Good to know, thanks! ... View more

Hi andrewm99, Did you find any solution to this ussue? I have the same problem and I'm loosing a lot of events too! Thanks! ... View more

I've just remembered another little problem, perhaps is your case: You have to modify the start Script of Streamfwd This is the path: /etc/init.d/streamfwd  You have to add these lines to the script, as the error is related to a non existing directory /var/run/streamfwd if [ ! -d /var/run/streamfwd ]; then   mkdir /var/run/streamfwd/ fi Check if it's your case too and please comment. ... View more

Hi banaie, There is no template called Splunk. If you search on /opt/streamfwd/configs, you will only find two templates, one for ES, and another for ITSI. You have to create another directory under /optstreamfwd/configs (I called it Splunk) and select and modify for your needs the xml files you will find on these templates. I started modifying those xml under the Default directory of  Stream App located at the indexer, wich seam to have the same format. If it doesn't work, check the log file located at /opt/streamfwd/var/log and post some errors here. ... View more

Hi Banaie, I had similar behaviour last month, but on CentOS 7. Try to use a template or create your own. Now I'm using my own template and works pretty stable. If you have many filters or aggregations, some problems could occur. Also you need some tunning in streamfwd.conf, that's mine as example: [streamfwd] port = 8889 ipAddr = 127.0.0.1 dedicatedCaptureMode = 1 streamfwdcapture.0.interface = 0000:00:13.0 #streamfwdcapture.0.filter =  uioDriverModuleName=uio_pci_generic #usePacketMemoryPool = true #streamfwdcapture.0.interface = eth1 streamfwdcapture.0.offline = false configTemplateName = splunk pcapBufferSize = 40000000000 maxTcpSessionCount = 1000000 maxTcpReassemblyPacketCount = 2000000 maxEventQueueSize = 100000000 maxPacketQueueSize = 16777216 maxEventAttributes = 2000 tcpConnectionTimeout = 10 processingThreads = 24 httpEventCollectorToken = 743e2231-8....... indexer.0.uri = http://yourindexer:8088 Hope it helps! ... View more

Hi Faisal, I managed to do that yesterday following these steps from the MLTK documentation: https://docs.splunk.com/Documentation/MLApp/5.1.0/API/CorrelationMatrix Hope it helps! ... View more

I think that if you are using streamstats window=100 to compute avg and stdev, your moving window is exactly 100 events. This should correspond with your 5 minutes window. In case you want to use all data as reference for finding outliers from avg and stdev, you should use eventstats to compute avg and stdev of all data in your search. ... View more

Update: I've tried again with Notepad++ "Convert to UTF-8" and save. It worked also perfecty. ... View more

Hi Marina, What it has worked for me is to edit the file with Notepad++ In the Coding menu, select "Convert to UTF-8 and save as a new file.CSV. Open the new file.CSV, select "Code as ANSI" and save again. With this new file.CSV, inputlookup show all characters OK. ... View more