Hi Friends, Anyone can help me on this topic. I'm struck with this point last 2 weeks.  I appreciate your feedback and commends  ... View more

Hi @richgalloway  My need is:  Whenever my configured HF1 went down it needs to apply failover and another HF2 needs to receive the data from UF's.  How to achieve this? Kindly share what I need to mention in output.cong file in UF server.  It should not failover the HF after certain time period or some amount of data received.  It should failover only current HF1 went down.  Thanks in advance for your suggestions. ... View more

Hi Friends, My need is:  Whenever my configured HF went down it needs to apply failover and another HF needs to receive the data from UF's.  How to achieve this? Kindly share what I need to mention in output.cong file in UF server.  It should not failover the HF after certain time period or some amount of data received.  It should failover only current HF went down.  Thanks in advance for your suggestions.    ... View more

Hi @richgalloway  Thanks for your suggestion.  I want to understand clearly  like if we mention 2 different HF names in each UF server.  Which situation UF will send data to which HF? Example. I have configured HF1 & HF2 in all UF. If  HF1 went down then it route to HF2 to send data or both HF's active, UF will send data first 1 hour to HF1 then it will send to HF2.  How it will work?  Thanks in advance for your response.  ... View more

Hi @shivanshu1593 , Thanks for your response.  Could you please confirm one more point like Splunk add-on for Microsoft cloud services and Splunk add-on for Microsoft SQL server both are same add-on?   In our HF we have installed both add-on. When ever I open Splunk add-on for Microsoft SQL server it shows Input & Configuration content which I configured in Splunk add-on for Microsoft cloud services.   ... View more

Hi @PickleRick  Thank you so much for your detailed explanation. It works for me.    ... View more

Hi @PickleRick ,   I have applied your suggestion like below: index=pg_idx_whse_snow sourcetype="snow:incident" source="https://pgglobalenterpriseuat.service-now.com/" | where incident_state_name!="Closed" | rex field=dv_short_description "^[^\-]+\-(?<Host>[^\-]+)" | rex field=dv_short_description "^[^\-]+\:(?<extracted_field>[^\-]+)" | rename Host as host |table host incident_state_name |append [|search index="pg_idx_whse_prod_events" sourcetype IN ("cpu_mpstat") host="adlg*" earliest=-15m | streamstats time_window=15m avg(cpu_idle) as Idle count by host | eval Idle = if(count < 30,null,round(Idle, 2)) | WHERE(Idle >= 90) | table host ] | stats values(host) by incident_state_name   But I got result like below: ncident_state_name  host New                                     host1                                                host2                                                 host3   But this is not my expected result.  My expect result is search1 have host1 host2 host3  & search 2 have host1 host2 then my result is only host3.  Kindly assist on this. @richgalloway  @gcusello  ... View more

HI @PickleRick , Thank you so much for your prompt reply and valuable suggestion.  I'm new to Splunk tool. I'm learning from my errors.  I have accepted your points and corrected my 2nd query.  index=pg_idx_whse_snow sourcetype="snow:incident" source="https://pgglobalenterpriseuat.service-now.com/" | where incident_state_name!="Closed" | rex field=dv_short_description "^[^\-]+\-(?<Host>[^\-]+)" |table Host incident_state_name Could you please help me how to implement in my query  your 2nd suggestion: 2. Append one search to another, do stats values() over hosts and filter by the incident_state_name (or by (not)existence of this field). Should be more efficient than solution 1, prone to subsearch problems with appended search. Thanks in advance.  ... View more

@richgalloway  Sorry to updated in the older question.   Thanks for your response.  My last question. If we just mention sourcetype in input.conf  is not enough? I should to mention the same sourcetype again in props.conf ?   Thanks in advance.  ... View more

Hi @richgalloway  In my case, more volume of data produced from Learned app. Is there any possibility to disable this app: learned?  If we can't disable how to stop generate logs from this app: learned ? Your response is much appreciated.  Regards, Jagadeesh @gcusello @ITWhisperer  ... View more

Hi @gcusello , While I use this search : index="pg_idx_whse_prod_events" source=server sourcetype=cpucore_mpstat | kvform field=CPU field="%idle"   I'm getting below error :  Error in 'SearchProcessor': Option 'field' should not be specified more than once.   My expected results should be:  Time CPU core %Idle 05:57:31  PM all 95.37 05:57:31  PM 0 96.25 05:57:31  PM 1 95.54 05:57:31  PM 2 96.20 05:57:31  PM 3 95.14   Some host have 8 core so we will get 0,1,2,3,..7 rows,  Some host have 32 core so we will get all, 0, 1,2,3,....30,31 rows Please help me how to achieve this. Thanks in advance.  ... View more

@gcusello , Thanks for your suggestion. Its not working for me.  Now my event is like below:  Linux 3.10.0-1160.80.1.el7.x86_64 (aelg3.eu.pg.com) 05:57:31  PM  CPU  %idle 05:57:31  PM  all  95.37 05:57:31  PM  0  96.25 05:57:31  PM  1  95.54 05:57:31  PM  2  96.20 05:57:31  PM  3  95.14 05:57:31  PM  4  93.33 05:57:31  PM  5  95.74   Could you please suggest how to use regex and get column name and all values as output to display in dashboard?  Thanks in advance.  ... View more

Hi @yuanliu , Thanks for the reply.  In our project we have only one search head. I'm not sure how to measure the capability of our SH to run multisearch command.  Currently I'm getting exact results which I want. If I use multisearch command it impact our application performance?  Thanks in advance.  ... View more

@yuanliu, Thank you so much. Its working perfect. I have made it with multisearch command. Kindly review and confirm which one I need to use it? Multisearch or Foreach ? | multisearch [search index = pg_idx_whse_prod_events sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS MarkSweep__collection-count.csv" | rename value as value1] [search index = pg_idx_whse_prod_events sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS MarkSweep__total-time-ms.csv" | rename value as value2] [search index = pg_idx_whse_prod_events sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS Scavenge__collection-count.csv" | rename value as value3] [search index = pg_idx_whse_prod_events sourcetype= PG_ST_PROBE_DATA source="/opt/redprairie/prod/prodwms/les/data/csv_probe_data/com.redprairie.mad/JVM-Garbage-Collectors__PS Scavenge__total-time-ms.csv" | rename value as value4 ] | stats latest(value1) as "PS Marksweep Collection Count" latest(value2) as "PS Marksweep Total Time ms" latest(value3) as "PS Scavenge Collection Count" latest(value4) as "PS Scavenge Total Time ms" by host |lookup PG_WHSE_PrIME_TS Server AS host |table Site_Name host "PS Marksweep Collection Count" "PS Marksweep Total Time ms" "PS Scavenge Collection Count" "PS Scavenge Total Time ms" | rename host as Server ... View more