Hi Splunkers, I am sure I've seen this before, but cannot remember. In the cluster of 3 indexers and replication factor of 3 I am trying to determine which indexer receives an event, which field can I use to indicate that? Essentially I would like to output a graph with count by indexer/host etc. Thank you! ... View more

Hi Splunkers, Haven't seen this message prior to 6.5 update, but now splunkd.log is full of it. Any idea why it might be happening? 11-17-2016 14:52:08.837 -0800 WARN IniFile - C:\Program Files\Splunk\var\run\searchpeers\bpsplunk-mstr-1479423126\apps\splunk_monitoring_console\metadata\local.meta, line 13: Cannot parse into key-value pair: 11-17-2016 14:52:08.841 -0800 WARN IniFile - C:\Program Files\Splunk\var\run\searchpeers\bpsplunk-mstr-1479423126\apps\learned\metadata\local.meta, line 17: Cannot parse into key-value pair: 11-17-2016 14:52:19.555 -0800 ERROR UserManagerPro - Could not get info for non-existent user="username" 1 ... View more

After switching to Search Head cluster some of our team members are having hard time adjusting to the 'deployment of the searches, alerts and dashboards' idea and modify those searches directly through web GUI which results in local delta of the objects stored on the cluster member and future deployment of the updated objects is being overwritten by those local copies. Example: - I have an HTML dashboard that references "Saved Search A" deployed to the cluster on the deployment server. - Deployed configs to the cluster members - Changes have been made to that dashboard via GUI referencing "Saved Search B" - For the next deployment I reference "Saved Search C", but it is being ignored as the local copy references B How do you go around "sanitizing" those local changes to override the local copies? Thanks! ... View more

Hi Splunkers I have set up a Search Head Cluster with Splunk 6.4 and ran into some challenges. Trying to send an email when alert is triggered, but it fails to send. Getting "Unexpected EOF" error. Tried 'Schedule PDF Delivery' of a dashboard, and got same "Unexpected EOF" Sending the test email failed: command="sendemail", (-1, 'Unexpected EOF') while sending mail to: antet@email.com From the Python Log: 2016-04-08 04:50:28,569 Pacific Daylight Time ERROR sendemail:127 - Sending email. subject="Stream error", results_link="http://**********:8800/app/opsalerts/@go?sid=scheduler__nobody__opsalerts__RMD5fb2ac14e7d33a13c_at_1460116200_3229_41D114D1-64B8-499E-A79C-EADED06D3A6F", recipients="[u'email@example.com']", server="99.99.99.99" 2016-04-08 04:50:28,571 Pacific Daylight Time ERROR sendemail:392 - (-1, 'Unexpected EOF') while sending mail to: email@example.com Any help or a hint where to look would be appreciated! Thanks ... View more

Hi fellow Splunkers I am trying to calculate a percentage of users whose download times were above average and create timechart from it. I might be going in completely wrong direction, but I hit the wall and need help. So far I have: 'search string goes here' event_name=video_heartbeat | timechart dc(user_id) as TotalUsers stdevp(chunk_load_time_ms) AS StDev avg(chunk_load_time_ms) AS Average | eval StdevTop = StDev + Average I now have total number of users and top value. I now need to find percentage of users who has chunk_load_time_ms value higher than StDevTop Thank you ... View more

Is it just me or Splunk 6.2 login page does not behave well in Safari 8.0? I've updated Splunk and now cannot login using saved credentials in Safari 8.0 (OS X 10.10) When selecting saved login information, login page throws "Invalid username or password." message without ever checking credentials. I tried manually typing it in and it works. Thanks ... View more

Hi Splunkers, I have a number of log files which do not have key:value structure to them. How do I map those values to custom fields? Here is an example: 2014-09-07 18:57:10 111.123.127.117 GET /url_value_goes_here/7185520.ts 200 6971895 2425 "-" "Player/12.00.13411.0000 WMFSDK/12.00.13411.0000" "-" Fields should be this: date time cs-ip cs-method cs-uri sc-status sc-bytes time-taken cs(Referer) cs(User-Agent) cs(Cookie) Thank you! ... View more