Any update? Thanks, Sahil ... View more

Hello, We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down. Thanks, Sahil ... View more

Thanks Andrey We are checking status in Deployment Server But If agent goes down We are not aware in which server or which application is impacted Is there any script , query or How we notify automatically tell us in Which server agent is down. Regards, Sahil ... View more

Hello, This happened 3 days back, We didn't change anything, We have 3 forwarders sending data. Thanks, Sahil ... View more

Hello, It is for all Search query and source type , Please let me know How I can removed regex exp for all fields. Thanks, Sahil ... View more

I takes almost more than minute for search result which is more than normal search count aws:cloudtrail:log 1007 aws:cloudwatch:log 26088 aws:cloudwatchlogs:log 79024 aws:config:log 734 aws:description:log 1955 aws:s3:log 6124 mongod 129 nfs0000000009669cb 162 scheduler 174 splunk-powershell.ps-2 1932 splunk-powershell.ps-too_small 722 splunk_ta_aws_proxy_conf-2 182 splunk_user_realnames 86 splunkd 6838386 splunkd_access 124312 splunkd_conf 2 splunkd_remote_searches 424 splunkd_stderr 5 ta_box-3 1 ta_box-4 490 ta_frmk-5 288 Thanks, Sahil ... View more

I have SPlunk on SPlunk app which i am checking CPU usage and disk space is fine MemTotal: 32871212 kB MemFree: 9258220 kB Buffers: 1049452 kB Cached: 13493864 kB ... View more

It is Linux Servers. ... View more

Hello, It is for all searches and data is in MB's, I change the time period also But it is very slow. Can you please suggest Thanks, Sahil ... View more

Hello, We need to monitor the back up files or failed backup. Thanks, Sahil ... View more

Please help us for the same. Thanks, Sahil ... View more

Please update and help for the same . Thanks, Sahil ... View more

We run Query and add 3 lines also add number 7 IP address in fields but not geeting IP data index=perfmon sourcetype="Perfmon:LogicalDisk" source="Perfmon:LogicalDisk" counter="% Free Space" |dedup host |eval unique_id=md5(_raw) |search [inputlookup win_disk.csv|fields host] |eventstats avg(Value) as disk_free_space by host |eval used_percent= (100-disk_free_space) |append [inputlookup win_disk.csv] |eval threshold=case(used_percent<95, "Stable", used_percent>=95 AND used_percent<98,"Warning", used_percent>=98, "Critical") |stats first(used_percent) as used_percent, last(used_percent) as last_used_percent, first(threshold) as threshold, last(threshold) as last_threshold, last(unique_id) as unique_id, first(_time) as _time by host |eval state=case(used_percent<95, "stable", used_percent<95 AND threshold=last_threshold, "still_stable" , used_percent>=95 AND used_percent<98 AND threshold=last_threshold, "existing", used_percent>=98 AND threshold=last_threshold, "existing", used_percent>=98 AND threshold!=last_threshold, "shift_critical", used_percent<98 AND used_percent>=95 AND threshold!=last_threshold, "shift_warning") |search state!="still_stable" |eval action=case(state="new", "post", state="existing", "nothing", state="stable", "clear", state="shift_warning", "recede", state="shift_critical", "escalate") |table host, used_percent, last_used_percent, threshold, last_threshold, unique_id, _time, state, action | append [search index=perfmon sourcetype="Perfmon:LogicalDisk" source="Perfmon:LogicalDisk" counter="% Free Space" |dedup host | search NOT [ |inputlookup win_disk.csv|fields host ] |eval unique_id=md5(_raw) |eventstats avg(Value) as disk_free_space by host |eval used_percent= (100-disk_free_space) | where used_percent>=95 | eval threshold=case(used_percent<95,"Stable",used_percent>=95 AND used_percent<98,"Warning", used_percent>=98,"Critical") |fillnull state value="new"|eval action=case(state="new", "post") | eval title="win_disk_Used_Exceeds_Perc_by_Host" |table host, used_percent, last_used_percent, threshold, last_threshold, unique_id, _time, state, action] |outputlookup win_disk.csv |eval alert_type="Windows Disk Alert" | eval 1=alert_type, 2=host, 3=used_percent, 4=threshold, 5=action, 6=unique_id, 7=ip |fields 1 2 3 4 5 6 7 |createsnmptrap 100 Per Page Format Preview 1 2 3 4 5 6 7 _time Windows Disk Alert uslv-dapp-bsm02 95.705941 Warning nothing 832eb3f3cfdeec78fcd72e0131e740fb 2017-04-04 04:01:20 Please suggest Thanks, Sahil ... View more

Hello, Below are the query and if we add dns its not working index=perfmon sourcetype="Perfmon:Memory" source="Perfmon:Memory" counter="% Committed Bytes In Use" |dedup host|eval unique_id=md5(_raw) |search [inputlookup win_memalert.csv|fields host] |eventstats avg(Value) as used_percent by host |append [inputlookup win_memalert.csv] |eval threshold=case(used_percent<70, "Stable", used_percent>=70 AND used_percent<85,"Warning", used_percent>=85, "Critical") |stats first(used_percent) as used_percent, last(used_percent) as last_used_percent, first(threshold) as threshold, last(threshold) as last_threshold, last(unique_id) as unique_id, first(_time) as _time by host |eval state=case(used_percent<70 AND threshold=last_threshold, "still_stable", used_percent<70, "stable", used_percent>=70 AND used_percent<85 AND threshold=last_threshold, "existing", used_percent >= 85 AND threshold=last_threshold, "existing", used_percent>=85 AND threshold!=last_threshold, "shift_critical", used_percent<85 AND used_percent>=70 AND threshold!=last_threshold, "shift_warning") |search state!="still_stable" |eval action=case(state="new", "post", state="existing", "nothing", state="stable", "clear", state="shift_warning", "recede", state="shift_critical", "escalate") |table _time, host, used_percent, last_used_percent, threshold, last_threshold, unique_id, state, action |append [search index=perfmon sourcetype="Perfmon:Memory" source="Perfmon:Memory" counter="% Committed Bytes In Use" | dedup host |search NOT [ |inputlookup win_memalert.csv|fields host ] |eval unique_id=md5(_raw) |eventstats avg(Value) as used_percent by host |where used_percent>70 |eval threshold=case(used_percent<70, "Stable", used_percent>=70 AND used_percent<85,"Warning", used_percent>=85, "Critical") |fillnull state value="new"|eval action=case(state="new", "post") |eval title="win_Memory_Exceeds_Percent_by_Host" |table _time, host, used_percent, last_used_percent, threshold, last_threshold, unique_id, state, action] |outputlookup win_memalert.csv | search action!="nothing" |eval alert_type="Windows Memory Alert" | eval 1=alert_type, 2=host, 3=used_percent, 4=threshold, 5=action, 6=unique_id |fields 1 2 3 4 5 6 |createsnmptrap | Thanks, Sahil ... View more

It shows below error OpenSSL: error :14077410:SSL routines:SSL23_GET_SERVER_Hello:sslv3:alert handshake failure ... View more

We are using DB 2 connect 2.1.3 version and MySQL database we are trying to connect. ... View more