you can find the Splunk Universal Forwarder here - https://www.splunk.com/page/previous_releases/universalforwarder from a previous post on this same topic - https://answers.splunk.com/answers/173767/splunk-version-for-windows-server-2003-32-bit.html I would suggest that they install the latest release version of the UF 32 bit 6.1.4. “This version of Splunk is supported but is not recommended on this platform” - is only applicable to 32bit installs on 64 bit machines I believe; so not relevant in this case. Please note that you only have about 9 months of support left on those. On July 15th, 2015 support ends on Windows Server 2003 ... View more

Hi, may i know how you created this screenshot (the search query or any app or..) ... View more

Hi Syed, can you update us if you are able to find the devices which are not sending logs.. if you have missed, as you are a new member, can you please accept this as an answer ... View more

Great to know that we found out the solution !!! as you are new member to this forum, you can accept this as an answer (and you can upvote as well 😉 ) ... View more

try this - sourcetype=uniqueidd | rex field=_raw "version=(?<version_number>[^,]+)" | eventstats max(version_number) as current_version min(version_number) as older_version by id | where like(current_version,"%1.10%") OR like(current_version,"%1.11%") OR like(current_version,"%1.12%") AND current_version=older_version | table current_version older_version _raw ... View more

I need to column of source,Host,lasttime and duration. // Finding source and host together may not be a good method I think. For example, if a host has not sent an event means, all sources/sourcetype s from that host also has not an event. A source/sourcetype which is sending events properly from one host may not be sending any events from another host. So finding source/sourcetype may not be useful I think. Or, do you have other reasons for looking source/sourcetype? ... View more

You can run the following search to detect forwarders that have been up in the last 24 hours but not in the last 2 minutes. It uses the forwarder heartbeat, which is a feature of Splunk versions 3.2 and later. index=_internal sourcetype="fwd-hb" starthoursago=24 | dedup host | eval age = strftime("%s","now") - _time | search age > 120 age < 86000 You can set this search up as an alert every several minutes so that Splunk will let you know if any of your active forwarders have not responded in the last 2 minutes. If you're running a version of Splunk that is later than 3.3', the heartbeat message is not longer sent. Use the following search instead: index=_internal "group=tcpin_connections" | stats max(_time) as latest by sourceHost | eventstats max(latest) as latest_all | eval lag = latest_all - latest | where lag > 120 | fields sourceHost lag ... View more

Please check this.. just did a reordering. You will need to add that table command in the last.. |metadata index!=network* index=win* index=lin* type=hosts | stats max(lastTime) as lastTime by host | eval diff = now()-lastTime | where diff > 3600|sort - diff | eval lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S") |eval Duration=tostring(diff,"duration") | table host sourcetype lastTime ... View more

Hi SamDavies, may we know 1) you have only two versions or more than two. 2). Can you give us the sample version numbers please. ... View more

Actually you explained the issue very clearly and nicely. Ok, let's try this ... If we use Uniq command, it will get us only "a".. index=my_index id=a | | uniq|table id ... View more

Try "latest=now" More on time modifiers... https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch ... View more

not this comment.. this whole reply, you can "Accept this as answer".. also the upvote button(^) ... View more

Yes Please 😉 .. an upvote and/or accept as answer would be Great ! ... View more

i am not sure if i understand your task correctly, but, lets check this - | inputlookup mylookup | search mylookup_column_name=$keyword$ ... View more

try this - | inputlookup mylookup | search keyword="value" i have a mapZipcode lookup configured on my system and to look for Florida, and this works fine - | inputlookup mapZipCode | search city="Florida" ... View more

Server tokens Common tokens that provide details available from the Splunk platform server. Token Description $server.build$ Build number of the Splunk platform instance. $server.serverName$ Server name hosting the Splunk platform instance. $server.version$ Version number of the Splunk platform instance. ... View more

Simply when you search for sourcetype=my:sourcetype what it returns ... View more

Maybe, add double quotes around source type. index=my_index sourcetype="my:sourcetype" ... View more

regarding that timechart, you can check this one.. | tstats count WHERE index=main by _time host sourcetype span=30m | timechart span=30m sum(count) by sourcetype if the issue is resolved, can you accept this answer. ... View more

Good learnings, Sundaresh Sir. ... View more

i uploaded these sample events - A is running b is running c is running A is running b is failed c is running i ran this query - sourcetype=runningrex | rex field=_raw "(?<first>\w)\sis\s(?<status>\w+)" | table first status _raw and i get this result - first status _raw c running c is running b failed b is failed A running A is running c running c is running b running b is running A running A is running ... View more