Hello, I am trying to pull out the last 24 hours worth of results for an alert using loadjob , with the following search: index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" | map search="| loadjob $sid$" That works fine. I would like to add the column trigger_time to my results. I tried this: index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" | eval trigger_time = strftime(trigger_time,"%m/%d/%y %H:%M:%S") | table trigger_time | appendcols [| search index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" | map search="| loadjob $sid$"] This kind of works, but if there are multiple results from the loadjob command, it breaks (i.e. it shows the trigger_time but no results from loadjob . Any ideas? Thanks, L ... View more

Hello, I have the following in my inputs.conf on a Windows server: [perfmon://CPU] counters = % Processor Time; % User Time; % Privileged Time; Interrupts/sec; % DPC Time; % Interrupt Time; DPCs Queued/sec; DPC Rate; % Idle Time; % C1 Time; % C2 Time; % C3 Time; C1 Transitions/sec; C2 Transitions/sec; C3 Transitions/sec disabled = 0 instances = * interval = 10 object = Processor useEnglishOnly=true index = os I can see metrics coming through: 0 7.597075517979601 3.4455327772956763 4.071993282258527 338.6526155305428 0 0 55.64008336869486 0 91.11271353582889 2.18562547981863 88.92708805601026 0 26.86764386091932 250.12974415296156 0 With object=Processor , sourcetype=PerfmonMk:CPU . The Windows Infrastructure app requires a counter field be present in its searches, but Splunk does not appear to be including this field in the results. Has anyone seen this before? Do you know where the extraction may be failing? ... View more

Hello, I have a Splunk Indexer cluster. The cluster consists of 3 peer nodes, with a replication factor of 3. My issues are surrounding freezing off old log data. I need to be able to archive off old logs. The documentation does not give a definitive way to do this with a clustered environment. I would think that since I have a replication factor of 3, each indexer has a complete copy of all the data, and therefore, I would only need to freeze data from one peer node. If the observation in point 1 is correct, since all configuration should be the same between indexers in a cluster, I don't think I can use the native Splunk config for archiving log data (or can I)? How have others handled this? Does anyone have any advice on how to best proceed? Cheers! ... View more

HI all, Just wondering if anyone here has been successful in getting logs out of WSUS that shows: number of hosts with outstanding patches, number of hosts with failing patches, list of patches applied to different hosts etc. The TA for WSUS appears to only seems to perform field extractions, not anything to do with the inputs from WSUS. I have written some PS to extract this information but there must be a better way. Any help would be most appreciated. Cheers, W ... View more

Hello, I have inherited PoC Splunk Search Head on Windows 2016 that has a Splunk Indexer cluster as its search peers. Unfortunately rebuilding it from the ground up is not an option. The Splunk SH continually crashes after midnight with the following error from splunkd.log: 05-26-2018 00:03:36.425 +1000 WARN Thread - DistributedPeerMonitorThread: about to throw a ThreadException: _beginthreadex: The paging file is too small for this operation to complete.; 68 threads active 05-26-2018 00:03:39.894 +1000 WARN Thread - indexerPipe: about to throw a ThreadException: _beginthreadex: The paging file is too small for this operation to complete.; 68 threads active 05-26-2018 00:03:39.894 +1000 ERROR pipeline - Runtime exception in pipeline=indexerPipe processor=indexer error='indexerPipe: about to throw a ThreadException: _beginthreadex: The paging file is too small for this operation to complete.; 68 threads active' confkey='' The crash log contains the following snippet: Crashing thread: DistributedPeerMonitorThread I have a bunch (10 or so) of searches to kick off at midnight but I have given them a schedule window of 6 hours to run. The paging file is currently set to 12 GB. The memory on the Search Head is 24 GB. Any ideas on how I can make this PoC a success? ... View more