Hi You will find answers for your queries in the below URLs.. https://answers.splunk.com/answers/345286/change-tag-permission-via-rest-api-curl.html https://answers.splunk.com/answers/13189/setting-tag-values-through-rest-api.html Also, if you want to change permission of any other object, check the below URL for details & examples. http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTUM/RESTusing#Access_Control_List ... View more

In my current project, the deployment server is able to handle 5000+ clients in AWS .. But we face lot of slowness while adding new server class, clients etc. Otherwise, its fine. We are planning to deploy more deployment servers to handle 1000 clients per Deployment server. In the enterprise infra, the deployment server is able to handle ~800 clients without any issues and no slowness aswell. CPU load is always < 1 .. And the poll interval set to 300 seconds [default] phoneHomeIntervalInSecs=300 ... View more

In my current project, the deployment server is able to handle 5000+ clients in AWS .. But we face lot of slowness while adding new server class, clients etc. Otherwise, its fine. We are planning to deploy more deployment servers to handle 1000 clients per Deployment server. In the enterprise infra, the deployment server is able to handle ~800 clients without any issues and no slowness aswell. CPU load is always < 1 .. And the poll interval set to 300 seconds [default] phoneHomeIntervalInSecs=300 ... View more

You disable at App level instead of individual inputs. If we leave it disabled - next time when there is a need to set up a new input, before pushing the new input to search heads, we have to enable all previous inputs, else all the previous inputs go to disabled state on search heads. I was able to delete the inputs successfully. does any one have issues deleing an existing input created on the DB Connect 2 app from the GUI? ... View more

As long as the load/job of Deployment Server & cluster Master instance is less, its fine to have all in 3 in one. Offcourse having them in separate instances better incase if there's going to be more Forwarders or Indexers planned for near future which will increase the load on Deployment Server and Cluster Master. ... View more

Editor's note: 2014 below. 2016 version here: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf Check out this URL.. https://www.splunk.com/web_assets/pdfs/secure/Splunk_and_VMware_VMs_Tech_Brief.pdf ... View more

Thanks for the response. I agree with you for schedule search ttl. But, in my case I can see the jobs in dispatch directory which are older than 2-4 days even though those are scheduled to run for every 1 min or 2 min. Also, I see the jobs id older than 2-4 days exists in dispatch dir for the searches ran manually . I checked the splunkd.log file, there is no information about failure in deleteing these jobs. So I'm wondering whether the dispatcher is trying to delete or not. ... View more

If your requirement is to send alert if there are no event received on particular index from particular sources, then you can use the following search command | metadata type=hosts index=myindex Above command returns the list of hosts sending data to the index "myindex" and when was the last event received. If the last event received timestamp is 15 min earlier to the current time, then you can create the alert. Hope this information is useful. ... View more

Just change the regex and try [cisco_wsa_pacfile_drop] REGEX = pacfile-splunk DEST_KEY = queue FORMAT = nullQueue ... View more

Yes, you need to open the firewall ports between x & y. ... View more

@the_wolverine - tscollect information are stored in Indexers. ... View more

If namespace is provided, the tsidx files are written to a directory of that name under the main tsidxstats directory (that is, within $SPLUNK_DB/tsidxstats). These namespaces can be written to multiple times to add new data. If namespace is not provided, the files are written to a directory within the job directory of that search, and will live as long as the job does. This namespace location is also configurable in indexes.conf, with the attribute tsidxStatsHomePath. http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tscollect ... View more

I dont think you can put such condition in rex itself. But you can do with fillnull. E.g: To fill all fields those doesn't value with "nil" index=aaaa | rex *************** | fillnull value=nil To fill field1 & field2 value with "nil" when value for these fields not present index=aaaa | rex *************** | fillnull value=nil field1 field2 Hope this helps. ... View more

useother=null will not club the hosts into OTHERS Basically you need 3 values in the table, i,e _time, count, and stats for each host. So, you want all hosts name as row and not as column. Update the query in the main answer.. Regarding your original question, you can add columns using eval, eventstats, streamstats..etc ... View more

Need more clarification... your query, sample output and what you want pass would help us to provide the answer correctly. ... View more

You are using " ...| eval D1 = max(date_mday)" to calculate max value which wont work. Updated the query in the answer to calculate daily sum, avg, max, min of volume injection by each host. ... View more

Here you go.. index=_internal group="per_host_thruput" earliest=-3d@d latest=@d| streamstats max(date_mday) as D1 | eval D2 = D1-1 | eval D3 = D2-1 |stats sum(kb) by series D1 D2 D3 Output is series D1 D2 D3 sum(kb) cc-index01 28 27 26 78107.664978 cc-index02 28 27 26 78186.546889 cc-index03 28 27 26 78157.350569 cc-index04 28 27 26 78496.797853 cc-licmgr 28 27 26 52702.763749 cc-sh1a 28 27 26 45635.153433 cc-sh2a 28 27 26 44189.015641 cc-sh3a 28 27 26 44197.826188 you can use streamstats or eventstats commands to take the max value of given parameter. if you want total, avg, max & min of volume injection by each host on daily basis, then use the below query index=_internal group="per_host_thruput" | bucket _time span=1d |eval MB=kb/1024 |eventstats sum(MB) as daily_volMB by series | timechart span=1d sum(daily_volMB) as daily_volMB , max(daily_volMB) as max_daily_volMB avg(daily_volMB) as avg_daily_volMB, min(daily_volMB) as min_daily_volMB by series As you have 200 hosts and you seems to be looking for each hostname to be in row index=_internal group="per_host_thruput" | bucket _time span=1d |eval MB=kb/1024 |eventstats sum(MB) as daily_volMB by series | stats sum(daily_volMB) as daily_volMB , max(daily_volMB) as max_daily_volMB avg(daily_volMB) as avg_daily_volMB, min(daily_volMB) as min_daily_volMB by series _time series _time daily_volMB max_daily_volMB avg_daily_volMB min_daily_volMB myhost 2015-01-05 00:00:00 808.219299412 28.864974979 28.864975 28.864974979 myhost 2015-01-11 00:00:00 16712.820512841 28.864974979 28.864975 28.864974979 myhost 2015-01-29 00:00:00 1703.033523761 28.864974979 28.864975 28.864974979 ... View more

Me too facing this issue... please let us know any one is able find the fix. ... View more

I think the below configuration should work if the standard timestamp is used in the log which is automatically recognized by SPlunk. Otherwise, please give the sample log file, we shall give you the time stamp recognition configuration required in props.conf Since you want entire file content as 1 line, SHOULD_LINEMERGE=false will combines multi lines (if any) into single line and if the characters are more than 10,000, then TRUNCATE=0 will tell splunk indexer not to truncate the event at 10,000 characters. props.conf [etl_logs] SHOULD_LINEMERGE = false TRUNCATE=0 CHECK_METHOD = modtime ... View more