Need a help folks. I am trying to create a dashboard where i have 1500 values that i need to put it as a drop down. I am using dashboard studio's drop down input. But unfortunately i am not able to list more than 1000 values. Need help to either list all that 1500 values in that drop down input or a logic how can i split these as two drill downs?   Please help folks. ... View more

Hello All,   I am new to splunk and trying to create an executive level dashboard for few of our enterprise applications. All these applications produces very large data like 100GB/day and my normal indexed searches are taking for ever and sometimes timing out as well. Need some guidance on how i could achieve faster/optimised searches    I tried using tstats but i am running into problems as the data is not totally structured and i am not able to do aggregate functions on response times as that data has string "ms" at the end or doesn't have KV type .  Like below examples.   Data 1 :  2022-09-11 22:00:59,998 INFO -(Success:true)-(Validation:true)-(GUID:68D74EBE-CE3B-7508-6028-CBE1DFA90F8A)-(REQ_RCVD:2022-09-11T22:00:59.051)-(RES_SENT:2022-09-11T22:00:59.989)-(SIZE:2 KB)-(RespSent_TT:0ms)-(Actual_TT:938ms)-(DB_TT:9ms)-(Total_TT:947ms)-(AppServer_TT:937ms)   Data 2:  09/27/2022 16:34:57:998|101.123.456.789|106|1|C97EC2DA10C64F64A83C87AEEC1CDDBE703A546E1B554AD1|POST|/api/v1/resources/ods-passthrough|200|97 Data 2 fields: date_time|client_ip|appid|clientid|guid|http_method|uri_path|http_status_code|response_time     Need help/suggestions on how to achieve faster search. ... View more

Hello All, I am kind of new into splunk. Need help to remove "ms" from the below data sets even before this data is being indexed so that i can use tstats command on these values to create faster searches. Could anyone please help with this. Sample data: 2022-09-11 22:00:59,998 INFO -(Success:true)-(Validation:true)-(GUID:68D74EBE-CE3B-7508-6028-CBE1DFA90F8A)-(REQ_RCVD:2022-09-11T22:00:59.051)-(RES_SENT:2022-09-11T22:00:59.989)-(SIZE:2 KB)-(RespSent_TT:0ms)-(Actual_TT:938ms)-(DB_TT:9ms)-(Total_TT:947ms)-(AppServer_TT:937ms)   How do i remove the string "ms" after all the response times in this data. ... View more

Hello All, I need help trying to generate the P95,P99,P75, mean and median response times for the below data using tstats command. Need help with the splunk query. I am dealing with a large data and also building a visual dashboard to my management. So trying to use tstats as searches are faster. Stuck with unable to find these calculations with value of Total_TT in my tstat command. Can someone help me with the query.   Sample Data: 2022-09-11 22:00:59,998 INFO -(Success:true)-(Validation:true)-(GUID:68D74EBE-CE3B-7508-6028-CBE1DFA90F8A)-(REQ_RCVD:2022-09-11T22:00:59.051)-(RES_SENT:2022-09-11T22:00:59.989)-(SIZE:2 KB)-(RespSent_TT:0ms)-(Actual_TT:938ms)-(DB_TT:9ms)-(Total_TT:947ms)-(AppServer_TT:937ms) ... View more

Hello All, I am pretty new to splunk and still learning day by day. I have a question...In my organisation we have a ton of jboss servers and we are planning to do centralized logging for all of them with each application names as index names. I want to manage all these within deployment server...Instead of creating one app for all applications i want to create a single app for jboss logs  with inputs and outputs deployed from deployment server. Now how can i handle that multiple index issue that i have. Does splunk allow the use of two different inputs.conf....   I was planning to have an inputs.conf created under the etc/system/local with just the value index=app1 and leave the deployment server to take care of jboss logs monitoring. Will this work???   Please suggest me ideas... ... View more

Hello All, I have the below string 2020-04-24 23:14:47,422 INFO http-8080-1 com.pscu.dxsimple.raApp - Response (Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms) I need to extract the key value pairs that are "(Success:true)-(Validation:true)-(F_TAG:1402)-(CLIENT_ID:2113)-(Total_TT:4046ms)-(AppServer_TT:3419ms)" as specific fields. I used index=testindex source="tomcat.txt"| extract pairdelim="\"{-}" kvdelim=":" I am able to see the keyvalue being generated but i need to have this data persistant and saved permanently. How can i do this? Please help ... View more