index = _internal component=Shutdown | stats earliest(_time) as etime latest(_time) as ltime by host | convert timeformat="%Y/%m/%d %T" ctime(etime) ctime(ltime) The SPL above work on version 9.x ... View more

oops, see edit above. /k ... View more

I did that.I'm able to view only certain words appearing now but part of the events are still distorted and the same error message. ... View more

I was able to get these to display in the PDF Report by NOT scheduling them which makes no sense. ... View more

Adding the index=Indexname statement fixed my issue. Thanks! ... View more

any status? ... View more

I've had this problem a number of times under Splunk 4.2, but two things have largely solved it -- one clue in my case was that restarting Splunk would typically get the file to be read again -- that's not optimal for a production environment, so, two changes I made helped considerably: 1) ignoreOlderThan = 7d I put this in stanzas for inputs.conf where I have a lot of files that are archived - Sometimes on restart Splunk would spend hours or days trying to go through them all and consider re-indexing. By including this directive in file/directory monitoring stanzas it would allow Splunk to more speedily get to the files that were (from my point of view) being ignored) 2) crcSalt = <SOURCE> I add this to most stanzas in inputs.conf where I'm continuously monitoring a single file - see the documentation for the various options here, but, adding this has helped me considerably in the situations you describe. ... View more

good to know on my behalf ... View more

no prob 🙂 ... View more

You can find it here :- /opt/splunk/etc/system/local/outputs.conf ... View more

the file that i'm monitoring is still being updated with events however splunk is not able to index the new events. ... View more

The file command was deprecated as of 4.1.x, and finally removed in 4.2. You can use inputcsv or inputlookups to replace it in many cases. ... View more

If you haven't used the Deployment Monitor app yet, you should take a look. It can tell you when you're receiving less data than expected, and you can configure alerting. You could do this as a very broad, slow, naive search: * | stats last(_time) as _time by host, source | sort _time, host, source But, looking at the _internal index for metrics would probably be best, which is what the Deployment Monitor does. ... View more

Got it. Data will be dropped silently for servers w/o Splunk forwarder sending udp syslog directly to an indexer collecting with "udp://" stanza. Consider collecting w/ syslogd on the indexer and then indexing via "monitor://". ... View more

Hi,I've tried your suggestion and have started receiving events already.Although in splunkweb the 3 channels doesn't show,I guess it doesn't matter.Thanks. ... View more

If you migrate from a heavy forwarder to a universal or light forwarder, you will have to move some configurations. See http://www.splunk.com/wiki/Where_do_I_configure_my_Splunk_settings%3F ... View more

The way I suggested above is to group at search time. Splunk has a nice document which details how to extract fields here - http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample ... View more

I like to display in descending so that the last event is shown first on the results table in splunk.When I use the "table" command in place of stats everything is nicely shown,but doesn't allow us to drill down by clicking on the event,thats why am considering to use stats.. ... View more

I took a look at the Splunk_TA_nix 5.1.2 script rlog.sh and made a change to it: I got rid of the grep -v part so the line that reads: awk -v START=$SEEK -v OUTPUT=$SEEK_FILE 'NR>START { print } END { print NR > OUTPUT }' $AUDIT_FILE | tee $TEE_DEST | /sbin/ausearch -i 2>/dev/null | grep -v "^----" no reads awk -v START=$SEEK -v OUTPUT=$SEEK_FILE 'NR>START { print } END { print NR > OUTPUT }' $AUDIT_FILE | tee $TEE_DEST | /sbin/ausearch -i 2>/dev/null This will give you a delimiter for the events which is the "----" Then I made my own sourcetype for this: [linux:audit] BREAK_ONLY_BEFORE = ---- DATETIME_CONFIG = MAX_TIMESTAMP_LOOKAHEAD = 23 NO_BINARY_CHECK = true TIME_FORMAT = %m/%d/%Y %T.%3 TIME_PREFIX = msg=audit\( category = Operating System description = Auditd Events disabled = false pulldown_type = true Seems to be working in my lab for now. Thanks @foxyfred for the idea. ... View more

If the instance monitoring the log is not a light-weight forwarder, then all transforms should be done there. In such a case your config will have no effect on the indexer. ... View more

Any more details on this? I tried the following which did not work: cd $SPLUNK_HOME/var/lib/splunk/ tar -zcvf mydatabase.tgz mydatabase I then copied the .tgz to another splunk instance and untar'd it in the same location. Restarted Splunk and Splunk restarts with the Index disabled. Any ideas? ... View more