Hi, I'm trying to set a weekly report on Severity Level 1 etc of syslog information. since there are equipment that sends the information every few minutes (which makes sense it is severity level 1) - I'd like to summerize that into 1 line (that can or can't be expandable). for example - > host = 10.40.2.148 severity_id = 1 > source = udp:514 sourcetype = > cisco:ios 1/18/15 1:30:13.000 PM Jan > 18 13:30:13 10.40.2.148 55888: Jan 18 > 11:30:09: %PLATFORM_ENV-1-PWR: Faulty > internal power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 1:20:51.000 PM Jan 18 13:20:51 > 10.40.2.148 55887: Jan 18 11:20:46: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 1:18:54.000 PM Jan 18 13:18:54 > 10.40.2.148 55886: Jan 18 11:18:50: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 1:14:09.000 PM Jan 18 13:14:09 > 10.40.2.148 55885: Jan 18 11:14:05: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 1:14:04.000 PM Jan 18 13:14:04 > 10.40.2.148 55884: Jan 18 11:14:00: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 1:09:18.000 PM Jan 18 13:09:18 > 10.40.2.148 55883: Jan 18 11:09:14: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 12:57:22.000 PM Jan 18 12:57:22 > 10.40.2.148 55882: Jan 18 10:57:18: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 12:48:14.000 PM Jan 18 12:48:14 > 10.40.2.148 55881: Jan 18 10:48:09: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected host = > 10.40.2.148 severity_id = 1 source = udp:514 sourcetype = cisco:ios 1/18/15 > 12:46:40.000 PM Jan 18 12:46:40 > 10.40.2.148 55880: Jan 18 10:46:36: %PLATFORM_ENV-1-PWR: Faulty internal > power supply detected can I make it into 1 line ? (summary) ... View more

Hi, I've been asked to give statistics whats the avarage EPS that each indexer get. and show it over a day etc. any suggestions ? ... View more

Hi, how do I set an alert to check the status every 5 minutes ? and another question - how can I set the throttle to be set per host ? for example - I'd like to get an alert when a host is sending syslog about Spanning Tree root guard. and I'd like the alert to ignore that specific host for 1 hour. BUT I do want the alert to alert me in case that another host is sending the same alert. is that possible ? ... View more

I have 10GB License and I have to know when I reach 90% of my license ! I've read that DMC (Distributed Management Console) has a native support from version 6.2. so I've chosen the DMC alert - DMC Alert - Total License Usage Near Daily Quota yet the problem is that I'm getting this alert every 4 hours ! instead of when I'm reaching 90% of my license. please help ! ... View more

Hi, I'm using the latest Splunk version , and netscaler 10.1. I have installed on the index head the Splunk_TA_Citrix-Netscaler & IPFIX, and on search head I have installed the software and the TA & IPFIX. I can see over the Splunk that data is getting - 12/16/14 11:54:21.000 AM Dec 16 11:54:21 10.40.2.224 16/12/2014:11:47:21 GMT 0-PPE-0 : UI CMD_EXECUTED 1489 0 : User NDS_support - Remote_ip 10.56.182.0 - Command "show ns hardware" - Status "Success" • host = 10.40.2.224 • source = udp:514 • sourcetype = syslog when I'm getting to the splunk for Netscaler software it doesn't recognize the Netscaler. I've modified over Splunk_TA_Citrix-NetScaler/default/inputs.conf to be - [udp://514] #connection_host = dns sourcetype = ns_log index = netscaler disabled = false # A separate IPFIX addon is needed in order for the following stanza to work. http://apps.splunk.com/app/1801/ [ipfix://NetScaler_AppFlow] sourcetype = appflow index = netscaler address = 0.0.0.0 port = 4739 buffer = 1048576 disabled = true ... View more

I have configured an Alert that is running in real time. with the value of host="10.56.183.0" "%LINEPROTO-5-UPDOWN" since 10.56.183.0 is a switch and I'd like to recieve an email when interface goes up or down. When the event occurs once (I can see in the search that it ocurrs once) I'm getting 2 emails. and when looking at the Alert window - I can see that it counted 2. any idea why ? ... View more