Hello, I am trying to write a search query to fetch data from different sourcetype and the common factor in all sorucetype is _time. I'm facing two issues. 1. With below search criteria, the value of field CPU is constant all the time, but the actual value is different. index=indexname host=hostname sourcetype=meminfo earliest=-1d@d latest=@d | table memUsedPct | join type=inner _time [search index=indexname host=hostname sourcetype=cpuinfo | multikv | search CPU=all | eval CPU=100-pctIdle | table CPU]   2. How to show the memUsedPct and CPU in a timechart ? Regards, Karthikeyan ... View more

Hi Team, I am ingesting job logs to SPlunk and below is one of the job log (job ran on 27th June) which was ingested with wrong _time value to SPlunk. Job log: (14.2) 06-27-22 10:31:03 (35312:24804) PRINTFN: 2022.06.25 (14.2) 06-27-22 10:31:10 (35312:24804) JOB: Job <ALERTS_MORNING> is completed successfully. As the job ran on 27th June, the _time value in Splunk is showing as 25th June (hope it is derived from printfn in the logs). The date_mday field under _time is showing as 25 instead of 27. Can someone help in how _time is derived (it is the ingested timestamp, but in this case it was calculated wrongly) and how to dervie correct ingested timestamp. Regards, Karthikeyan.SV ... View more

Hi Experts, I'm new to splunk. I have created a dashboard to which logs are ingested every min and shows how many logs were ingested, as percentage i.e, on hourly basis it calculates the value as total. ingested logs/60.  However, in the drill-down part, I would like to show the actual timing when the logs were not ingested. Let me know if there is a mechanism to achieve this. Regards, Karthikeyan ... View more

Hi Experts, I have installed an application in windows server which uses 3 services(like AAA, BBB, CCC) to measure the availability of the services. I would like to ingest the status of those 3 services to Splunk to showcase/display the availability of the application. I'm using universal forwarder in windows server and also installed Splunk_TA_Windows, but not sure how to filter and ingest only for 3 specific services. Please help in ingesting the data. Regards, Karthikeyan.SV ... View more

Hello Experts, Requirement is to show the no. of jobs started, completed in last 4 hours. I have injested job log files to splunk. From file name, I can derive the job start time and the first line of the job is always "Job xxx started". With this I can count the no. of jobs that started in an hour.  I tried extracting the info by searching the last line of the job log, which is "Job xxx completed successfully" and since there is some delays in data ingestion to Splunk, previous hours data are showing in the table thereby the table shows 5 hours count instead of 4 hrs. Now to identify the no. of jobs that got completed successfully which is started in the hour, I tried to query with AND command, append command unsuccessfully. Criteria is to show the count of the job that got started and completed in a 4 hr time span. I hope we can use AND or subsearch command. Kindly help with this requirement. Regards, Karthikeyan.SV ... View more

Hi Experts, I have a requirement to in which a table is ingested to Splunk. And the table has a field named Time showing timestamp as "YYYY-MM-DD HH:MM:SS:milisec". Data ingestion is happening without any issues. When I tried to show the count of events in a particular day 1. With stats command, the count is is matching with source, but there are times when there is no event happens in source system and that day count is not showing as 0 in Splunk, its just ignored. 2. With time command, Splunk takes the ingested timestamp of the event and not the timestamp in the event, and the count is not matching. Whereas, here when there is no data gets ingested, the count is showing as 0. Please help me with this issue, where the count should be calculated with the field Time and in case if there is no event for a day, that should get displayed as 0. I'm trying to show the data in a bar chart.   Any help is much appreciated. Thanks. Regards, Karthikeyan.SV ... View more

Hi Experts, I have specific requirement to split the contents of a file and ingest it as a separate events. In that events, a filter to be applied and ingest the filtered data to Splunk indexer. I have created a REGEX pattern which split the contents of the file and ingesting the data in to separate events as desired. Now, my issue is with the filtering of ingested data. In each event, I need to filter fro AGGREGATED_EXECUTION and ingest only the event which has that content. I set the configuration as below. props.conf: [expensive_statements] TRANSFORMS-set= send_events   transforms.conf: [send_events] REGEX = AGGREGATED_EXECUTION DEST_KEY = queue FORMAT = indexQueue   Above settings is made on HF. Still the filtering is not happening as expected. Kindly help in resolving the issue with filtering.   Regards, Karthikeyan.SV ... View more

Hi Experts,   I have created a search query to fetch details from Linux log and extracted a timestamp field and converted that with command strftime. Timestamp from Linux log: 1628674387976621 | eval CT_time=strftime(Start_Time/pow(10,6),"%d/%m/%Y %H:%M:%S")  Now I would like to filter the events based on converted time, like From CT_time to CT_time.   Please help with a query to filter with converted timestamp.   Regards, Karthikeyan.SV ... View more