Hi team, I have security events and process events get indexed to SPLUNK instance from windows... How to get to know under which process which user is running.... That is how to integrate security events and process events and get statistics for the user who logged in to the server... ... View more

Hi team, I have a process that get indexes daily for a certain duration. 1) i want to get the duration it gets indexed 2) I want to create a alert where daily duration should not be less than avg duration for a month ... View more

how to use the liscense key for the snmp modular input , it is giving me an error other options to send snmp events and receive at splunk instance ... View more

Hi team, I am receiving multiple events from different servers to dynatrace. so how can I forward all those events from dynatrace to splunk?? ... View more

Hi team, I need to create a alert, where if my daily count is less than 30 % of monthly count average... of a particular field how is this.. ... View more

Hi team, ##### Monitor inputs # ERROR Log for SQL Server [monitor://C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Log\ERRORLOG*] sourcetype = mssql:errorlog disabled = 0 index=sqlserver # Default SQL Server Agent Log for the SQL Server Agent Service of SQL Server [monitor://C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Log\SQLAGENT.OUT] sourcetype = mssql:agentlog disabled = 0 index=sqlserver ##### Windows performance monitoring inputs ### Performance Monitoring for System [perfmon://sqlserverhost:processor] object = Processor counters = % Processor Time instances = _Total interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:logicaldisk] object = LogicalDisk counters = Avg. Disk sec/Read; Avg. Disk sec/Write instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:physicaldisk] object = PhysicalDisk counters = Disk Reads/sec; Disk Writes/sec; Avg. Disk sec/Read; Avg. Disk sec/Write; Avg. Disk sec/Transfer; Disk Read Bytes/sec; Disk Write Bytes/sec;Avg. Disk Queue Length instances = * interval = 60 showZeroValue = 1 disabled = 1 index=sqlserver [perfmon://sqlserverhost:network] object = Network Interface counters = Current Bandwidth; Bytes Total/sec instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:memory] object = Memory counters = % Committed Bytes In Use;Pages/sec;Available Mbytes;Pages Input/sec;Free System Page Table Entries interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:paging_file] object = Paging File counters = % Usage;% Usage Peak instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:process] object = Process counters = Private Bytes;% Processor Time instances = sqlservr interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserverhost:system] object = System counters = Processor Queue Length;Context Switches/sec instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver ### Performance Monitoring for SQL Server [perfmon://sqlserver:buffer_manager] object = (SQLServer|MSSQL[^:]*):Buffer Manager counters = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:memory_manager] object = (SQLServer|MSSQL[^:]*):Memory Manager counters = Total Server Memory(KB);Target Server Memory(KB);Granted Workspace Memory (KB);Maximum Workspace Memory (KB);Memory Grants Outstanding;Memory Grants Pending;Target Server Memory (KB) interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:databases] object = (SQLServer|MSSQL[^:]*):Databases counters = Active Transactions;Data File(s) Size (KB);Log File(s) Size (KB);Log File(s) Used Size (KB);Transactions/sec instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:general_statistics] object = (SQLServer|MSSQL[^:]*):General Statistics counters = User Connections;Processes blocked;Logins/sec;Logout/sec interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:sql_statistics] object = (SQLServer|MSSQL[^:]*):SQL Statistics counters = Batch Requests/sec;SQL Compilations/sec;SQL re-Compilations/sec;SQL Attention Rate/sec;Auto-Param Attempts/sec;Failed Auto-Params/sec;Safe Auto-Params/sec;Unsafe Auto-Params/sec interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:access_methods] object = (SQLServer|MSSQL[^:]*):Access Methods counters = Forwarded Records/sec;Full Scans/sec;Index Searches/sec;Page Splits/sec;Workfiles Created/sec;Worktables Created/sec;Worktables From Cache Ratio;Table Lock Escalations/sec instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:latches] object = (SQLServer|MSSQL[^:]*):Latches counters = Latch Waits/sec;Avg Latch Wait Time (ms);Total Latch Wait Time (ms) interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:sql_errors] object = (SQLServer|MSSQL[^:]*):SQL Errors counters = Errors/sec instances = DB Offline Errors;Info Errors;Kill Connection Errors;User Errors;_Total interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:locks] object = (SQLServer|MSSQL[^:]*):Locks counters = Number of Deadlocks/sec;Average Wait Time (ms) instances = * interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver [perfmon://sqlserver:transactions] object = (SQLServer|MSSQL[^:]*):Transactions counters = Transactions; Longest Transaction Running Time interval = 60 showZeroValue = 1 disabled = 0 index=sqlserver this is my inputs.conf of mssql add on, I am not getting performence events such as locks, latches, transactions any help regarding this I am using universal forwarder.... ... View more

which events need to be indexed by microsoft sql add on to monitor dead lock in splunk and how?? ... View more

Hi Team, I have javascript source code from github (https://github.com/bramp/js-sequence-diagrams) How to use this in my dashboard to render the output... what changes need to be made?? ... View more

in a line chart after reaching a threshold it needs to show in different color how is it ?? ... View more

Hi team, I have used windows add on to get events from server to my splunk instance using universal fowarder. I want some of the monitoring examples that has bean already implemented so that I will go through that, get to practice and apply... please share some of the example links... ... View more

Hi team, what is the difference between perform data and the data provided by the windows add on??? ... View more

Hi team, I have installed UF and add on for windows and getting server data to my splunk instance..... are there any use cases on monitoring and forecast predicting using MLTK for this data...?? this is the server data..... and the data is generated by add on windows.... ... View more

Hi Team, I need a visualization similar to this diagram https://www.websequencediagrams.com/ to show the interaction between multiple components.... I am not finding any apps in splunk base, any help related to this... ... View more

Unable to initialize modular input "snmp" defined in the app "snmp_ta": Introspecting scheme=snmp: script running failed (exited with code 1).. I am getting this error?? how to solve this... ... View more

what is the use of snmp master agent? how to configure it to forward to the splunk instance from remote server? is UF necessary... ... View more

I am not finding universal fowarder that supports windows 2012 , NT 6.2 version ?? ... View more

How to configure Univesal fowarder to send snmp traps in unix server and how to collect? whats the use of snmp modular input and where to install it? on the fowarder side or splunk instance? can we use syslog for snmp traps?? ... View more