Right... I didn't check so far in the documentation and it's a new construct/feature to me. ... View more

The error message is misleading, in my view. I tried this in Splunk 6.5.9 and received the same error message. However, the difference is that Splunk 6.5.9 doesn't have the snap-to as a feature for timechart, but according to the doc 6.6.3, should have it. (Original answer converted to a comment and edited entirely. I assumed that 1w@w would be the correct snap-to in 6.6.3, but I was corrected.) ... View more

Can you telnet to port 9996? Afaik, disabled does not need to be set. The valid values are 0 or 1, so remove or comment out that line. I'm just guessing that "none" is non-zero, so it might actually disable the input. However, you say that the port is shown as enabled... ... View more

Hi jeevankumarg, As was already suggested, I think you need to start from combining the data using the transaction command. I had a look at your picture, but it wasn't entirely clear what sort of data you already have in your index. I'm assuming that you already have the data in the top of your picture? So, I suppose you could go along with something like: ...| transaction SrcFileName TgtFileName |eval LastStatus=mvindex(Status,-1) |eval LastEndDateTime=mvindex(EndDateTime,-1) |eval LastExecutionStep=mvindex(ExecutionStep,-1) |eval LastDestinationServer=mvindex(DestinationServer,-1) |rename LastStatus as Status |rename LasteEndDateTime as EndDateTime |rename LastExecutionStep as ExeceutionStep |rename LastDestinationServer as DestinationServer |table BusinessObject, SrcFileName, SourceServer, DestinationServer, Environment, ExecutionStep, Status, TgtFileName, StartDateTime, EndDateTime The idea here is that within the transaction, the eval-command mvindex gets you the last value for that particular field, as transaction creates a multi-value field for fields that do not have identical values across the transaction. (If there is only one value, the field will not be multi-value, unless you give the option mvlist=true to transaction .) Hope this helps you or at least gives you some idea for a solution. ... View more

It's a bit confusing when you combine the words "predict" and "past" in that way, but I assume you try to predict the future from the past. I can't give you a complete solution as I don't know the base search, but have you considered these options? 1) calculate the standard deviation using stdev , constant values should have stdev=0. 2) calculate the min and the max for the value. If they are the same, the value hasn't changed. ... View more

The correct command for this would be appendpipe . Say you have something like: ...|stats sum(score) AS totalscore by item . Then you can do this: ...|appendpipe [stats avg(totalscore) AS totalscore |eval item="AVERAGE"] . (You need to use AS in appendpipe in order to put the average in the same column. You can leave item empt, if you want.) ... View more

Is rec_type numeric? Because, you're comparing it to the string "400" . Remove the quotes and you should be fine. To be extra sure, you could use tonumber() to convert. if(rec_type=400, "network", null) OR if that doesn't work: if(tonumber(rec_type)=400 , "network", null) ... View more

Yep, you're quite right. Actually, the thought occurred to me, so I copied the files to the relevant servers and did an |extract reload=T as per the documentation. However, it seems this doesn't take effect without a full restart. It works as expected after a restart. Thanks! ... View more

Hi, Do you have a problem with reinstalling splunk? I would very much recommend against moving it after installing with rpm, because rpm may get confused. If you can reinstall, rpm takes an option, --prefix , which you can use to specify the location of the install directory. I'm not that familiar with rpm, so not sure if you can use the following directly to upgrade/reinstall, but at least it works if you remove splunk first. rpm -Uvh --prefix=/custom/location /path-to-rpm/splunk-6.6.2-4b804538c686-linux-2.6-x86_64.rpm Note, that you need to specify the --prefix also when upgrading. If you can't reinstall, but have to move, then perhaps you can try changing the SPLUNK_HOME in etc/splunk-launch.conf . SPLUNK_HOME=/custom/location ... View more

I was struggling with this too. Based on thejohn's comment above, it's clear that splunkweb is slow to start when it can't reach the update URL, e.g. when behind a corporate firewall and not using a proxy. The solution by thejohn works, but if you have a coroporate proxy, you can also get this working by setting the https_proxy environment variable. This will allow splunk to perform the normal update checks. Apparently you can't disable this in web.conf... I reduced my startup time from 5 minutes (sic) to 5 seconds by putting this in my splunk user's .bash_profile: export https_proxy=https://proxy.corporation.com:8080 On a server which doesn't have access to the proxy, I just put the following in my splunk-launch.conf : QUICKDRAW_URL=0 ... View more

Thanks, thejohn. I suggest you change your comment to an answer. ... View more

Thanks, but as far as I can tell, I've done what you suggested. TZ has been set and the forwarders restarted. Still, the time in Splunk remains the same time as in the file(s) ... View more

Well, head restricts the number of results to the number you specify and Splunk discards the rest, so after receiving say 100 events, Splunk knows it doesn't have to look for more. head shows the newest N events it encounters. (In the specified time frame.) There is also a tail command that will give you the oldest N events. The tail command is therefore slower, since it has to churn through the entire result set first. ... View more

See the comment I added to my original answer/ ... View more

In your example, if you need stats , you would want to do this: index=firewall TERM(src=10.0.0.1) OR TERM(src=10.0.0.2) TERM(dst=10.0.0.3) TERM(port=12345) | head 1 |stats latest(_time) ... View more

If you don't know when the last event is, then head will help you. Apparently your milage varies quite a bit, but for me head seems to terminate the search very efficiently. I'm also searching over a "All time" in a huge index, but with head it ends within a second. Did you see that you need to use head before you use stats . In fact, I left out stats completely in my answer. ... View more

I'm afraid I don't have the option of setting the TZ host-wise, because of the reasons outlined above. ... View more

I wonder if you should specify the span too. I don't know how the default span is chosen, but for a month, it is normally 1 day in my experience, but perhaps you want to try and set it? If the span chosen by default is longer than 1 day, the timechart normally visualizes this with the first date and/or time. host=myComputer-* index=index "KeyPhrase" success=True NOT (Content=Test1 OR Content=Test2) Crm=myRequest|timechart span=1d count ... View more

Had to check. tonumber() won't work without trim() , so your solution seems the best. ... View more