Hi @CarolinaHB , While that's true, changing the server.conf in C:\Program Files\SplunkUniversalForwarder\etc\system\local\ will give you the desired results. It's a best practice to place the server.conf file in a separate app as @jtacy said. That would be in $SPLUNK_HOME/etc/apps/myapp/local/server.conf.   Recommended read on config files: https://docs.splunk.com/Documentation/Splunk/9.1.3/Admin/Wheretofindtheconfigurationfiles HTH ... View more

I was querying the data in fast mode, and the fields did not show. FIX: Changed to verbose mode and chose list format for the display. I then discovered they were actually there the whole time. ... View more

Thank you laserval, ... View more

Thanks laserval! ... View more

Is this problem resolved? What is the fix for this? ... View more

Thanks for your help. Eventually i found the fix on the troubleshooting guide: Fix: If you suspend and restart a VM on which the Java Bridge Server is running, make sure to restart Splunk. Also, remove any stale state.xml files from $SPLUNK_HOME/var/lib/splunk/persistentstorage/dbx. Simply had to delete the state.xml file and restart ^^ ... View more

Is this when indexing data, or when searching on already indexed data? It sounds like you are having problems getting the events to break correctly. Do you want to skip parts of the log files when indexing? ... View more

OMG, it's embarrassing... Yeah, cidrmatch definitely works in this case! Thanks a lot, both laserval and stephanefotso!! ... View more

That is true, Title: your alert Title Alert Type: Scheduled Timerange: Run Every month Schedule on day: choose the day Trigger Condition: Number of Results Trigger if Number of Results is : Greater than 0 ... ... View more

Hi jackson, Thanks for the help. I have accepted the answer. I have another query of mine which has been pending from many days, could you please try to help : http://answers.splunk.com/answers/241211/why-is-my-scheduled-alert-for-my-dashboard-failing.html#comment-241437 ... View more

This might be a little bit unconventional, but if timewrap isn't an option, and if the time periods are consecutive and the searches are the same for both then you could do one search like so. (assuming search-terms are your base search terms and analysis is analysis you do with other functions once you have the results...: search-terms [noop | stats count | addinfo | eval userearliest=if(info_min_time==0,relative_time(now(),"-30d@d"),info_min_time) | eval latest=if(info_max_time="+Infinity",info_search_time,info_max_time) | eval earliest=userearliest-(latest-userearliest) | fields earliest latest | format "" "" "" "" "" ""] | addinfo | eval side=if(_time<info_max_time-(info_max_time-info_min_time)/2,"earlier","later") | analysis Now this will break if the user selects too large of a time range, and might break on some other edge cases, but what's happening is we have a dummy subsearch to capture the selected timeframe for the overall search using addinfo and with some evals calculate earliest and latest for a search window that's 2x longer (and assuming they "selected" -30d@d to now if they entered all time). Using format, we insert the earliest and latest terms into our main search, where we again use addinfo and an eval to determine if we're on the later selected side or the earlier calculated side. Now if timeranges aren't consecutive, or searches are different, then it might look something like this (I didn't run this one through a splunk instance... might be a bit more off than above): search-terms | eval side="later" | append [search search-terms [noop | stats count | addinfo | calculate-earliest-and-latest | fields earliest latest | format "" "" "" "" "" ""] | eval side="earlier"] | possibly-sort-then-analysis ... View more

Hi Iaserval, I need from both, DB and CSV file. for CSV, search string I have used is : sourcetype="Churn Data_CSV" Churn="*" | stats count(Churn) by state I have added drop down. Can you say me the procedure for " As per the selection of Churn , the below chart should change. Churn contains TRUE and FALSE as its values. In the chart there is count for Churn based on each state. Regards, Santhosh. ... View more

just converted it, marked as answered, and upvoted 🙂 cheers! Patrick ... View more

One of my colleagues worked it out. Here are my notes: • In setting for the app (DB Connect v2), use the Java8 JDK not JRE. • Make sure ‘jtds-1.3.1.jar’ is in \bin\lib directory. • The following stanza should reside in \local\db_connection_types only once: [mssql] displayName = MS-SQL Server Using jTDS Driver serviceClass = com.splunk.dbx2.MSSQLJtdsJDBC jdbcDriverClass = net.sourceforge.jtds.jdbc.Driver jdbcUrlFormat = jdbc:jtds:sqlserver://:/;useCursors=true #jdbcUrlFormat = jdbc:sqlserver://:;databaseName=;selectMethod=cursor;integratedSecurity=true #jdbcUrlFormat = jdbc:jtds:sqlserver://:/;useCursors=true;domain=;useNTLMv2=true #jdbcUrlFormat = jdbc:jtds:sqlserver://:/;useCursors=true;useNTLMv2=true # seems this driver cannot use pooled datasource. useConnectionPool = false testQuery = SELECT 1 [generic_mssql] useConnectionPool = false displayName = MS-SQL Server Using MS Generic Driver serviceClass = com.splunk.dbx2.MSSQLJDBC jdbcDriverClass = com.microsoft.sqlserver.jdbc.SQLServerDriver #jdbcUrlSSLFormat = jdbc:sqlserver://:;databaseName=;selectMethod=cursor;encrypt=true;trustServerCertificate=true #jdbcUrlFormat = jdbc:sqlserver://:;databaseName=;selectMethod=cursor #jdbcUrlFormat = jdbc:sqlserver://:;databaseName=;selectMethod=cursor;integratedSecurity=true jdbcUrlFormat = jdbc:jtds:sqlserver://:/;useCursors=true;domain=;useNTLMv2=true port = 1433 testQuery = SELECT 1 ... View more

Thanks for the help eddit0r worked mint after I figured out that the space between: TRANSFORMS-setnullqueue = setnull1, setnull2 should not be there. Found another thread titled "Filtering Windows event logs" then changed my props and volia! v8 moment... Working now! ... View more

I downvoted this post because sadly this does not work as expected. bins=1000 means that splunk will determine some arbitrary number of bins that is less than 1000. ... View more

We tried that. Check the performance of your searches. If there's a lot of fields, it will be geometrically WORSE. At least it was in our case. ... View more

Hi Vinit It would be better if you post this as a new question, since this post is 3 years old and you might not get as much visibility on your question. Thanks ... View more

"Note that that is the start of the line, not the end of it." This clue helped me to get a solution for my problem. Thanks a lot !! ... View more

ps_sos.ps1 fetches per-process CPU usage from WMI: $pctCPU = get-wmiobject Win32_PerfFormattedData_PerfProc_Process -Filter "IDProcess = $myPID" | select -expand PercentProcessorTime I believe that this yields usage over the sample period (5s by default), which makes spikiness a lot more noticeable of course. ... View more

Great news, thanks for letting me know! I'm still waiting for an answer from support for more than a month... ... View more

This is great. Thanks for this.. although I figured that if I keep the variable name same as the name of the key, then it works straight away . Thanks again ... View more

rex "tel:001001(?<hrl_addr>\d{4,8})" will not work because the regular expression has nothing after the {4,8} - how would the regex know whether to choose 4, 5, 6, 7 or 8 digits? IF we know that the number ended with a space, we could do this rex "tel:001001(?<hrl_addr>\d+) " which says "pick off the one or more digits up to the next space" - but we don't know that. We don't know how many digits we need until we check to see if it matches in the lookup. ... View more

try sourcetype = json instead of feed ... View more

Will splunk-launch.cfg also be overwritten by an update? I suspect so. ... View more