The "Edit Summary Indexing" Option appears to be missing in 7.24 as well... ... View more

Avaya devices support syslog . I was able to forward logs from Avaya to Splunk using Avaya's default UDP port of 514. In the Avaya configuration, enter the IP address of the Splunk Syslog server with no port info and Avaya will send the data via UDP 514 by default. Hope this helps! ... View more

I'm looking to collect logs from HP Performance Center as well....According to our HP Performance Center analysts, it appears the analysis summaries are posted to HTML pages. Is REST the best option? ... View more

It worked! Not sure why I cant send the alert logs to a specified index other than the main index, however this will work for my application. Thanks! ... View more

That's the original issue - I created a specific index for Splunk to send the alert machine logs to and it didn't work...Just waiting for an alert to fire to validate the change to the default index worked... ... View more

Thanks for checking - I left the field blank.. Seems like a bug to me if the field allows you to point the alerts to alternate indexes (which the option does not appear to work)... ... View more

I just set the index pointer to the default main index ...Awaiting the next alert to fire to see if it works. Is this a know bug where the index can't be set to anything but main? ... View more

Ok - Thanks . I will download the Splunk app to our Dev server and see if it will work for us. Thanks again. ... View more

Lets see.... The update produces these results : Avg_Response_Time= 00:00:11.744500 Max_Response_Time= 00:00:16.711000 The service field contains no results, even after modifying to include service in the table | service, Avg_response_Time, Max_Response_Time. Removing the last | "each * [eval <>=tostring('<>',"duration")]" ( Not sure what this part of the query does - can you explain?) produces these results and shows data for the service field: service =quote/save Average_Response_Time = 11.744500 Max_Response_Time =16.711000 I think we are very close! For the formatting, I'm wondering if we can filter to show two places after the decimal and up to 4 place markers before : 00:00.00 ? Thanks! ... View more

After updating the query and removing the last pipe, I do see the Service field, however the results format seems to be off..Results are returned in this format: 28.611000 . Raw data looks like this: 0:00:28.611. Adding the pipe back in (foreach * [eval <>=strftime('<>',"%H:%M:%S.%3N")]) appends every returned avg and max value with 19 hours, however the format looks better .... 19:00:06.698 .... ... View more

This appears to be working with the exception of showing the service field( column contains no data!). I truncated the Time to show HMS (for some reasone I couldn't get .%N" to run without errors), removed the ,, after the <>' tag, to get the query working... | eval Response_Time=strptime(Response_Time,"%H:%M:%S") | stats avg(Response_Time) as Avg_Response_Time , max(Response_Time) as Max_Response_Time by service | sort -num(Max_Response_Time) | foreach * [eval <>=strftime('<>',"%H:%M:%S")] | Table service, Avg_Response_Time, Max_Response Any Suggestions? Thanks again for your help! ... View more

I just reached out to the team who generates the logs to see if they can remove the very first "HOST INFORMATION" line. Thanks! ... View more

Will the change to the props.conf line break the pre-existing log files within the index, or just the new logs that are being ingested after the change? ... View more

Yes the source file is a .csv - I just added the csv reference to the stanza - hopefully this will work! Thanks for the tip!! [software_summary] INDEXED_EXTRACTIONS = CSV LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false ... View more

According to the documentation, the stanza I added to the props.conf which includes (([\r\n]+), ) should break out each line into an event...Not sure why this is not working? Defaults to ([\r\n]+), meaning data is broken into an event for each line, delimited by any number of carriage return or newline characters. ... View more

I was hoping to just line break the file in the props.conf and then build the field extractions using the UI - Thanks ... View more

Yes -"count" is an existing field . This worked - Thanks for the answer! ... View more

Should this option be added to the props.conf located here: /opt/splunk/etc/deployment-apps/app_common/local ? ... View more

Yes, This is how I would like to see the log file break.... ... View more