Hi, What is the best query to map this promethues query in splunk query language? Prometheus query: 100*sum_over_time(metric_name_gauge{}[1d:1m])/1440 metric_name_gauge  possible values 0 or 1. This query adds the values of metric_name_gauge for a period if 1 day with a resolution of 1 minute and then, it divides the result by the number of minutes in a day which is 1440 minutes. --> a period to time of 1d. Any idea How to implement this query using Splunk Query Language... Thanks in advance. ... View more

Issue: Source log events not forwarded after log rotation. Splunk UF version: /opt/splunk# /opt/splunk/bin/splunk version Splunk Universal Forwarder 7.0.0 (build c8a78efdd40f)   Inputs.conf: [monitor:///var/lib/origin/openshift.local.volumes/pods/*/volumes/kubernetes.io~empty-dir/applog/pipe-co.log] sourcetype = pipe-co ignoreOlderThan = 12h crcSalt = <SOURCE> index = pipe disabled = false Trie Splunk UF PID: ps -ef | grep -i splunk | grep -v grep root 75265 75137 1 19:19 ? 00:00:56 splunkd -p 8089 start ls -al /var/lib/origin/openshift.local.volumes/pods/e43d5812-ebe7-11eb-bf87-48df374d0d30/volumes/kubernetes.io~empty-dir/applog/ total 4876 drwxrwsrwx. 2 root 1000100000 187 Jul 23 20:13 . drwxr-xr-x. 3 root root 20 Jul 23 18:57 .. -rw-r--r--. 1 1000100000 1000100000 960597 Jul 23 20:06 pipe-co-2021-07-23T20-06-16.710.log.gz -rw-r--r--. 1 1000100000 1000100000 964929 Jul 23 20:09 pipe-co-2021-07-23T20-09-57.963.log.gz -rw-r--r--. 1 1000100000 1000100000 963195 Jul 23 20:13 pipe-co-2021-07-23T20-13-26.509.log.gz -rw-r--r--. 1 1000100000 1000100000 2021943 Jul 23 20:14 pipe-co.log Any idea? Thanks ... View more

Hi, From a set of log events I need to get the daily Top 1000 calls by each appId and clientId. How can I do this in a single query without using the append command? log events: timestamp call=123 client=a appId=1 timestamp call=123 client=a appId=1 timestamp call=123  client=a appId=1 timestamp call=12 client=a appId=1 timestamp call=123 client=b appId=1 timestamp call=123 client=b appId=2 .... Nth event So the result set based on these logs is : day | call | client | appId | count 07/14/2020 | 123 | a | 1 | 3 07/14/2020 | 12 | a | 1 | 2 07/14/2020 | 123 | b | 1 | 1 07/14/2020 | 123 | b | 2 | 1  The idea is to get the Top 1000 calls by each tuple of client : appId. Thanks for your help. ... View more

I am wondering why from some set of _raw indexes I do not see _indextime. I should see it. Any idea? Thanks, Lp ... View more

Is there a way to include more than one indexer for scheduled searches that write to a summary index? The scheduled search UI does not have it. I am not sure if this can be done via Splunk config stanza.... Thanks, Lp ... View more

Symptom of the problem: When configuring a http_collector input with an outputs.conf group in an active splunk indexer, It looks like, the indexer in question forwards the events received from other sources to the indexers found in the /opt/splunk/etc/apps/splunk_httpinput/outputs.conf. This is not the expected behaviour. Events from the http collector end point should be the only ones forwarded to the indexers found in the outputs.conf. None of the events hitting "receiving port 9997" should be forwarded. Splunk Version: 6.4.1 Splunk Build: debde650d26e Configs: **/opt/splunk/etc/apps/splunk_httpinput/local** **/opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf** [http://Token for DMD Team] disabled = 0 index = dmd indexes = dmd token = 1ZZWWA62-AGFA-43BF-9B29-41S0E39335GF useACK = 0 [http] disabled = 0 outputGroup = httpC **/opt/splunk/etc/apps/splunk_httpinput/local/outputs.conf** [tcpout:httpC] server = server1:9997,serverm:9997 autoLB = true autoLBFrequency = 30 **/opt/splunk/etc/apps/search/local/inputs.conf:** [splunktcp://9997] connection_host = ip disabled = 0 Does anyone have experience this issue? Or is there something wrong with the configs? Thanks, Lp ... View more

I have a TCP:514 input working without any problem but indexing in a single index. I have not found a way to index events as follow: Event A should be indexed in index=A _time host="a.com" Type="A" ....... Any Key Value Pair Event B should be indexed in index=B _time host="a.com" Type="B" ....... Any Key Value Pair How can I do that? Thanks, Lp ... View more