This worked for me. Thanks! ... View more

I too have the same issues after upgrading from 6.2.5 (w/SHC enabled) to 6.3, and was hoping to spur some thoughts by sharing how I am able to reproduce it... It doesn't matter which browser I choose, but adding the domain name to my host in the URL seems to cause the issues noted (missing icons, menus). When I remove domain, it magically works. https://splunk (works perfectly) https://splunk. (missing icons, menus) ... View more

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf ----Syslog output---- maxEventSize = * If specified, sets the maximum size of an event that splunk will transmit. * All events excedding this size will be truncated. * Defaults to 1024 bytes. ... View more

I'm not sure I understand the reporting you're looking to present. Your search is just looking for data over the past 15 minutes, yet you're presenting a table that shows concurrent sessions by minute over the previous hour. I would think you'd want the reporting period in the table to match the time period for the search. Using a transaction may be unnecessary since the STOP record has the fields you need to determine duration. Here's a search you can use with an explanation on search variables and functions: sourcetype=Sonus Site=oma10 Ingress_TG_Name=ATT_0007* STOP earliest=-15m | strcat Start_Date " " Start_Time start | strcat Disconnect_Date " " Disconnect_Time end | convert auto(start) as start_time_secs | convert auto(end) as end_time_secs | eval start_time_secs=round(start_time_secs,0) | eval end_time_secs=round(end_time_secs,0) | eval dur=end_time_secs-start_time_secs | concurrency duration=dur start=start_time_secs | timechart span=1m max(concurrency) as "Concurrent Sessions" 1.) Base search: sourcetype=Sonus Site=oma10 Ingress_TG_Name=ATT_0007* CDR_Type=STOP earliest=-15m 2a.) Concatenate values in "Start_Date" and "Start_Time" fields and call the new field "start" | strcat Start_Date " " Start_Time start 2b.) Concatenate the "Disconnect_Date" and "Disconnect_Time" fields and call the new field "end" | strcat Disconnect_Date " " Disconnect_Time end 3a.) Convert the "start" field to epoch seconds and call the resulting field "start_time_secs" | convert auto(start) as start_time_secs 3b.) Convert the same with the "end" field and call the resulting field "end_time_secs": | convert auto(end) as end_time_secs 4a.) Since the values in the "start_time_secs" field are in deciseconds, round to the nearest second: | eval start_time_secs=round(start_time_secs,0) 4b.) Since the values in the "end_time_secs" field are in deciseconds, round to the nearest second: | eval end_time_secs=round(end_time_secs,0) 5.) Subtract the "start_time_secs" from the "end_time_secs" and call the resulting field "dur": | eval dur=end_time_secs-start_time_secs 6.) Use the concurrency command to calculate concurrency per second based on "dur": | concurrency duration=dur start=start_time_secs 7.) Chart it to present peak concurrent sessions per minute, with 1-second granularity, over the past 15 minutes: | timechart span=1m max(concurrency) as "Concurrent Sessions" *** NOTE: You can simplify this a bit by using just the "Start_Date" + "Start_Time" + "Call_Duration" fields to determine duration if you do not want to include set-up and tear down of the sessions. ... View more

Thanks, but this isn't quite the answer I was looking for so let me rephrase... How can I customize my LWF configuration to perform a couple of the regular forwarder duties? Need to transform data to route events to 2 systems Need to send data in syslog format via UDP to a 3rd party Do I need to enable certain modules in $SPLUNK_HOME/etc/apps/SplunkLightForwarder/default/default-mode.conf?: [pipeline:udp] [pipeline:syslogfifo] [pipeline:syslogudp] Would it be better to run reg. forwarder and disable what I don't need? The goal is to have min. impact on system performance. ... View more