Hi All, I have a data truncation problem. I have a long event that is >10,000 characters. I updated the props.conf TRUNCATE field to 100,000 and this works great to view full event. However, when I want to dump data in an organized format with TABLE command it still limits me to 10,000 characters. Specifically, I have a search command like this: {base search} | table key1, key2, key3, ... {base search} displays more than 10,000 characters if I run it by itself because I changed TRUNCATE in props.conf. But when I add "| table" then table thinks that I am only giving it 10,000 characters. So some output keys in the table are broken. Is there a different property I can update in props.conf to fix this problem? ... View more

Hello, I am trying to determine the time difference between the two timeStamp columns in my events. I tried to use the search below, but cannot return anything for the "diff" at the end... ... my base search ... | eval raw_time=strptime(_time,'%Y-%m-%dT%H:%M:%S') | eval utc_endtime=strptime(UTC_EndTime,'%Y-%m-%dT%H:%M:%S') | eval diff= raw_time-utc_endtime My example events are like this: 2016-10-15T03:59:59.999999, UTC_EndTime=2016-10-14T19:59:59.999999, 2016-10-15T02:59:59.999999, UTC_EndTime=2016-10-14T18:59:59.999999, 2016-10-15T01:59:59.999999, UTC_EndTime=2016-10-14T17:59:59.999999, I would appreciate if you can help me to see the mistake I am doing here. Many thanks! ... View more

Hello everyone, I had trouble last year making a simple alert work in Splunk (topic: "Simple alert not working?"). I could not make it work so I used Python SDK and alerted using python. Now I want to try to make Splunk alert again. I have tried many simple tests, and I have never successfully made an alert fire. I must be doing something simple wrong. I have streaming data that comes constantly. Can anyone suggest a trivial alert test I can try that can work? For example, I try a search for all data on my index and get hundreds of results in most recent few minutes. Then I click "save as" and select "alert". I select to have alert type scheduled from Cron Schedule, and tell it to run every minute (* * * * *). I choose "trigger alert when" I select "number of results" and select "is greater than" with value "0". For trigger action I ask it to send me an e-mail. I save the alert and it appears in my alerts list. But no longer how long I wait I never get an e-mail and the alert always says "There are no fired events for this alert". I have tried other Cron selections. I have also tried using "Real-time" instead of Cron Schedule, but it still does not fire. Does anyone know how to make it fire? Thank you very much for any help, Pelin ... View more

Hello, I have installed and used the Splunk universal forwarder to successfully forward my data to my local Splunk Enterprise server. I followed the instructions http://answers.splunk.com/answers/50082/how-do-i-configure-a-splunk-forwarder-on-linux.html. I then followed the same instructions for two different cloud hosts, but neither worked. Both listed the host as inactive. I cannot even ping either of the hosts. I have seen some people say that a firewall could block the forwarder. Is it possible that this is the cause? Both Splunk cloud hosts are configured to receive on port 9997. If it is a firewall problem, how can I fix it for the Splunk cloud trial version? Here is the problem: splunk list forward-server Active forwards: Pelins-Macbook-Pro.local:9997 Configured but inactive forwards: prd-p-26fhqv8slwd9.cloud.splunk.com:9997 prd-p-tvrqpx4kg23s.cloud.splunk.com:9997 I would greatly appreciate any advice or help! ... View more