Hi all. I need to get data from Splunk by invoking an external scrip(Python etc..). Directly when i run the script i need to get the output data. For e.g i need to get the data from an index "CDM" Is there a way to do it? How to start with this? Thanks in advance. ... View more

Hi all. I have to get data from database which is on one machine and indexer on another machine. So How do i get the data from the database? Can Splunk Db connect App be installed on Splunk Forwarder? Thanks in advance. ... View more

Hi, I have to search for data from two different sourcetypes. There is a common field in both the sourcetypes called id. So When i search using this id it should return the corresponding events from both the sourcetypes. It sould searchin both and return the events if the id exists. Can anyone suggest how to do this? Thanks in advance. ... View more

Hi All. I have installed nmon app in splunk running on a windows machine. I have a sample .nmon file which i need to analyze using the nmon app. In the documentation it is mentioned that splunk will look for the .nmon file in /opt/splunk/etc/apps/nmon/var/nmon_repository path. But i am unable to find the var/nmon_repository folder. Should i manually create the folder and paste the nmon file there? ... View more

I have a log which has entries with transactionid and START_TRANSACTION or END_TRANSACTION. For e.g, INFO , createLabel, VF4546, START_TRANSACTION, 2015:04:16:07:11:46.925 INFO , createLabel, VF4546, END_TRANSACTION, 2015:04:16:07:11:47.596 INFO , retrieveB2CClients, 12345, START_TRANSACTION, 2015:04:16:07:15:00.730 INFO , retrieveB2CClients, 12345, END_TRANSACTION, 2015:04:16:07:15:00.777 I have to find out response time for each transaction type for which i have to get the starttime and endtime from the entries. How can i match the corresponding starttime and endtime from the logs? Sometimes the START_TRANSACTION or END_TRANSACTION may be missing. Which means the corresponding start or end time should be filled with zero and while calculating response time i will neglect those entries. Can anyone suggest how to do this? ... View more

I tried adding the data through inputs.conf. I am trying to add sample log file from my system to the splunk server. I added the below code to inputs.conf and restarted the server but i dont find any data in my index. [monitor://C:\Windows\WindowsUpdate.log] disabled=0 index=windowsupdate_test sourcetype=windowsupdate Does anyone know what may be the issue here? Thanks in advance. ... View more