Hi, I have the following search that displays a table with time as rows and conferenceID as columns. i only want to include conferenceIDs (columns) where the sum > 1 and there are at least 2 non-zero spans. My search: index=myindex sourcetype=mysourcetype | timechart span=7d count by ConferenceID limit=0 where sum > 1 I want to keep column 1, but not column 2: 1001 1002 wk1 1 2 wk2 0 0 wk3 1 0 wk4 0 0 ... View more

Hi, I have xml data that can have up to 500+ lines but Splunk is truncating at 257 lines. I've been trying combinations of LINE_BREAK and BREAK_ONLY_BEFORE, but no luck. I'm not sure if it's my regex or my config files or what. thanks, mike I defined the stanza in inputs.conf: [monitor:///app/freeswitch/cdrs/*.xml] sourcetype = conf_cdr_xml Here's my props.conf: [conf_cdr_xml] KV_MODE = xml SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE = \<\/cdr\> MAX_EVENTS = 100000 TRUNCATE=100000 NO_BINARY_CHECK = true pulldown_type = true And here is an example event: <cdr> <conference> <name>5551231234-1234567</name> <hostname>test@test.net</hostname> <rate>8000</rate> <interval>20</interval> <start_time type="UNIX-epoch">1521040386</start_time> <end_time endconference_forced="false" type="UNIX-epoch">1521040388</end_time> <members> <member type="caller"> <join_time type="UNIX-epoch">1521040386</join_time> <leave_time type="UNIX-epoch">1521040388</leave_time> <flags> <is_moderator>true</is_moderator> <end_conference>true</end_conference> <was_kicked>false</was_kicked> <is_ghost>false</is_ghost> </flags> <caller_profile> <username>5553214321</username> <dialplan>XML</dialplan> <caller_id_name>DEMO SITE</caller_id_name> <caller_id_number>5553214321</caller_id_number> <callee_id_name></callee_id_name> <callee_id_number></callee_id_number> <ani>5553214321</ani> <aniii></aniii> <network_addr>10.1.1.165</network_addr> <rdnis></rdnis> <destination_number>5551231234;conf=555;mod;tone=NO_SOUNDS</destination_number> <uuid>2dccfdde-279a-11e8-99a6-5903ab961f76</uuid> <source>mod_sofia</source> <context>public</context> <chan_name>sofia/internal/5553214321@10.1.1.125</chan_name> </caller_profile> </member> <member type="caller"> <join_time type="UNIX-epoch">1521040386</join_time> <leave_time type="UNIX-epoch">1521040388</leave_time> <flags> <is_moderator>true</is_moderator> <end_conference>true</end_conference> <was_kicked>false</was_kicked> <is_ghost>false</is_ghost> </flags> <caller_profile> <username>5553214321</username> <dialplan>XML</dialplan> <caller_id_name>DEMO SITE</caller_id_name> <caller_id_number>5553214321</caller_id_number> <callee_id_name></callee_id_name> <callee_id_number></callee_id_number> <ani>5553214321</ani> <aniii></aniii> <network_addr>10.1.1.165</network_addr> <rdnis></rdnis> <destination_number>5551231234;conf=555;mod;tone=NO_SOUNDS</destination_number> <uuid>2dccfdde-279a-11e8-99a6-5903ab961f76</uuid> <source>mod_sofia</source> <context>public</context> <chan_name>sofia/internal/5553214321@10.1.1.125</chan_name> </caller_profile> </member> </members> <rejected></rejected> </conference> </cdr> ... View more

Hi, Here's a sample of my XML data. I want to get the username. I tried a field alias, but that's not working, nor is field extraction. When I open the field extractor tool, the data is truncated after the caller_profile tag. When I look at the event, it's all there. It's only when I try to use the field extractor that it gets truncated. props.conf: [conf_cdr_xml] TRUNCATE = 0 KV_MODE = xml date sample: 1235551234-101 hostname.com 8000 20 1510329526 1510329534 1510329526 1510329534 true true false false 1235551010 XML Joe Boss 1235551010 1235551010 10.0.1.1 1235551234;conf=101;mod;tone=NO_SOUNDS 038fa0ce-c630-11e7-938f-b3cdceb36fa4 mod_sofia public sofia/internal/1235551010@10.10.1.1 ... View more

Hi, Data generated from the app is being forwarded with index = "os" but that doesn't exist on our corporate splunk instance. I edited indexes.conf, replacing "os" with the name of my index, and when that didn't work, I edited inputs.conf and added index = "myIndex", but the data still shows up with index = "os". Here's what the files look like now. $ cat ~/etc/apps/Splunk_TA_nix/default/indexes.conf # Copyright (C) 2005-2016 Splunk Inc. All Rights Reserved. [myIndex] homePath = $SPLUNK_DB/os/db coldPath = $SPLUNK_DB/os/colddb thawedPath = $SPLUNK_DB/os/thaweddb [firedalerts] coldPath = $SPLUNK_DB/firedalerts/colddb homePath = $SPLUNK_DB/firedalerts/db thawedPath = $SPLUNK_DB/firedalerts/thaweddb $ cat ~/etc/apps/Splunk_TA_nix/local/inputs.conf [script://./bin/cpu.sh] disabled = 0 [script://./bin/df.sh] disabled = 0 [script://./bin/uptime.sh] disabled = 0 [script://./bin/vmstat.sh] disabled = 0 index = myIndex ... View more

Hi, I have a search that plots CPU and max Attendees over time. It's rather convoluted, and I'm wondering if there's a better way. I'm pretty new to splunk. Any suggestions? host="freeswitch" sourcetype="cpu" | eval earliest=info_min_time | eval latest=info_max_time | multikv | append [search host="freeswitch" sourcetype="cdr_xml" | eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") | eventstats count(callerName) as Attendees by Conf_Start] | timechart span=5m max(cpu_user_percent) as CPU max(Attendees) as Attendees thanks, mike ... View more