Hi, I know this has been done to death several times, but my take on the issue is slightly different. I have the following search that works. index=platform_logs sourcetype=UpdateLog earliest=@d latest=now "Download completed successfully" | eval ReportKey="Today" | append [search index=platform_logs sourcetype=UpdateLog earliest=-1d@d latest=-1d "Download completed successfully" | eval ReportKey="Yesterday"] | stats count by ReportKey It gives me a nice table showing the number of successful downloads "today" compared to "yesterday" at the time the search is run. This way I can see if these particular downloads are tracking correctly. However, If I configure this search as a dashboard it seems to hard code the earliest and latest within the code and it only every displays me the result for "Today" I saved this as a dashboard so I could pull the code out for another app I am writing and the logic was as follows: <table> <title>Feed Download : Today vs Yesterday</title> <searchString>index=platform_logs sourcetype=UpdateLog earliest=@d latest=now "Download completed successfully" | eval ReportKey="Today" | append [search index=platform_logs sourcetype=UpdateLog earliest=-1d@d latest=-1d "Download completed successfully" | eval ReportKey="Yesterday"] | stats count by ReportKey</searchString> <earliestTime>1393758000</earliestTime> <latestTime>1393844400</latestTime> </table> The dashboard works ... but if I pull the code into a different app/dashboard it doesn't. If I replace the and tags with and I still only get the results from Today. My other option would be to split these into two different dashboard elements, but then I would not be able to do any further logic of alerting if there is a difference between the two results Cheers, C. ... View more

Hi, I am interested in installing your app as we run both nagios and splunk. However, we run splunk on Windows 2008 R2 Server and use the Nagiosxi CentOS Virtual appliance that they provide. Your configuration instructions suggest that you assume that someone is running both nagios and splunk on the same linux host. Do you have any plans on providing support for such a configuration as ours? eg The app could use puTTY to SSH to the nagios server and pull the information it needs?. Cheers, Conrad. ... View more

Hi, I have a file on a server that i want to index. I have an app that watches this file and indexes it. The file contains an output of server metric data and is essentially in the format of "key = value","key = value" and so on. This file gets overwritten with new data every 60s. Recently I noticed that the some metrics were dropping off, i checked the file and it is complete. but when i check the source in Splunk i can clearly see that it has been truncated. Nothing else on the server has changed. I have checked the logs on the universal forwarder, but I could not see anything that stood out. ideas welcome! C. ... View more

Hi, I have a dashboard that shows me some simple metrics in real-time. These are displayed as a mixture of "single" values and "radialGauges" I have created a special user to use to view this dashboard who has restricted rights. The have rights to this app only and they are a member of their own role. The user_role I created for them is a member of the "users" and "power" users groups. The user_role group has the dashboard app as its default, is limited to 12 concurrent search jobs, 12 concurrent real-time search jobs and is limited to 100mb for jobs disk quota. When I login as my admin user the dashboard runs fine without any errors and the radialgauges appear AOK. When I login as this user and access the dashboard I get an error in red that states: "Search Operation 'gauge' is unknown. You might not have permission to run this program." and the radialGauges do not appear. In my home.xml (the dashboard view) I have gauge configurations similar to: <chart> index="windows_perfmon" host="ps*4sql*" counter="% Processor Time" | stats avg(Value) as CPU | eval CPU=round(CPU,2) | gauge CPU 0 25 75 100 SQL Server CPU Utilisation rt rt radialGauge minimal I am using Splunk 4.3.2 Build 123586. I really don't want to run my dashboard as admin! Anyone have any ideas? Cheers, C. ... View more

Hi, I have following input.conf in an app on my deployment server [Monitor://%product_home%\logs\stdout.log] disabled=0 followtail=0 sourcetype=product_stdout index=product_logs The app deploys to the target server fine, and i also have a forwarding app which also deploys fine (I am also monitoring windows event logs, and these appear in the index no problem, so I know both this and the forwarding app work correctly) However, my stdout.log doesn't seem to be making it into the product_logs index (the index does exist) I have seen mention of accessing https://localhost:8089/services/admin/inputStatus/TailingProcessor%3AFileStatus on the target server, but I get prompted with a login box with no idea what credentials to enter in. likewise if i run the equivalent request from the command line, i get prompted to enter a username and password. after it fails i get a 401 unauthorized error. I have tried various combinations ... [Monitor://$product_home\logs\stdout.log] [Monitor://c:\really long path\in here\logs\stdout.log] [Monitor://%product_home%\logs\stdout.log] To no avail. stdout.log does exist and has content, there are no special permissions on the file and the Splunk agent is running as local system %PRODUCT_HOME% is defined on the target server as a system environment variable, and is in use by other programs, so I know the path is valid. The splunkd.log doesn't appear to have anything useful to tell me other than the app deployed ok. I am sure this must be something incredibly simple that I am missing, but I can't see it for the conf. Halp? ... View more

Hi, I installed and configured the Splunk4JMX but am having issues in getting a connection to my servers via jmx. My servers are configured by the following java_opts -Dcom.sun.management.jmxremote=true -Dcom.sun.management.jmxremote.port=7337 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.password=true jmx usernames and passwords are stored under the JRE and are valid for readonly and control access. I can access the jmx interface locally on one of the tomcat servers using jconsole via :7337 username password but i can't access the jmx interface of the target server from my splunk server using jconsole. the connection attempts for a few seconds and then gives up. we have internal firewalls and the servers are in different zones. A rule to allow the splunk server to connect to the tomcat server over the jmx port has been enabled and tested ok (via telnet). worth noting too that the splunk deployment and data channel are configured the same way with firewall rules, so it doesn't appear to a firewall issue. Prior to the firewall rule being in place the error was: 2012-01-12 09:48:38,658 ERROR [Thread-1] host= , jmxServiceURL=, jmxport=7337, jvmDescription= , processID=0,systemErrorMessage="Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: ; nested exception is: java.net.ConnectException: Connection timed out: connect]" with the firewall rule now inplace the error is": 2012-01-12 12:22:09,879 ERROR [Thread-1] host= , jmxServiceURL=, jmxport=7337, jvmDescription= , processID=0,systemErrorMessage="Connection refused to host: ; nested exception is: java.net.ConnectException: Connection timed out: connect" Can I increase the logging to debug to see if there is any addtional useful information? How would i do this? C. ... View more