I currently have summary searches that are writing data to summary indexes, and have been doing so for years. My disk space constraints allow me to maintain just over a year of indexed data, and as the index(es) grow, old data rolls off via max index size settings. However, my summary indexes contain (reportable) summarized data from before the earliest index data. In fact, I have about three years’ worth of summarized data (with significantly less disk utilization than the original data). In Report Acceleration, one specifies the (preset) time frame over which to maintain the summarized data. Summarized data that is older than the time frame specified is trimmed. But how does that work for the “All Time” constraint? Does the summarized data get removed when index data is removed due to size constraints, or is the summarized data retained and reportable? ... View more

According to the setup documentation, the input for Splunk for Palo Alto Networks should write to the pan_logs index, however, I would prefer that it write to the default index. My hope is that making this change is as easy as updating the `pan_index` macro to point to the default index rather than pan_logs, but are there any other considerations? ... View more

Environment: Windows Splunk 5.0.4 Splunk for Palo Alto Networks 3.3.1 I am looking to install the Splunk for Palo Alto networks in an environment where Splunk has no access to the outside world. That being said, geolocation, wildfire, and pretty much everything that needs to talk to a third party will not work. Are there steps I can take to disable the attempts to query the outside world? Attempts to access disallowed locations are logged/alerted on, and I would like to remove as much noise as possible. I also get the following errors when I access the app because I have not installed the geolocation modules (because they wouldn’t work anyway). And the start page just hangs at "Loading...". How do I prevent these pop-ups? And is there a workaround for the PAN Overview page? Splunk encountered the following unknown module: "GoogleMaps" . The view may not load properly. Splunk encountered the following unknown module: "GeoDrilldown" . The view may not load properly. ... View more

I'm sure there is an easy answer for this and I'm going feel silly when I see it. I have a scripted input that pulls volume data for several volumes every 5 minutes. I would like to see the change in used terabytes of the combined volumes over time (each volume has a used_tb key/value pair in the log). For short timeperiods, I can do... ... | timechart span=5m sum(used_tb) but when once I need to go beyond the last 24 hours, this breaks down. I can do... ... | timechart span=1h min(used_tb) by volume and then use an area graph in stacked mode to get the idea, but I can't get an accurate measure when I hover over the graph (the pop up is for the individual volumes). I thought that nesting the functions... ... | timechart span=1h sum(min(used_tb) by volume) would work, but this produces no values. What really easy thing am I missing here? ... View more

I'm trying to identify the source of a performance slow down that has occurred twice over the last two days. Each slow down occurred over a five minute period, once two days ago, once this morning (at different times of the day). I suspect some user activity, but have not been able to identify the particular user. I'd like to be able to narrow my search results to only users w/ activity during both time periods. The logs that I'm looking at have a "CustID" field. So, what I'd like to be able to do is something like... sourcetype=MySourceType CustID="Any customer w/ activity in both time periods" ... How would I go about this? Would it be possible to timechart the results and overlap the times? ... View more

I have two sourcetypes where the thousandth of a second portion of the timestamp is not padded w/ leading zeros if the time is less than 100 thousandths of a second. Examples: A log event is created at eight AM and eight thousandths of a second. The timestamp for this event would be... 08:00:00:8 Splunk interprets that time as... 08:00:00:800 instead of 08:00:00:008 A log event is created at nine AM and ninety thousandths of a second. The timestamp for this event would be... 09:00:00:90 Splunk interprets that time as... 09:00:00:900 instead of 09:00:00:090 This causes log entries in Splunk to be out of order when viewing a sequence of logs. My question is how I should go about fixing the timestamp for future logs (w/o a huge burden on the indexer). And can I fix the timestamps for events that already exist in my index? I will include some example logs for additional clarification. Note that all items (including date and time) are tab delimited. SERVER-1 Aug 05, 2010 12:58:58:851 1234 <SYSTEM/AUTOMATION> Running Job ID 1, Name of job 1 SERVER-1 Aug 05, 2010 12:58:59:2 1235 <SYSTEM/AUTOMATION> Running Job ID 5, Name of job 2 SERVER-1 Aug 05, 2010 12:58:59:70 1235 <SYSTEM/AUTOMATION> Running Job ID 3, Name of job 3 SERVER-1 Aug 05, 2010 12:58:59:132 1235 <SYSTEM/AUTOMATION> Running Job ID 2, Name of job 4 Per Lowell's suggestions, I have tried the following permutations for the time format of my sourcetype in the local props.conf file with no improvement... TIME_FORMAT = %b %d, %Y"\t"%H:%M:%S:%3N TIME_FORMAT = %b %d, %Y\t%H:%M:%S:%3N TIME_FORMAT = %b %d, %Y %H:%M:%S:%3N TIME_FORMAT = %b %d, %Y %H:%M:%S:%3N TIME_FORMAT = %b %d, %Y"\t"%H:%M:%S:%Q TIME_FORMAT = %b %d, %Y\t%H:%M:%S:%Q TIME_FORMAT = %b %d, %Y %H:%M:%S:%Q TIME_FORMAT = %b %d, %Y %H:%M:%S:%Q It's hard to see, but the third and seventh lines have a literal tab between the year and hour, and the fourth and eighth line have a space between the year and hour. ... View more