Hello I need some help with the following scenario: I am collecting two perf counters, CounterA and CounterB, from multiple hosts. I want to be able to timechart the following: Ratio = CounterA / CounterB * 100 per host. I tried this: index=perfmon object="Core DataAccess" instance="_total" counter="Query Failures - Timeout" | eval QueryFailureTimeout=Value | appendpipe [search index=perfmon object="Core DataAccess" counter="Queries" | eval QueriesTotal=Value] | eval FailureRatio=(QueryFailureTimeout/QueriesTotal*100) | fields _time, host, FailureRatio | timechart max(FailureRatio) by host but it does not seem to work - it looks like the FalureRatio is not getting calculated... Thank you in advance! ... View more

Hello I am trying to extract some digits from a string and I can't seem to get the regex to work. Here is an example of my strings: ABC-F1KLMNOP7 ABC-F12KLMNOP8 ABC-F2KLMNOP55 ABC-F14KLMNOP66 I want to be able to extract the 1 or 2 digits, depending on whether there is a single digit or 2, starting at the 6th character (in effect pulling just the 6th, or 6th and 7th). In the strings above, I would expect my rex to match 1, 12, 2 and 14. What I tried is this: rex field=host .(?<Farm>(\d{1})) rex field=host .(?<Farm>(\d{2})) rex field=host .(?<Farm>(\d{1,2})) The first one works, but returns only the first character (resulting in 1,1,2,1, in the above example) - this is expected. The second works, but returns a value consisting of 2 digits, missing the ones that have a single digit (resulting in 12, 14 in the above example) - this is also expected. The last rex does not work at all - this is not expected. If I understand correctly, {1,2} means the \d should be matched one or two times. Apparently I am wrong... I suppose I could also do it with a regex matching the 6th and/or 7th character, but that seems like it would be more complex, and not exactly 'ideal'. ... View more

Hello I am having a difficult time getting Splunk to recognize fields from my IIS 7.5 logs. I know that there are many, many posts in splunk-base regarding this - I have looked through many of them and tried the suggested answers in at least 8-10 different posts. None of them have worked for me, eventhough I don't have a custom config - just a standard IIS server with logging enabled and default fields selected. The files get indexed, but the fields are not recognized (i.e. I cannot simply search for "time-taken > 50" within the data indexed from these logs) Here is my full config: Splunk versions: Client UF: 4.3.3 Intermediary UF: 4.3.3 Indexer: 4.3.4 Client UF sends data to intermediary UF, which sends it to the indexer. My config current config (and last attempt to make this work) on the Client UF is: C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\inputs.conf [monitor://C:\inetpub\logs] disabled = false followTail = 0 sourcetype = iisw3c index = testindex C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\props.conf [iisw3c] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False CHECK_FOR_HEADER = true TZ = GMT REPORT-iisw3cfields = iisw3cfields TRANSFORMS-removecomments = removecomments C:\Program Files\SplunkUniversalForwarder\etc\apps\app_A\default\transforms.conf [removecomments] REGEX = ^\#.* DEST_KEY = queue FORMAT = nullQueue [iisw3cfields] DELIMS = " " FIELDS = date, time, s-sitename, s-computername, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs-version, cs(User-Agent), cs(Cookie), cs(Referer), cs-host, sc-status, sc-substatus, sc-win32-status, sc-bytes, cs-bytes, time-taken What I am doing wrong? Thanks in advance! ... View more

Hello I have a Universal Forwarder that acts as an intermediary forwarder between about 200 other UFs and the Indexer. Data from the client UFs gets delayed or not sent at all and digging through the logs, I noticed this: On the client UF: 09-29-2012 05:42:07.620 -0400 WARN TcpOutputFd - Connect to 10.xx.xx.60:9997 failed. No connection could be made because the target machine actively refused it. 09-29-2012 05:42:07.620 -0400 ERROR TcpOutputFd - Connection to host=10.xx.xx.60:9997 failed 09-29-2012 05:42:07.620 -0400 WARN TcpOutputProc - Applying quarantine to idx=10.xx.xx.60:9997 numberOfFailures=52 On the intermediary UF: splunkd.log: 09-29-2012 06:35:48.722 -0400 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying... 09-29-2012 06:35:49.504 -0400 INFO TailingProcessor - ...continuing. metrics.log: 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=fschangemanager_queue, max_size_kb=5120, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=indexqueue, max_size_kb=10240, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=nullqueue, max_size_kb=10240, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=parsingqueue, blocked=true, max_size_kb=512, current_size_kb=511, current_size=409, largest_size=445, smallest_size=163 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=splunktcpin, max_size_kb=500, current_size_kb=423, current_size=218, largest_size=442, smallest_size=152 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=tcpin_queue, max_size_kb=10240, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0 09-29-2012 06:27:24.509 -0400 INFO Metrics - group=queue, name=winparsing, max_size_kb=10240, current_size_kb=0, current_size=0, largest_size=1, smallest_size=0 I already updated the etc\system\local\server.conf on the intermediary UF adding this: [queue] maxSize = 10MB [queue=parsingqueue] maxSize = 10MB [queue=splunktcpin] maxSize = 10MB however, as you can see from the log, those two queues are the only ones that seem to not get affected, showing max_size_kb to be 500-512 KB, instead of the 10 MB I set. Any idea why? Or am I not even on the right track? ... View more

What is the default password for delete_admin? Is it safe to reset it from the admin interface? ... View more