Thanks, I guess I have to open a feature request... ... View more

Sorry if I wasn't clear. For whatever reason splunk doesn't treat OR as associative in the where clause of a stats command. This means you have to explicitly treat it as a binary operator. This means you have to do this: "where (count(foo) > 1 OR count(bar) >6 ) OR count(foobar) < 7" Notice the parenthesis. To abstract away, you have to do (x or y) or z , rather than x or y or z ... View more

LOL, I take that back, apparently splunk's parser is much more stupid than I gave it credit for, x OR y OR z will not work in a where clause, however (x OR y) OR z will indeed work, just use parens to make your operators explicitly binary. ... View more

copy and paste the actual search sting you are using. This works fine for me, and the error message you posted looks like you tried to put two 'OR's in a row (like "... OR OR ...") which will not work. ... View more

Use the logical operators (AND OR NOT etc, note that they have to be capitalized). Also stats commands are allow to have a where clause, so you could: sourcetype=foo-bar category=foo | stats count by category where count(category=1)>5 OR count(category=2)>10 OR count(category=3)>15 EDIT: this isn't entirely true, splunk's parser (into the prefix-notation it uses internally) can't handle this for whatever reason. Instead you need to make the operators explicitally binary, that is, sourcetype=foo-bar category=foo | stats count by category where (count(category=1)>5 OR count(category=2)>10) OR count(category=3)>15 ... View more

just "|delta TX" it will save the values in a field called delta(TX) ... View more

Does Sideview allow for this? ... View more

The TX value is accumulated total bytes, and yes, that is why you are finding the difference (Tho I would look at the "delta" command, it does that too and would probably be much more efficient). This command is pulling out the fields "streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name", It should be pulling them out in order, I'm not sure why it wouldnt (which would yield negative numbers). Try making sure that the "by Interface_Host" is actually working. Try looking at the raw data and make sure the tx values are increasing relative to the time stamp. ... View more

Accumulated total bytes, just like ifconfig/the ip2 suite (Btw, that search is much more easy if you use the delta search command) ... View more

As far as I am aware, all that that command does is tell the deployment server to instruct the deployment clients to redo their handshake, recomparing their hashes against the has of the version on the deployment server. (If your thought was that the handshake hasn't been redone since the lookups file was updated, that isn't the case. We run reload deploy server at the very least once a week, and the file has differed for a very long time) To further clarify, my goal isn't to force the deployment server to redeploy the apps, but rather to understand the conditions thereof. ... View more

I should add that it is definitely not just the default/ directory, as I have seen updates in appserver/ and local/ cause a redeploy (And since local/app.conf is generated on the client if missing, the app will redeploy perpetually if you don't have that file) ... View more