Hi all. I need to get data from Splunk by invoking an external scrip(Python etc..). Directly when i run the script i need to get the output data. For e.g i need to get the data from an index "CDM" Is there a way to do it? How to start with this? Thanks in advance. ... View more

Hi all. I have to get data from database which is on one machine and indexer on another machine. So How do i get the data from the database? Can Splunk Db connect App be installed on Splunk Forwarder? Thanks in advance. ... View more

Hi, I have to search for data from two different sourcetypes. There is a common field in both the sourcetypes called id. So When i search using this id it should return the corresponding events from both the sourcetypes. It sould searchin both and return the events if the id exists. Can anyone suggest how to do this? Thanks in advance. ... View more

Hi All. I have installed nmon app in splunk running on a windows machine. I have a sample .nmon file which i need to analyze using the nmon app. In the documentation it is mentioned that splunk will look for the .nmon file in /opt/splunk/etc/apps/nmon/var/nmon_repository path. But i am unable to find the var/nmon_repository folder. Should i manually create the folder and paste the nmon file there? ... View more

I have a log which has entries with transactionid and START_TRANSACTION or END_TRANSACTION. For e.g, INFO , createLabel, VF4546, START_TRANSACTION, 2015:04:16:07:11:46.925 INFO , createLabel, VF4546, END_TRANSACTION, 2015:04:16:07:11:47.596 INFO , retrieveB2CClients, 12345, START_TRANSACTION, 2015:04:16:07:15:00.730 INFO , retrieveB2CClients, 12345, END_TRANSACTION, 2015:04:16:07:15:00.777 I have to find out response time for each transaction type for which i have to get the starttime and endtime from the entries. How can i match the corresponding starttime and endtime from the logs? Sometimes the START_TRANSACTION or END_TRANSACTION may be missing. Which means the corresponding start or end time should be filled with zero and while calculating response time i will neglect those entries. Can anyone suggest how to do this? ... View more

I tried adding the data through inputs.conf. I am trying to add sample log file from my system to the splunk server. I added the below code to inputs.conf and restarted the server but i dont find any data in my index. [monitor://C:\Windows\WindowsUpdate.log] disabled=0 index=windowsupdate_test sourcetype=windowsupdate Does anyone know what may be the issue here? Thanks in advance. ... View more

I am displaying a table with running processes and few metrics. If the user clicks on any column then the column's name should get passes to another dashboard which displays graph. below is the code which displays the table, Troubleshooting Tool False 1 splunk.search.job True 1 dashboard Type System Name stringreplace host= True span datetime <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <param name="label">Search</param> <!-- End Header --> <!-- Begin Modules --> <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Running Processes (Point-in-Time)" autoRun="False"> <param name="search"> $computername$ index=winserver_process earliest=`ChangeTime("$datetime$","-3m")` latest=`ChangeTime("$datetime$","+3m")` NOT instance=Idle NOT instance=_Total | dedup source,instance | eval instance=Upper(instance) | stats first(*) AS * by instance | join host type=outer [search index=winserver_config $computername$ sourcetype=WMI:SysInfo earliest=-14d@d latest=now | dedup host | fields host,NumberOfLogicalProcessors] | eval "% Processor Time"=round(if(isint(NumberOfLogicalProcessors),'%_Processor_Time'/NumberOfLogicalProcessors,'%_Processor_Time'),1) | eval "Private Bytes (MB)"=round('Private_Bytes'/1024/1024,2) | eval "Working Set (MB)"=round('Working_Set'/1024/1024,2) | eval "Write Ops/sec"=round('IO_Write_Operations/sec',2) | eval "Read Ops/sec"=round('IO_Read_Operations/sec',2) | eval "Page Faults/sec"=round('Page_Faults/sec',2) | eval Handles=round(Handle_Count,2) | eval Threads=round(Thread_Count,2) | eval "Elapsed Time"=round(Elapsed_Time,0) | eval "ID Process"=round(ID_Process,0) | rename instance AS Process | fields Process "% Processor Time" "Private Bytes (MB)" "Working Set (MB)" "Page Faults/sec" "Write Ops/sec" "Read Ops/sec" "Handles" "Threads" "ID Process" "Elapsed Time" | fillnull </param> <module name="JobProgressIndicator" /> <module name="EnablePreview"> <param name="display">False</param> <module name="Count"> <param name="options"> <list> <param name="text">10</param> <param name="selected">True</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> </param> <module name="MSPager"> <param name="entityName">results</param> <module name="FilterableResultsTable"> <param name="displayRowNumbers">off</param> </param> </module> </module> </module> </module> </module> </module> </module> </module> Thanks in advance. ... View more