Thanks, I think https://docs.splunk.com/Documentation/Splunk/9.2.1/InheritedDeployment/Ports is the one included? ... View more

Can also be accomplished over time by: index=summary sourcetype=stash source IN (Summary_Error_*) | fields + * | bin _time span=1d | eval search_name=search_name+"#"+_time | stats mode(*) AS * by search_name | transpose 1000 header_field=search_name column_name=fieldName | eval type=if(match(fieldName,"(_raw|_time|date_.*|eventtype|tag.*|index|sourcetype|host|info_.*|punct|time*.?pos|search_name|search|search_now|splunk_server.*|linecount)"),"internal","custom") | stats count(*) AS * BY type | transpose 1000 column_name=search_name header_field=type | rename "row 1" AS fieldCount | search search_name!=fieldName | rex field=search_name "(?<search_name>[^#]+)#(?<_time>.*)" | stats max(*) as * BY _time search_name ... View more

i did this and it worked on my syslog files after importing them. but it doesnt work on live data (real-time). do you have a fix for that? ... View more

2nd such post with no resolution 😞 ... View more

Hi. I got confused with the following statement to be precise - "A bucket is a directory containing a set of rawdata plus indexing data." Could you clarify what the "rawdata" and the "indexing data" is meant here? ... View more

Regardless of retention period, hot buckets will roll to warm bucket if either maxHotSpanSecs or maxDataSize is reached or Splunk was restarted. A warm bucket will stay warm (default location $SPLUNK_DB/IndexName/db) till it's number crosses maxWarmDBCount , which then will roll (the oldest bucket) to cold (default location $SPLUNK_DB/IndexName/coldb). Retention period is applied to buckets in cold stage and it'll start rolling oldest cold bucket to frozen (archived or deleted per what you've setup). If the indexer is restarted more than 300 times means it could have 300 or more warm buckets. How much data it holds depends upon it's retention period. Data in hot , warm and cold are all searchable. ... View more

Correct. Splunk has no mechanism to move files around in the filesystem. ... View more

Is this still applicable? It doesn't seem to work in my case. I appended the "-tour" suffix to the ID of the dashboard, but it doens't start when I view the dashboard. (Tried it with a test user) ... View more

If you remove code lines 3,4,5 from my answer and replace them with lines 2,& 3 from Ryan's answer, I think you'll be in a sweet spot for performance and still achieve what you want. Indexed extractions could be of concern too because it uses more disk on indexers. Kv mode JSON on the search heads causes the JSON parsing at search time though and is less performant in many cases at search time. However indexed extractions is less performant at index time... It's a trade off and most people want to guarantee indexing over search which means Ryan's answer is better for most. ... View more

What are you what to do is this? your search * | table Product, Version | join Product [ | inputlookup | eval LastVersion=Version | table Product LastVersion] than you can compare the different versions where Version!=LastVersion ... View more

Thx ssievert, you helped me out here! Works like a charm. ... View more

It does! Kudo's for you, my friend! ... View more

I agree with dgrubb and renems - to avoid bucket conflict, you should turn on indexer acknowledgment on your forwarders and queue the data there while you make the move. See Protect against loss of in-flight data in the Forwarding Data manual. When you make the move, follow the procedure in the Managing Indexers and Clusters of Indexers manual: Move the index database. ... View more

First create searches that will provide the needed information or results to be able to determine the status of the component or service. Next take a look at this App https://splunkbase.splunk.com/app/1923/#/overview and use it together with your search. Try something simple and easy to start with, like Apache status codes. If there are more than 10 x 404 error codes within one minute set the ample to yellow, else it's green. cheers, MuS ... View more

Since it looks like you're still on 6.0, the Forwarder Health app might help. Hopefully Mark will update this for 6.2. Additional views include looking at field descriptor and throughput limits being hit, duplicate GUIDs, and the version distribution and log volumes being generated by your agents. Forwarder Health App ... View more

Hi, After configure site=site0 in server.conf all the search head says error invalid site. Is needed other configuration to disable search affinity? Thanks, ... View more

I believe that a lookup would be more appropriate for this. Look at http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources ... View more

Try this index=ix_*_nix_p host=*.linux.domain.com sourcetype=df Filesystem="/dev/mapper/vg.appl-lv.was70" OR Filesystem="/dev/mapper/vg.appl-lv.was70" NOT [ search index=ix_*_nix_p host=*.linux.domain.com sourcetype=ps COMMAND=java USER=ups | dedup host | fields host ] | dedup host | table host | lookup cpu.csv host Assuming cpu.csv is set as lookup table and its scope/permissions have been setup correctly to be accessible here. ... View more

Sideview Utils 3.2.9 released today and I added this as another working example on the Multiplexer docs page. (the docs and examples are as always within the Sideview Utils app itself) ... View more