Hello, I've used the view.py hack in a previous version of Splunk to populate my drop-downs with more than 500 results. This appears to no longer work in version 6.4+. Anyone else experience this? Any suggestions? Ref: https://answers.splunk.com/answers/349973/splunk-not-displaying-all-my-saved-searches-in-the.html ... View more

Need some advice on a search. I have a logfile that clearly states starting and finishing tasks for each of the Batch Process jobs that run. There are ~70 different batch process jobs which are clearly displayed in each event *(bold in my examples below) * that need to be checked to ensure they start and finish properly. 2016/04/13 16:52:44.740 INFO s-------- Batch Process 'ScheduleBillingPayment_ThreadedTrigger' starting 2016/04/13 16:55:42.539 INFO s-------- Batch Process 'SchedulBillingPayment_ThreadedTrigger' finished Does anyone have an idea of how i can detect when any job doesn't successfully start and finish within a rolling 7 minute window? I was thinking about using the |transaction command and searching the field_match_sum field, but I'm not sure it will be reliable enough. Here is what I am working with, but may be way off: sourcetype=batchprocesses Batch Process starting OR finished | rex "Batch\sProcess\s\'(?\w+)\'\s(?\w+)" | transaction Trigger startswith=starting endswith=finished | table Trigger, Status, duration Thoughts? Suggestions? Thanks! Jeremy ... View more

I have an audit request to show the last time a report was modified. Thanks, Jeremy ... View more

To group and organize "Searches and reports" we modify defaults.xml in the Navigation Menus. Can the same be done to organize "Dashboards and Views". If so, could you please provide me an example or reference? I tried adding code below under "Dashboards and Views" but it ended up pulling the searches and reports but not the dashboards. Ex: <collection label="SOC"> <saved source="unclassified" match="SOC" /> </collection> <collection label="Threat"> <saved source="unclassified" match="Threat" /> </collection> Thanks! ... View more

Hello, I am looking to add two additional fields to the results of my search. (Account_Name) and (Workstation_Name). I'm unsure how to add them since the timechart seems to be limiting what fields are available. Here is the search I have now: index=domaincontrollers sourcetype="WinEventLog:Security" accountname | eval time=_time| timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time"|convert timeformat="%m/%d/%y %H:%M:%S" ctime(*) Results: _time Logon Time Logoff Time 2014-08-26 08/26/14 06:20:33 08/26/14 15:04:22 2014-08-27 08/27/14 06:42:43 08/27/14 11:37:59 Thanks! ... View more

We are looking to add a "Rising Column" to one of our zOS DB2 databases to allow Splunk dbtail to work properly. Does anyone know if Splunk can handle the "Rising Column" identity being set to BIGINT? My DBA prefers using BIGINT vs INTEGER due to the 2 Billion plus rows we expect. Any insight will be greatly appreciated! Thanks ... View more

Hello, We are using an F5-Bigip load balancer to host splunk.company.com for a pool of search heads. Our internet services team is looking for a way to perform a health check on each pool member. Normally, they place a small html file in the document root and have the load balancer read it periodically. Has anyone had Splunk experience with this? Does anyone have any better idea for a health-check? Also where is the web server "document root" in Splunk? We are running our servers on Linux. Thanks! ... View more

My webserver logs are sent to my indexers through a Universal Forwarder. *Snippet from inputs.conf on the Universal Forwarder [monitor:///path/to/apache/2.2/web/.../logs/*access_log] disabled = false sourcetype = access_combined index = internet followTail=0 With this configuration, we properly set the following fields index = internet, host = unixservername, sourcetype = access_combined The problem is, we need a field with the webserver name in segment 6 of the source: /path/to/apache/2.2/web/.../logs/*access_log We tried adding host_segment = 6 to the forwarder stanzas, but then we lose our true "host = unixservername" which is also necessary. Unfortunately, this information is NOT available anywhere but the source field. So.... We can easily create a search time |rex for Splunk to process to pull the information: |rex field=source "\/path\/to\/apache\/[0-9].[0-9]\/\w+\/(? .*?)\/" This works well... however, I don't want my users to have to run this every time they search. I would like the ability to add this as a Index time or Search time extraction through props and transforms -- preferably at the forwarder or indexer level. Any suggestions? Thanks for your help, ideas, and input! I'm stuck... Jeremy ... View more