalDataSizeMB homePath.maxDataSizeMB coldPath.maxDataSizeMB check out the spec for options.. ... View more

Yes, we tried with xmlkv command & "KV_MODE = xml" in props.conf We are getting all the results as list basis not in event base means ex: 0036651c6fffb000c60337c64f3ee4ac 0036651c6fffb000c60337c64f3ee4ab 0036651c6fffb000c60337c64f3ee4ad 0036651c6fffb000c60337c64f3ee4af 0036651c6fffb000c60337c64f3ee4ag Its whole result comes under one result (showing as list/values command). I need it as separate events. ... View more

we tried all these option.. but no luck. ... View more

Are you using Windows? Windows has issues with file locking. ... View more

Thanks for quick reply, I had a data for daily basis with half an hour intervals (so per day 48 events) will be generated in Database. Getting data into index "myindex", using Splunk DB connect dbinput. On that index, with span period of 1 day, I have to calculate interval wise (00:00,00:30... so on) averages & summation for Column1 & Column2 on time interval basis. i.e. for "0:00:00" on day1,day2 , day3... so on , values average and summation. and that should display in another column along with day1, day2, day3 values .. so on values with column1 & column2 values (as sample output provided in above question) I have used stats, streamstats and timechart to achieve expected output, but not succeeded . ... View more

Like this: ... | eval BandC = B . " " . C | stats values(BandC) AS "B C" by A ... View more

Is this ran directly into the application Query? I tested it and it returned 0 rows, are you running this as one large Query? Or are you saving a job then in a separate search calling it?? ... View more

Apparently you can do it very easily by: Reference your token in the target dashboard as any token: search index=... field=$token$ Use the url to give value to the token searchhead:8000/en-US/app/search/mytarget?token=value1 searchhead:8000/en-US/app/search/mytarget?token=value2 So you don't have to create input in the dashboard for the token to work. ... View more

Thanks sideview ... View more