Hi all, Can u clarify me wheather the Splunk can do real-time analysis/moitoring.. If so..please give me the document link for doing realtime analysis in Splunk Thanks in advance Poornima ... View more

Hi all In the search bar i want to use two source files and to see the events of the two files below is the query i have used source="E:\pros_data\taskmanager_log (2).txt" "E:\pros_data\taskmanager_log.txt" i am getting no results found please give inputs ... View more

Hi all, is it possible to add deployment server in trial version of the splunk 4.3.3 thanks, Poornima ... View more

Hi all, i have an doubt please clarify me .. in the search panel ..is it possible to give two source and get the output thanks ... View more

hi using the below code i created three dropdowns if i select the index name in first dropdown it shows the sourcetypes in that index in the second dropdown . upto this its working fine:) my problem is if i select the sourcetype in that second dropdown i want to list of the sources for the sourcetype i have selected in the second dropdown ..but it shows all sources this is codei used <module name="SearchSelectLister" layoutPanel="panel_row3_col1" group="Drilldowns - 3"> <param name="label">which index</param> <param name="settingToCreate">index_setting</param> <param name="search">| eventcount summarize=false index=* | search index!="splunklogger" index!="summary" index!="history" | sort -index</param> <param name="searchWhenChanged">True</param> <param name="selected">main</param> <param name="searchFieldsToDisplay"> <list> <param name="label">index</param> <param name="value">index</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">index_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="index"> <param name="fillOnEmpty">True</param> <param name="prefix">index=</param> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister"> <param name="label">Sourcetype</param> <param name="settingToCreate">sourcetype_setting</param> <param name="search">| metadata type="sourcetypes" $index$</param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">sourcetype</param> <param name="value">sourcetype</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">sourcetype_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="sourcetype"> <param name="fillOnEmpty">True</param> <param name="prefix">sourcetype=</param> <param name="value">$target$</param> </param> </param> </param> <module name="SearchSelectLister"> <param name="label">Source</param> <param name="settingToCreate">source_setting</param> <param name="search">| metadata type="sources" $index$ $sourcetype$ </param> <param name="applyOuterIntentionsToInternalSearch">True</param> <param name="searchFieldsToDisplay"> <list> <param name="label">source</param> <param name="value">source</param> </list> </param> <module name="HiddenSearch"> <param name="search">$index$ $sourcetype$ $source$</param> <module name="ConvertToIntention"> <param name="settingToConvert">source_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="source"> <param name="fillOnEmpty">True</param> <param name="prefix">source=</param> <param name="value">$target$</param> </param> </param> </param> this the output i am getting thanks!!! ... View more

Hi all i used the below code..to list down the sourcetype of the main indx in the dropdown .. sources | metadata type=sourcetype index=main please correct me if i made an mistake.. thanks in advance ... View more

Hi all, i have an log4j logs in that i have extracted the User names ...so now my field User has 79 user names what i need is i want a dropdown in that i want this 79 name to be in that list so that if i click any one of the name i want to see the log related to that Username plz give an idea to proceed thanks in advance, poornima ... View more

Hi all , can anyone tell me wt is the type of the log file for the below given logs 2011-12-17 00:03:54,415 INFO [RMI TCP Connection(11631)-149.177.139.66] (com.prssom.evaluating.pm.index.IndexLog$2) - USER: system, ACTION: retrieving value for index id = 10861, effective starting at 20111216000000 2011-12-17 00:03:54,681 INFO [RMI TCP Connection(11631)-149.177.139.66] (com.prssom.evaluating.pm.index.IndexLog$2) - USER: system, ACTION: retrieving value for index id = 726, effective starting at 20111216000000 thanks Poornima ... View more

can you anyone suggest what will be the source type for this log 2012-09-24 00:03:46,453 INFO http-8080-4 - Servlet RTOU Request: loginPage Session: 2683355BD1E9664233FA135874EA0E25 Parameters: control=loginPage Headers: connection=Keep-Alive user-agent=Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) host=amgdcprosappp1.celanese.com:8080 2012-09-24 00:03:46,453 INFO http-8080-4 - eventClass=com.prosrm.ui.web.engine.processors.SignOnProcessor 2012-09-24 00:03:46,453 INFO http-8080-4 - method=processSignOn 2012-09-24 00:03:46,469 INFO http-8080-4 - Request or Session or Locale object is null, using default US locale. 2012-09-24 00:03:46,469 INFO http-8080-4 - CheckpointBuffer for control = loginPage, session = 2683355BD1E9664233FA135874EA0E25, elapsed (msec) --> 16 thanks in advance ... View more

hi all, i am splunk 5.0 and i tried the query below with predict function as given in the document source="hdfs://172.25.192.226:8020/user/cloudera/input/taskmanager_log20111210_09.19.49.txt"| transaction TaskAction startswith=START endswith=Succeeded| timechart count(duration) by TaskAction|predict count(duration) as Durationf but it throws me error as command="predict", Too few data points: 0. Need at least 2 Thanks in Advance poornima ... View more