As @aholzer said, this is not possible but you can anonymize it as documented here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles ... View more

Yes, you do this by first sending ALL events to nullQueue and then pull back just the events that you like. NOTE: I did not test this RegEx. In props.conf : [YourSourceTypeHere] TRANSFORMS-set= setnull,setparsing In transforms.conf : [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = ^\d{4}-\d{2}-\d{2} \d{1-2}:\d{2}:\d{2},\d{3}\s+(?:[+\-0-9]*\s+)?(INFO|WARNING|ERROR|SEVERE) DEST_KEY = queue FORMAT = indexQueue ... View more

Works great, thanks! ... View more

Have you looked at https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs in particular https://your-splunk-server:8089/services/admin/inputstatus/TailingProcessor:FileStatus ? Can be quite helpful in seeing why files aren't being processed. My guess would be "ignoreOlderThan = 10m" is the issue. This means that Splunk ignores any files that is older than 10minutes when it first sees the file (on startup) even if it is written to later on while Splunk is still running. The only way to get Splunk to process the files once it has 'tagged' them as old, is to restart Splunk. ... View more

Hi, I have a similar requirement and the query works fine, I want this time value displayed in a single value panel. Is there any way out? ... View more

I couldn't find a clean and easy way to do this. In fact, I couldn't find a messy and hard way to do this. But then I had a thought - those do happen from time to time - and might have a way to get this done. A few weeks ago I saw an app released that integrates R into Splunk. R is a ... well, don't take it from me, follow the link I provided to the Splunk app and read up on it yourself. R can do practically anything. Well, anything statistical. A quick search turned up pages like this page which show you a function that can be used to find where a time series crosses the X axis. Are there others ways to do this using R? Probably. Do I have those magic answers? Nope. Not even close. Perhaps, though, if you ask real nicely, you may be able to get help from the tool's author (listed on the Docs page of the app) or at least some pointers. For what its worth, some playing around may get you the answer you are looking for anyway. It might "just work" mostly like you'd expect. (I'm not holding my breath, but that would be brilliant if it did!) So, while I'd be overjoyed if there was a clean easy way I just overlooked in Splunk to do this, I hope that at least this may give you a glimmer of hope. If you find an answer, could we ask you post it in here so that others who may want this same sort of functionality will be able to find it? Thanks! ... View more

...|top 20 status| stats avg(count) ... View more

I still have the same problem, at this point it seems to be a problem with the timestamp, I will look into it and update this thread. ... View more

It will end up only counting times when the requests per minute is less than 10 but also greater than 0. Basically if you think about time periods in which there are zero events, for these _time values there will be no rows at all coming into your stats command. See my answer for more details. ... View more

Hi Norling, Which answer are you trying to use? if you're using @stephanefotso 's answer, change eval time=strftime(_time, "%H") to eval time=strftime(_time, "%d/%m/%Y %H:%M:%S") ... View more

I would have said to push it out via the deployer also. ... View more

Hey, I just bumped into some problem when with the search you helped out with before. the where requests_per_minute = 0 does not work as expected, I think it´s because if the count is 0 it does not return any result, however if i do where requests_per_minute = 1 it find every single minute where the count is 1. I changed it to where requests_per_minute < 10 and it founds every minute that has less then 10 events... except for the minutes that have a count = 0. any ideas how to solve this? The most optimal would be if I could specify a ... View more

Worked like a charm, with a minor update to the regex: REGEX=\d*\sINFO\s+\[ Thanks you very much! ... View more

Time range picker is global if token is not defined. Global time range picker is overridden by specific searches having declared time frames, either in xml or in the search string. Being that you said all of your searches have those declared and the default is to include a token from the add input, It is an unused variable at the moment. edit: I have the time range picker working in a global capacity by deleting the token="token" property and deleting any earilestTime and latestTime properties under and in a given search. edit2: Below is for using the token. <earliestTime>$local_time_pick.earliest$</earliestTime> <latestTime>$local_time_pick.latest$</latestTime> This got it working! ... View more

Thanks a lot, that worked. /Magnus ... View more

First of all, if possible change the log structure to something easier to analyse. But if this is not possible here is something you can try: Are the fields wrapped in either " or ' ? Because than you could us a DELIMS="\" \"" or DELIMS="'" if you can change the format use something like this: field1="value1", field2="value2",... Hope this helps. ... View more