Under Metrics, in the Splunk App for Unix, the query for CPU begins like this: search (index=os sourcetype=cpu host=anyhost CPU="all") If I remove CPU=all in the search, I see the data. How can I fix this? ... View more

When I attempt to look at a volume in the Proactive Monitoring > Volume Detail section, Splunk CPU's on the indexer/search head go to 100% and I have to power the box off to resolve this. I am running NetApp Data ONTAP 2.1.1 and Splunk Enterprise 6.3.1 on Windows 2012 R2. ... View more

I'm trying to deploy the Splunk App for NetApp, and on my DCN, I can't get python to run on port 8008. The hydra_gateway.log file has these entries: 2014-12-25 17:09:03,521 WARNING [HydraWSGI:27980] got unexpected socket error when checking port availability, will attempt to bootstrap gateway anyway. socket error: [Errno 111] Connection refused 2014-12-25 17:09:03,521 WARNING [HydraWSGI:27980] unable to recover a serialized cache, message=[Errno 2] No such file or directory: '/opt/splunk/etc/apps/SA-Hydra/local/run/hydra_gateway.cache' I'm running Splunk 6.2.1 and the DCN is running on CentOS7. Thanks for the help. ... View more

I'm currently indexing DHCP stats, used and free for each scope, every five minutes. Now, if I want to chart this information for say a day it's not a problem. But, if I want to chart this data for longer periods of time, how can I get Splunk to selectively pull the used and free data at the top of every hour, or two hours etc. to cut down the data points? Thanks. ... View more

I have this in a transforms.conf file on one of my forwarders. My goal is to drop everything from either of the IP's, but they keep coming through. What am I doing wrong? [setnull] REGEX = .*(10\.3\.0\.(11|12)).* DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = . DEST_KEY = queue FORMAT = indexQueue THanks, --Carl ... View more

I am trying to graph BytesTotalPersec for the four interfaces on a particular server. The name of each interface is: Intel[R] Gigabit ET Quad Port Server Adapter Intel[R] Gigabit ET Quad Port Server Adapter _2 Intel[R] Gigabit ET Quad Port Server Adapter _3 Intel[R] Gigabit ET Quad Port Server Adapter _4 The index has the stats for all four interfaces, but in the Pick fields section, Name only contains one value and that value is Intel[R]. Thanks for the help. --Carl ... View more

On a Windows 2008 R2 server, I've been comparing the %Processor Time counter on the _Total instance from Perfmon with the PercentProcessorTime counter on the _Total instance of the PerfOS_Processor object in Splunk. The output from the counters is never the same. In Splunk, I created a separate index and started sampling at one second intervals to see if I could get the two counters to line up but they don't. I'm running version 4.2.1 build 98164. Can someone help me discovery why there is a discrepancy? Thanks, --Carl ... View more

I need a regex that can process all security events with eventid 540 that don't contain $, SYSTEM, or ANONYMOUS LOGON. I am genetically incapable of creating such a regex, so thanks for the help. ... View more