Hi everyone I have this field: File_Size="File size (bytes): [byte_size]" , where byte_size is nr; e.g File_Size="File size (bytes): 14642"... and I want to convert it to MB Can anyone help me on this? Thank you ... View more

Hi everyone, I want to correlate data between windows and oracle. Each user can logon on only one pc in the company. First, a user has to logon on Windows eventcode 4624, sourcetype=wineventlog:security, source_network_address=192... ... ....! after user opens an application which gathers info from an oracle db. lets say this oracle db has sourcetype=my_appDB, which has terminalID, userID, functionID. so, in a normal activity source_network_address (from windows) must be equal with terminalID (from oracle), otherwise i have to create an alert. can anyone help me on this? many thanks ... View more

hi all, after installing splunk universal forwarder on linux machine RHEL i have this message after ./splunk list forward-server : Active forwards: None Configured but inactive forwards: x.x.x.x:9997 but i checked firewall and it is ok. Connection to x.x.x.x 9997 port [tcp/palace-6] succeeded! But logs are not going on splunk server universalforwarder version: splunkforwarder-6.1.4-233537-linux-2.6-x86_64.rpm what might be the problem? thanks ... View more

Hi splunkers, i have a problem with CiscoIPS application. i cant collect logs. the connection is but the logs not. Splunk version Splunk 6.0.3 (build 204106) Search: index="_internal" sourcetype="sdee_connection" Message: 5/23/14 10:17:03.000 AM Fri May 23 10:17:03 2014 - ERROR - Exception thrown in sdee.get(): URLError: <urlopen error [Errno 8] _ssl.c:521: EOF occurred in violation of protocol> host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 7 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - INFO - Successfully connected to: 192.168.x.x host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 8 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - INFO - Attempting to connect to sensor: 192.168.x.x host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 9 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - INFO - SubscriptionID: sub-1-393c8920 found for host: 192.168.x.x host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 10 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - INFO - Checking for exsisting SubscriptionID on host: 192.168.x.x host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 11 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - ERROR - Attempting to re-connect to the sensor: 192.168.x.x host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options 12 » 5/23/14 10:16:59.000 AM Fri May 23 10:16:59 2014 - ERROR - Exception thrown in sdee.get(): URLError: <urlopen error [Errno 8] _ssl.c:521: EOF occurred in violation of protocol> host=splunk Options| sourcetype=sdee_connection Options| source=/opt/splunk/var/log/splunk/sdee_get.log Options any idea ???? Thanks ... View more

Hello there ! Can anyone tell how can i find storage/space used on splunk for specific server (e.g Windows AD or Exchange server etc)??? Thanks ... View more

hello, can anyone help me with index backup? i want do make the script. ... View more