How can I alert and send email when unversalforwarder stops forwarding log to splunk server or got stopped? ... View more

I went over 500MB limit of splunk and violated the splunk license. which disabled my search functionality. Now, I fixed the log size problem, which is well below 500MB. but still search functionality is not working. How do I fix it? Any help please.. ... View more

suppose two log file have common field named IPaddress. One log file has username filed with that IPaddress field and another log has kernelno field associated with that IPaddress field. Based on IPaddress common field, can I search between two logs to find username and kernelno?? ... View more

Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 3: autoLBUseDNS = false Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 4: backoffOnFailure = 30 Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 6: blockOnQueueFull = true Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 9: disableBackoffOnFailure = false Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 11: dropClonedEventsOnQueueFull = 5 Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 17: maxPersistentQueueSizeInMegs = 1024 Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 18: persistentQueuePath = /usr/local/splunkforwarder/var/run/splunk/persistent_tcp_queue Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 19: readTimeout = 300 Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 22: splunktcpVersion = --splunk-cooked-mode-v2-- Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 25: usePersistentQueue = false There might be typos in your conf files. For more information, run 'splunk btool check --debug' ... View more

search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID I got the each session duration using the above command. Now how do I calculate the average of all those session duration?? ... View more

I have a log which says when session was created and destroyed. What search string should I use to calculate the length of session?? ... View more

2011-11-07 13:25:35,145 FE (Exe 45) (pid 11788) destroyed 2011-11-07 13:25:35,152 PNG.exe (Exe 64) (pid 17286) destroyed 2011-11-07 13:25:35,158 K (Exe 44) (pid 11706) destroyed 2011-11-07 13:25:35,160 Kernel 44 released 2011-11-07 13:25:39,976 FE (Exe 66) initialized 2011-11-07 13:25:41,386 K (Exe 65) initialized 2011-11-07 13:39:14,750 Kernel 47 acquired 2011-11-07 13:39:16,139 PNG.exe (Exe 67) initialized 2011-11-07 13:49:27,829 FE (Exe 48) (pid 12912) destroyed 2011-11-07 13:49:27,838 PNG.exe (Exe 67) (pid 17786) destroyed 2011-11-07 13:49:27,868 K (Exe 47) (pid 12830) destroyed 2011-11-07 13:49:27,869 Kernel 47 released 2011-11-07 13:49:27,982 FE (Exe 69) initialized 2011-11-07 13:49:29,524 K (Exe 68) initialized 2011-11-07 13:58:19,630 Kernel 49 acquired 2011-11-07 13:58:20,147 PNG.exe (Exe 70) initialized In the above log I only to search for log lines that has K and ends with initialized or destroyed. So my search result should be 2011-11-07 13:25:35,158 K (Exe 44) (pid 11706) destroyed 2011-11-07 13:25:41,386 K (Exe 65) initialized 2011-11-07 13:49:27,868 K (Exe 47) (pid 12830) destroyed 2011-11-07 13:49:29,524 K (Exe 68) initialized What might be the possible search query?? ... View more

It was working fine and suddenly got the following error of nowhere and not geeting data anymore. 11-03-2011 16:53:50.854 -0500 INFO PipelineComponent - MetricsManager:probeandreport() took longer than seems reasonable (12380 milliseconds) in callbackRunnerThread. Might indicate hardware or splunk limitations. 11-04-2011 00:30:10.212 -0500 ERROR TailingProcessor - Unable to resolve path for symlink: /www/logs/abc.com/access. Any idea?? ... View more

I have splunk indexed log for 6 months but I want to search log for 20 days only(from current date till 20 days ago) and draw a chart. What might be the possible search query?? ... View more

What's the difference between daily, fivemin, and all backfilling python script?? what does this script does actually for webintelligence app?? logs gets index on real time on my splunk shouldn't this webintellegence show traffic statistics on real time?? ... View more

I have following log. What will be the REGEX to index log containing line the line 'tomcat' trying to restart and send rest to nullQueue?? [CDT Oct 27 09:31:44] info : 'tomcat' trying to restart [CDT Oct 27 09:31:44] info : 'tomcat' start: /sbin/service [CDT Oct 27 09:33:44] info : 'tomcat' process is running with pid 20021 [CDT Oct 27 12:13:44] error : 'tomcat' process PID changed to 6908 [CDT Oct 27 12:15:44] info : 'tomcat' PID has not changed [CDT Oct 27 14:30:04] info : unmonitor service 'tomcat' on user request [CDT Oct 27 14:30:04] info : monit daemon at 13351 awakened [CDT Oct 27 14:30:04] info : Awakened by User defined signal 1 [CDT Oct 27 14:30:15] info : restart service 'tomcat' on user request [CDT Oct 27 14:30:15] info : monit daemon at 13351 awakened [CDT Oct 27 14:30:15] info : Awakened by User defined signal 1 [CDT Oct 27 14:30:15] info : 'tomcat' trying to restart [CDT Oct 27 14:30:15] info : 'tomcat' stop: /sbin/service [CDT Oct 27 14:30:43] info : 'tomcat' start: /sbin/service [CDT Oct 27 14:31:43] error : 'tomcat' failed to start [CDT Oct 27 14:32:43] error : 'tomcat' process is not running [CDT Oct 27 14:32:43] info : 'tomcat' trying to restart [CDT Oct 27 14:32:43] info : 'tomcat' start: /sbin/service [CDT Oct 27 14:32:44] info : 'tomcat' started ... View more

Hi, What will be the search condition if I wanna display only one log line if they occur within 5 min?? For e.g. 10:10:30 tomcat trying to restart 10:9:10 tomcat trying to restart I want splunk to count those two events as one if they occur within 5 min time duration. ... View more

I am new to this Splunk...I have universal forwarder installed on my two linux machine and successfully forwarding apache, tomcat logs to another linux machine which has Splunk server(indexer) using tcp port. Now I want to filter those logs based on REGEX. I was just wondering which files and which section of the files should I make the changes on universal forwarder and splunk index?? ... View more