one more try to see if anyone has any ideas? ... View more

Sorry, just to clarify this a bit further, the view I have set up is complex and has a lot of graphs, etc. So it is not something that I can run as a search and then use sendemail. I am wanting to generate the pdf from the html page and then forward this pdf onto an email address, similar to using a scheduled search but I need to be able to trigger it from a script ... View more

Hey lain179, I am not sure how splunk works with DA, but have you had a look at the passwd file that holds default user details in: $SPLUNKHOME/etc/passwd Might be somewhere to start. Regards Vince ... View more

Hi mmason, is the search that you have provided in the question, is that what the app is calling or is it your search, as it may be easiest to simply edit the saved search or xml the app is using. Let me know if I have missed the point of if you need me to clarify my question. Regards Vince ... View more

Hi daniel333, If you create a new Alert through the management interface(Manager => Searches and Reports => Add New). It will allow you to set the Alert Condition, where you can choose "if number of events" then "is greater than". It will step you through all of the process. I hope that this is what you are looking for. Regards Vince ... View more

Hey bagelbyheart, If you move the password config file $SPLUNK_HOME/etc/passwd file to $SPLUNK_HOME/etc/passwd.bak. If you perform a restart of splunk you should then be able to access splunk with the default admin/changeme username and password. Let me know if this does not work...maybe there is a new change to splunk that stops access as well? Regards Vince ... View more

Hi sourabhguha, if you do reindex your data, I would be interested to know if it works or now? Regards Vince ... View more

Hi sourabhguha,(amended from previous answer) Have you set up a props.conf file for this data as you can add a config that will break each line up as a different. I have just been testing with the data that you have and have been able to get it working by adding the TIME_PREFIX option to the props.conf and adding a comma, as listed below: TIME_PREFIX=, If this does not work, let me know what you props.conf file looks like and I would be glad to work on it further with you. Regards Vince ... View more

Hey Kai191, with regard to the logs, if you are on the forwarder and you go to the following location, you will be able to see the log files: /opt/splunkforwarder/var/log/splunk Have a look through the splunkd logs...this should let you know if there are any connection issues with the forwarder connecting to the indexer ... View more

Sorry, I forgot to mention that if you want to overwrite the entire app, you can simply reinstall from the manager ... View more

Hey olopez77, Have you checked out the Splunk License Usage app that is available: http://splunk-base.splunk.com/apps/22382/splunk-license-usage I think this should give you a good idea as to how you can set this up...One of the searches being performed on the dashboard does something like the following: index="_internal" source="metrics.log" per_host_thruput | chart sum(kb) by series So all you would really need to do is provide host details for each BU and you can get a total from that. Hope that this helps, if not let me know and I would be happy to clarify. Regards Vince ... View more

Hey mfrederckson, This should be pretty straight forward with a regex such as the following: &\s(?P [^ ]+)\s& If you could provide some more information on the actual logs you are searching through, as well as the context of your regex, eg; is it for a props.conf or a search, etc...I would be happy to assist further. Regards Vince ... View more

Hey Kai191, I think Ayn is trying to get some further information on your set up and what troubleshooting you have performed so far. Can you please do the following and provide the answers: 1. can you telnet from the forwarder to indexer on port 9997, eg; telnet 9997 2. Have you set up the /opt/splunkforwarder/etc/system/local/outputs.conf and print out the info 3. Can you please run a netstat to see if ports are listening on the index host, eg; netstat -tnap | grep 9997 4. Are you seeing any errors in the splunkd or metrics logs on the forwarder. Regards Vince ... View more

Hey dgagjov, My guess would be that the characters in the search that you are doing are being recognized as xml tags and is confusing things. If you enclose your search in <![CDATA[ and ]]>, it will allow you to place anything into your search without there being any issue. Eg: <![CDATA[ source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed" ]]> Let me know if you need me to elaborate, and let me know if this does not work. Regards Vince ... View more

Hi a212830, Try something like the following for your props.conf: BREAK_ONLY_BEFORE=^\*\*\s+\w+|^\[ NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true The BREAK_ONLY_BEFORE is in two parts to have two separate event: 1. ^\*\*\s+\w+ - this is looking for a newline starting with 2 asterisk a space then a word 2. |^\[ - OR a square bracket at the start of a line. Of course you can make this as complicated as you like depending on your events, but from what you have shown me the regex of ^\*\*\s+\w+|^\[ should work as an event break for your data. Regards, Vince ... View more

Hi a212830, If you create you own source type and you use the BREAK_ONLY_BEFORE option to create a regex that will look for the two linebreaking formats: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf Without knowing much more information on what you are currently working on, you could set it to something like: BREAK_ONLY_BEFORE = (^*|^date) Hope this helps, if you would like to provide some examples, I would be happy to help set up the props.conf file with you. Regards, Vince ... View more

Hey rossikwan...can we get a little more information here. What is the data you are trying to put into splunk and let us know what it is displaying as date and time? Regards Vince ... View more

Hey catch_milli, try checking the running processes like: ps aux | grep 8089 Regards Vince ... View more

Hey dengjin, I think I understand what you are saying here. The command "./splunk add monitor col1" would be monitoring standard output that perfmon would be printing out to...You are probably best to be running your perfmon command that outputs to a text file and then running your monitor command to monitor that text file. eg; ./splunk add monitor /var/log/perfmon.log Please let me know if I have missed what you are asking. Regards Vince ... View more

Hi disha, probably a silly question, but have you tried to separate each of the fields instead of including them in one string, eg; instead of str, have the fields name, input, output...just a suggestion ... View more

Hey jalfrey, I had a lot of issues getting lookup tables to work when I first started using them. Is the file simply a csv file and can you post a couple of lines as an example? ... View more

Not sure what the easy way to resolve this issue would be, but I would guess you could either, change the app to point to your old data as well as your new data or use the collect command to move the data into the newly created app index eg: index=oldindex | collect index=newindex The information you search for will then be piped into the index you need http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect Not sure if there is a better resolution to this ... View more