Hi We have weird behavior, in the Data Summary Screen on the Search Head, we see a Host reporting events, when clic on the host searching for the details, the Search Head shows 0 results This is happening only with 1 host, other hosts from the same index and same sourcetype didn't present the same issue. Any Ideas? ... View more

Hi I have a log like this Mar 10 20:19:39 10.18.10.11 Mar 10 2016 20:18:07 HIPDR-M909-X8-CA %%01SHELL/5/CMDRECORD(s)[37105]:Recorded command information. (Task=VT1, Ip=10.2.11.10, VpnName=O_G, User=65w, AuthenticationMethod="Local-user", Command="ping -c 100 -vpn-instance DAT 1.23.30") I have a Field extraction in search mode: sourcetype="huawei" | rex field=_raw "\%\%\d{2}(?<sig>\w+\/\d+\/\w+)\(" So if I want to search like this sourcetype="huawei" | rex field=_raw "\%\%\d{2}(?<sig>\w+\/\d+\/\w+)\("| search sig="SHELL/5/CMDRECORD" Works like charm But if I save the extraction in Fields Extractions, all the permissions are global, we restart splunk several times and do the extract reload=true So when I do the search: sourcetype="huawei" sig="SHELL/5/CMDRECORD" Shows 0 Results Any Idea what could be happening? ... View more

Hello I'm trying to install Splunk Mobile Server on my Stand Alone Splunk server, but once it is unzipped, trying to start the service I get this error: /opt/mserver# sh server.sh start starting data service... it might take up to couple minutes /opt/mserver/server/node_modules/co/index.js:292 throw err; ^ Error: data service failed to startup, output:about to fork child process, waiting until server is ready for connections. forked process: 6505 ERROR: child process failed, exited with error number 14 at MongoDaemon.start (/opt/mserver/server/lib/bundlemgr/mongo_linux.js:16:13) at GeneratorFunctionPrototype.next (native) at next (/opt/mserver/server/node_modules/co/index.js:74:21) at /opt/mserver/server/node_modules/co/index.js:93:18 at Immediate._onImmediate (/opt/mserver/server/node_modules/co/index.js:52:14) at processImmediate [as _immediateCallback] (timers.js:374:17) Any Ideas what could be happening? Context Server Ubuntu Trusty Updated Splunk Enterprise 6.2 Updated Mserver downloaded: mserver-linux-release-2.0.1.tgz Regards ... View more

Hi I have a dataset with Time, by Day-Month-Year and a Integer value per day, something like this _time mxo 30-01-2010 6 30-01-2011 8 30-01-2012 3 30-01-2013 5 30-01-2014 9 I want to make some timechart comparing by month over the years, like comparing 2 or more years of maximum number My first approach was using Timewrap with something like this host="smo*" earliest=-12m@y latest=-1m@m |timechart span=1Month max(mxo) | timewrap y But seems out of range or something wrong External search command 'timewrap' returned error code 255. Script output = "ERROR "'timeunit' argument required, such as d, w, 2m, q, y" " Maybe someone have a better and working solution, ... View more