Hello, since daylight savings time is active we have a time offset for our events. For example, we use das splunk stream addon to ingest netflow data.  Within the Events, the timestamp is configured "2021-04-13T05:32:31Z". For my understanding with Z for zulu (UTC) But if i search for events my _time is 07:32:31. two hours later.. Our timezone is Europe/Berlin. How can i get this fixed? In the sourcetype of stream_netflow is the timestamp configured to auto. The OS time from the indexer/search head or universal forwarder are correct to CEST and the time is also correct.   We have several other sourcestypes where the time offset is around 1 or 2 hours. ... View more

Hello, we use mstats to visualize the _value. But for cpu perfmon values there is a number with 10 or more decimals after the pound like 45.736484739 For normal events we can use the eval command with round but for metrics this should be not working. How can we round the metrics values in the charts?   | mstats avg(_value) prestats=t where metric_name="Processor.%_User_Time" AND index=* span=1m AND host=WI219SQL-P1 by metric_name | timechart avg(_value) as "AVG" span=60m   ... View more

Hi, i am trying out the unix and linux addon on my linux machines.  I enabled the iostat_metric monitor an see high io values. Often about 100 till 2000 iops. But thats wrong. Its  test machine and also vcenter monitoring shows only 1-5 iops and after enabling collectd monitoring, collectd also shows low iops.  If i run the iostat_metric.sh script manually, it shows also some time those high iops. Running iostat manually, the iops are low and right. Is there a known bug in parsing the output from iostat? Does someknow see same behavior. ... View more

Hello, i read hundreds of articels, but its not working well. i try to gather data through telegraf from my snmp devices or other linux devices.  First i install on a linux device telegraf 1.17. Create a simple input file       [[inputs.diskio]]       and a file output         [[outputs.file]] ## Files to write to, "stdout" is a specially handled file. files = ["stdout", "/var/snmplog/metrics.out"] data_format = "splunkmetric" splunkmetric_hec_routing = false         On the universal forwarder where my telegraf is running on, i create a inputs.conf stanza for the metrics.out file       [monitor:///var/snmplog/*.out] disabled = false index = telegraf sourcetype = telegraf         and in my company app a props.conf stanza for the sourcetype telegraf       [telegraf] category = Metrics description = Telegraf Metrics pulldown_type = 1 DATETIME_CONFIG = NO_BINARY_CHECK = true SHOULD_LINEMERGE = true disabled = false INDEXED_EXTRACTIONS = json KV_MODE = none TIMESTAMP_FIELDS = time TIME_FORMAT = %s.%3N LINE_BREAKER = ([\r\n]+)         I tried to create the index "telegraf" as event index and also as "metrics" index. What is the right type of index for telegraf sending as splunkmetrics? Running with metrics index type i dont see any events. Running with event type index, i see events, but no fields are extracted and i have a big event with hundreds of values.       {"_value":103672,"metric_name":"diskio.weighted_io_time","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.writes","name":"loop2","time":1612282330}{"_value":47713280,"metric_name":"diskio.read_bytes","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.write_bytes","name":"loop2","time":1612282330}{"_value":114060,"metric_name":"diskio.read_time","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.write_time","name":"loop2","time":1612282330}{"_value":3872,"metric_name":"diskio.io_time","name":"loop2","time":1612282330}{"_value":39751,"metric_name":"diskio.reads","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.merged_reads","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.merged_writes","name":"loop2","time":1612282330}{"_value":0,"metric_name":"diskio.writes","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.write_bytes","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.write_time","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.io_time","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.merged_reads","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.merged_writes","name":"loop3","time":1612282330}{"_value":20,"metric_name":"diskio.reads","name":"loop3","time":1612282330}{"_value":32768,"metric_name":"diskio.read_bytes","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.read_time","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.weighted_io_time","name":"loop3","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"loop3","time":1612282330}{"_value":13287963,"metric_name":"diskio.reads","name":"sda","time":1612282330}{"_value":26131311,"metric_name":"diskio.writes","name":"sda","time":1612282330}{"_value":315109941248,"metric_name":"diskio.read_bytes","name":"sda","time":1612282330}{"_value":636415049728,"metric_name":"diskio.write_bytes","name":"sda","time":1612282330}{"_value":53542148,"metric_name":"diskio.write_time","name":"sda","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"sda","time":1612282330}{"_value":83744736,"metric_name":"diskio.read_time","name":"sda","time":1612282330}{"_value":30181608,"metric_name":"diskio.io_time","name":"sda","time":1612282330}{"_value":137261312,"metric_name":"diskio.weighted_io_time","name":"sda","time":1612282330}{"_value":142855,"metric_name":"diskio.merged_reads","name":"sda","time":1612282330}{"_value":36168488,"metric_name":"diskio.merged_writes","name":"sda","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"sda1","time":1612282330}{"_value":0,"metric_name":"diskio.writes","name":"sda1","time":1612282330}{"_value":48879616,"metric_name":"diskio.read_bytes","name":"sda1","time":1612282330}{"_value":3652,"metric_name":"diskio.read_time","name":"sda1","time":1612282330}{"_value":0,"metric_name":"diskio.write_time","name":"sda1","time":1612282330}{"_value":3652,"metric_name":"diskio.weighted_io_time","name":"sda1","time":1612282330}{"_value":1743,"metric_name":"diskio.reads","name":"sda1","time":1612282330}{"_value":0,"metric_name":"diskio.write_bytes","name":"sda1","time":1612282330}{"_value":3652,"metric_name":"diskio.io_time","name":"sda1","time":1612282330}{"_value":0,"metric_name":"diskio.merged_reads","name":"sda1","time":1612282330}{"_value":0,"metric_name":"diskio.merged_writes","name":"sda1","time":1612282330}{"_value":636415049728,"metric_name":"diskio.write_bytes","name":"sda2","time":1612282330}{"_value":53542148,"metric_name":"diskio.write_time","name":"sda2","time":1612282330}{"_value":30176468,"metric_name":"diskio.io_time","name":"sda2","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"sda2","time":1612282330}{"_value":142855,"metric_name":"diskio.merged_reads","name":"sda2","time":1612282330}{"_value":36168488,"metric_name":"diskio.merged_writes","name":"sda2","time":1612282330}{"_value":13282111,"metric_name":"diskio.reads","name":"sda2","time":1612282330}{"_value":314988112896,"metric_name":"diskio.read_bytes","name":"sda2","time":1612282330}{"_value":83727040,"metric_name":"diskio.read_time","name":"sda2","time":1612282330}{"_value":137243956,"metric_name":"diskio.weighted_io_time","name":"sda2","time":1612282330}{"_value":26131311,"metric_name":"diskio.writes","name":"sda2","time":1612282330}{"_value":0,"metric_name":"diskio.merged_writes","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.write_bytes","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.merged_reads","name":"loop0","time":1612282330}{"_value":17583104,"metric_name":"diskio.read_bytes","name":"loop0","time":1612282330}{"_value":42544,"metric_name":"diskio.read_time","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.write_time","name":"loop0","time":1612282330}{"_value":1432,"metric_name":"diskio.io_time","name":"loop0","time":1612282330}{"_value":36456,"metric_name":"diskio.weighted_io_time","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"loop0","time":1612282330}{"_value":12320,"metric_name":"diskio.reads","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.writes","name":"loop0","time":1612282330}{"_value":0,"metric_name":"diskio.write_bytes","name":"loop1","time":1612282330}{"_value":162976,"metric_name":"diskio.read_time","name":"loop1","time":1612282330}{"_value":0,"metric_name":"diskio.iops_in_progress","name":"loop1","time":1612282330}{"_value":0,"metric_name":"diskio.merged_reads","name":"loop1","time":1612282330}{"_value":0,"metric_name":"diskio.writes","name":"loop1","time":1612282330}{"_value":36114432,"metric_name":"diskio.read_bytes","name":"loop1","time":1612282330}{"_value":5880,"metric_name":"diskio.io_time","name":"loop1","time":1612282330}{"_value":139632,"metric_name":"diskio.weighted_io_time","name":"loop1","time":1612282330}{"_value":0,"metric_name":"diskio.merged_writes","name":"loop1","time":1612282330}{"_value":26595,"metric_name":"diskio.reads","name":"loop1","time":1612282330}{"_value":0,"metric_name":"diskio.write_time","name":"loop1","time":1612282330}         What goes wrong? What is missing? Can someone help me?  Thanks  best regards Stefan     ... View more

Hello, i installed the itsi app and also java openjdk 11 on centos.  Assigned my admin user the itso_admin role and take a look inside the app.  The documentation says, i must create entities. So i go to configuration -> entitiies -> Create Entity. But i cannot find a button "Create entity".  I tried chrome, and edge as browser. Both the same. Any ideas whats missing, or going wrong ? ... View more

Hello, we are very new to Splunk. At the moment we try the palo alto app and missed some inputs on dashboards for search and filter. Whats the best way to extend this app but do it so, that after an upgrade of the app, the changes will not be lost? Is it ok to copy the view from default to local folder and do the changes ? Will it persist after an upgrade of the app? ... View more

Hello, we are trying out the Splunk App for Infrastructure. With the easy install script for windows, we get the data in. Fine. But we dont want to run the script on every universal forwarder manually. Because of this, we want to deploy the inputs.conf through our deployment server. But in every inputs.conf are an _meta option where the dimensions are defined.  Has someone a solution to deploy the configuration through deployment server and also set the dimension options right ? ... View more

Hello, i want to log my windows nps (network protection server or radius) to splunk. I found this thread. https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-parse-Radius-log-files-into-splunk-What-the-configuration/td-p/351275 But my data is not forwarded to my splunk server. I installed the universal forwarder on the radius server and deployed the default windows app. My windows eventlogs are forwarded from the radius to the splunk server. But not das Radius Log file. I created an app with inputs.conf and pros.conf like in the thread above. The inputs.conf file   [monitor://C:\Windows\System32\LogFiles] sourcetype = ias index = radius disabled = 0 whitelist=IN.*\.log alwaysOpenFile=1     How can i find out, why the data is not forwarded ? ... View more

Hello, we tried the vmware app from splunk to monitor our environment. But we think the app is not detailed enough. So for performance values we are searching for an alternative. Does someknow an alternative ? The ITSI app is very expensive, so that we wish us a cheaper solution. ... View more

Hello, I am new to Splunk and we want to monitor our VMware environment. We installed the VMware app and add-on from Splunk to get data in. This is working, but the reports and dashboards are not what we need. It's too much and we only want some simple values. I tried to build my own searches, but it's hard for me to find the data that I need. Is there any explanation for how to work with the add-on data, or is there a better/simpler way to get the data from vSphere into Splunk? To start simple, I want a search to show me the system's overall CPU consumption from all hosts in the last 4 hours. ... View more

Hello, does somebody know any ready app or something to parse dell idrac syslog messages?   ... View more