Hey, We have a regular access log file with fields named UserAgent and Method. Is it possible to send all data in those fields to the nullqueue? ... View more

Hi We have a very volatile log source which we today control by sending unwanted events to the nullQueue. This is good, but not 100% waterproof and reliable due to the nature of the log source. Is there a way to achieve the same behavior, but instead whitelist events? Basically, we only want to index events that starts with a timestamp and has a LogLevel, examples below: 2015-10-21 12:10:05,786 +0200 INFO .... "the rest of the event..." 2015-10-21 12:10:05,786 +0200 WARNING .... "the rest of the event..." 2015-10-21 12:10:05,786 +0200 ERROR .... "the rest of the event..." 2015-10-21 12:10:05,786 +0200 SEVERE .... "the rest of the event..." cheers Magnus ... View more

Hi. We have an issue when we are trying to collect syslogdata from a filesystem on a syslog server with help from a deployment-app. The folder structure looks like this, all data is being written to /var/log/netlogs/"IP-adress of the device"/messages.log Example structure: /var/log/netlogs/10.3.56.12/messages.log /var/log/netlogs/10.3.56.13/messages.log /var/log/netlogs/10.3.56.14/messages.log /var/log/netlogs/10.3.56.15/messages.log Here is the inputs.conf file we are using right now (we have experimented back and forward with crcSalt, initCrcLength) [monitor:///var/log/netlogs/] sourcetype = syslog whitelist = .log$ SHOULD_LINEMERGE = false crcSalt = <string> initCrcLength = 6250 ignoreOlderThan = 10m index = network Any ides what we need to do in order to index every single messages.conf in this filestructure ... View more

Hi. I'm using the predict command to determine when my machine will run out of disk based on the historical usage, and it works really well. However, instead of showing it as a graph, I want to display the date in time in a statistics view when the field prediction(Used Space) = 1 or less The predict command automatically produce the fields lower95/Prediction/upper95 by default. Here is the search: index=main host="localhost" instance="G:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180 Any ideas how to get this result? ... View more

Hey guys, I have build a couple of dashboards around capacity management and I use the Splunk predict command to determine when disk space hit´s 0%, it works really well. see the attached image. Now I need help to build a search which just returns the date as a single value where the red line/Judgement day is. Any creative ideas how to do that? Here is a search i currently use: index=perfmon host="my hostname" instance="H:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart avg(Value) as UsedSpace | predict UsedSpace algorithm=LLP5 future_timespan=180 ... View more

Hi guys. I want to be able to calculate downtime based on the amount of requests that an Application server processes. The downtime is calculated based on the following rules. Choose a time-span 30 min before and 30 min after the actual downtime. Calculate the average amount of events based on the top 20 results i.e the 20 minutes with the most amount of processed requests. Cassify all events as downtime that has 80% or below of the average described in step 2 above. Below is an example of the result I want to calculate downtime on: ... View more

Hey guys, does anyone of you know why this happens when on dashboard with chart overlay elements? I only experience it when I look at charts over 1 week of time. ... View more

Hi guys. When using the Single Value Decorations (extension available in the Splunk 6.x Dashboard Examples) is it possible to show the timestamp next to the decoration instead of the value for when the last event occurred, my XML and search looks like this: <searchString> "my base search" | stats count | rangemap field=value none=0-99 low=100-199 guarded=200-299 elevated=300-399 high=400-499 severe=500-599 default=none</searchString> <earliestTime>-15m</earliestTime> <latestTime>now</latestTime> <option name="classField">range</option> <option name="field">value</option ... View more