This could be also solution for you. index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb*1024)) AS bytes by series ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",printf("%.2f",round(bytes/pow(1024,if(bytes=0,0,floor(min(log(bytes,1024),10)))),2)).case(bytes=0 OR log(bytes,1024)<1,"B ", log(bytes,1024)<2,"KiB", log(bytes,1024)<3,"MiB", log(bytes,1024)<4,"GiB", log(bytes,1024)<5,"TiB", log(bytes,1024)<6,"PiB", log(bytes,1024)<7,"EiB", log(bytes,1024)<8,"ZiB", log(bytes,1024)<9,"YiB", log(bytes,1024)<10,"RiB", log(bytes,1024)<11,"QiB", 1=1, "QiB"))   Another option is installing add-on Numeral system macros for Splunk enables you to use macros numeral_binary_symbol(1) or numeral_binary_symbol(2). Example index="_internal" source="*metrics.log" per_sourcetype_thruput | chart sum(eval(kb*1024)) AS bytes by series ```THE FOLLOWING LINES MAY BE WHAT ACHIEVES THE FORMAT YOU ARE LOOKING FOR.``` | fieldformat bytes=printf("% 10s",`numeral_binary_symbol(bytes,2)`)   Numeral system macros for Splunk https://splunkbase.splunk.com/app/6595 Usage: How to convert a large number to string with expressions of long and short scales, or neither. https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-large-number-to-string-with-expressions-of-long/m-p/629383... ... View more

It is very unlikely these are related. Yo dawg, I heard you like to index things. So I Spotlight-indexed your Splunk buckets so you can have things indexed while you have things indexed. According to this -- https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man2/getattrlist.2.html -- the OS X getattrlist system call can return an ENOENT which (best I can tell) is errno=2 on OS X. Splunk is probably deleting or renaming these hot bucket files before spotlight can fully process them. Letting Spotlight attempt to index Splunk's bucket files should not cause any specific problems other than these errors - but it will cause a lot of needless I/O. It may make things more palatable system-resource-wise to disable Spotlight indexing of $SPLUNK_HOME/var/lib/splunk . More info at http://osxdaily.com/2011/12/30/exclude-drives-or-folders-from-spotlight-index-mac-os-x/ The startup error is not related to the above at all. It almost reads like the sentiment app may have Splunk 6.0 compatibility problems? If you uninstall the sentiment app do these errors go away? ... View more

I am seeing the same behaviour here on Windows 2012R2. I 'had' been using DBConnect without issue on another server running Windows 2008R2. Trolling for an answer. ... View more

Great idea. As it turns out, it doesn't matter much. ... View more

Thank you, I used this to troubleshoot a user that said he couldn't login ... View more

I believe you can update the existing GeoLiteCity.dat with the files available from maxmind http://www.maxmind.com/en/geolite unzip the latest binary in the directory with the existing .dat file. I am using the GeoASN app and the files reside in a different location. > [root@splunksearch1-d1-inf apps]# ls > -l /app/splunk/etc/apps/GeoASN/lookups/ > total 84460 > -rw-rw-r-- 1 root root 3872281 Apr 2 2011 GeoIPASNum.dat > -rw-r--r-- 1 splunk splunk 54878292 Jun 15 2012 GeoLiteCity.dat > -rw-rw-r-- 1 root root 27629545 Apr 4 2011 GeoLiteCity.old ... View more

We only ask for regex as from experience, a lot of people in the past say they have correct regex and then the fault ends up being with the said regex. Anyway, the behaviour still doesn't sound quite correct. You may be experiencing an issue where Splunk is only extracting them as needed, this can cause fields to show with no results if it hasn't extracted them at search time. Have a look at fields.conf as you can define fields as not being index-time extractions which will force Splunk to extract them before using search terms. Glad you've got it working! ... View more

Hi, The events are part of windows server roles where there is not path showing up for evtx. I would like to know how did you integrate those events to Splunk. ... View more