Hi there, i run into a problem with the new Distributed Management Console. When i change to the Ditributed Mode in the Setup view, i get the following Error Message: Duplicate instance name. Ensure each instance has a unique instance (host) name. Instance (host)--------Instance (serverName)----------Machine steve.xxxx.de----------bill.xxxx.de--------------------------bill.xxxx.de steve.xxxx.de----------mike.xxxx.de--------------------------mike.xxxx.de So steve is the ClusterMaster and the two Nodes are bill and mike. I have no idea where my mistake is. Hope anyone can give me a hint. Thanks Regards, Sven ... View more

Hi community, propably a simple question, but I still hanging. I need a search over two logfiles, which shows me all users listed in both logs. Example: LogA TIME, USER, GROUP 14.10.2014 14:03:45, user=Adam, group=alpha 14.10.2014 14:03:35, user=Bert, group=alpha 14.10.2014 14:03:25, user=Conny, group=alpha 14.10.2014 14:03:15, user=Norman, group=beta 14.10.2014 14:03:05, user=Fred, group=beta 14.10.2014 14:02:55, user=John, group=alpha 14.10.2014 14:02:45, user=Steve, group=beta 14.10.2014 14:02:35, user=Bob, group=alpha LogB TIME, USER, DEP 14.10.2014 13:03:45, user=Adam, dep=sales 14.10.2014 13:03:35, user=Gregor, dep=sales 14.10.2014 12:03:25, user=Conny, dep=sales 14.10.2014 13:03:15, user=Jeff, dep=marketing 14.10.2014 12:03:05, user=Fred, dep=marketing 14.10.2014 13:02:55, user=Paul, dep=marketing 14.10.2014 13:02:45, user=Steve, dep=sales 14.10.2014 13:02:35, user=Rod, dep=sales Now show me all Users which are in LogB and in LogA. (Adam, Conny, Fred, Steve) Surely a simple search, so sorry for this question. 🙂 Thanks a lot Cheers, Sven ... View more

Hello, still trying to get the nmon App running. The AIX Server is collecting all nmon-Files one one server, on which also is installed the Universal Forwarder. /opt/splunkforwarder/etc/apps/TA-nmon/local/inputs.conf [monitor:///opt/nmon/nmon_collect//nmon] disabled = false index = nmon sourcetype = nmon_processing crcSalt = host_segment = 4 [batch:///opt/splunkforwarder/etc/apps/TA-nmon/var/csv_repository/*nmon .csv] disabled = false move_policy = sinkhole recursive = false crcSalt = index = nmon sourcetype = nmon_data source = nmon_data [batch:///opt/splunkforwarder/etc/apps/TA-nmon/var/config_repository/nmon.csv] disabled = false move_policy = sinkhole recursive = false crcSalt = index = nmon sourcetype = nmon_config source = nmon_config [script://./bin/nmon_helper.sh] disabled = false index = nmon interval = 60 source = nmon_collect sourcetype = nmon_collect /opt/splunkforwarder/etc/apps/TA-nmon/local/props.conf [source::/opt/nmon/nmon_collect//nmon] invalid_cause = archive unarchive_cmd = /opt/splunkforwarder/etc/apps/TA-nmon/bin/nmon2csv.pl sourcetype = nmon_processing NO_BINARY_CHECK = true [nmon_data] FIELD_DELIMITER=, FIELD_QUOTE=" HEADER_FIELD_LINE_NUMBER=1 INDEXED_EXTRACTIONS=csv NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIMESTAMP_FIELDS=ZZZZ TIME_FORMAT=%d-%m-%Y %H:%M:%S KV_MODE=none pulldown_type=true [nmon_processing] EXTRACT-cksum = (?i) .?: (?P \d+) TIME_FORMAT=%Y-%m-%d %H:%M:%S [nmon_config] BREAK_ONLY_BEFORE=CONFIG, MAX_EVENTS=10000 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true TIME_FORMAT=%d-%b-%Y:%H:%M TIME_PREFIX=CONFIG, TRUNCATE=0 The Problem is, that only the nmon Files from the localhost, on which the forwarder is running, are converted to csv-Files. I tried *, //, /.../ for the wildcard function but allways the same problem. If i changed the path and set on servername instead of the wildcard, the nmon files from this server will be converted. The path looks like this: /opt/nmon/nmon_collect/SERVERNAME/ Can someone help me to find out the mistake? Thanks Cheers Sven ... View more

Hello, is there any solution to get the nmon data from the aix / linux servers an send them to a dedicated universal forwarder without a forwarder on every server? Thanks Cheers, Sven ... View more

Hi there, I know the docs and the search function in answers.splunk.com. But I think I sit on the line. Hope someone can get me in the right direction or can help me with my problem. I want to log emails and with all the header in the mail I just want to index a part of the mail. Here is an example of a similar mail. I just want the part from "Object: Sensor A" till "Time: 2013-01-27 11:58:23" and push the rest to the Null-Queue. Thanks a lot Cheers, Sven ################################## Content-Type: multipart/alternative; boundary=Apple-Mail-3A77049A-4A01-443F-B1DB-C1AA16C7497D Content-Transfer-Encoding: 7bit Subject: blablablablabla From: Doc Snider blablabla@blablabl.de Message-Id: 92D35476-1711-4B3451-A4B5-8D14534351E@gmail.com Date: Mon, 27 Jan 2014 11:30:57 +0100 To: doc@blablabla.de Mime-Version: 1.0 (1.0) X-Mailer: iPhone Mail (11A501) --Apple-Mail-3A77049A-4A01-443F-B1DB-C1AA16C7497D Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Here are the infos Object: Sensor A Temperature: 42 Humidity: 32 Time: 2013-01-27 11:58:23 here is more uninteresting text. blablablablablabla ############################################ ... View more

Hi there, is it possible to define different min- and max-values for the Y-Axis in a Multi-series Mode chart? Using splunk version 6. Thanks Cheers, Sven ... View more