simple and efficient ... View more

With the 2.41 version on 6.6.11 I can't load the postgresql driver. with the 3.13 I can't load DB connect RPC connection OK. Some are saying it's OK with MySQL. It's look like it's spend on the driver you need. ... View more

oh gosh! sorry blush that's works fine 🙂 how can I give you points ? ... View more

thank's a lot for the time spent to share your knowledge. If I good understand no need to split the line to create fields already existing, (I 've only put the raw because it's sometimes easier) : DAT_DER_IMAP, DAT_DER_POP, DAT_DER_WEB are the names of the fields. | foreach DAT_DER_* [ eval <<FIELD>>=if('<<FIELD>>'="NULL",0,strptime(<<FIELD>>, "%Y%m%d")) ] | eval correct_date=strftime(if(first_field >= second_field, if(first_field >= third_field, first_field, if (second_field >= third_field, second_field, third_field)), second_field), "%Y%m%d") | table login_forgee correct_date datecrea no error, but the "correct_date" column is empty ... View more

Here are samples and the good answer after : |20140327|NULL|20140327 : 20140327 |20080901|NULL|20080902 : 20080902 |20000415|20000412|20000412 : 20000415 |20110402|NULL|20110403 : 20110403 3 fields A, B, C , how keep the last event ? (or how compare 3 date field ?) ... View more

Thank you. I extracted a new field that I called "date". | table date give the good result : |20140327|NULL|20140327 |20080901|NULL|20080901 |20000412|20000412|20000412 |20110403|NULL|20110403 if I try |makeresults |eval date_expand=split(date,"|") |eval correct_date=mvindex(date_expand,1)) | table correct_date I've got "Error in 'eval' command: The expression is malformed." in "date_expand,1", the number one give the jungest date or the first position ? I need to extract the jungest date. ... View more

That was my intention ! I don't see how change the "accepted answer" ... View more

Thank you for made me discover btool. I must now investigate. Config Quest app will help me. Your suggestion solved my problems ! ... View more

7.1.2 update works for me too. 🙂 thank's ! ... View more

uninstall and back to 6.6.7 with an enterprise dev licence solve the problem. But installing 7.1 or upgrading to 7.1 open the door to the bug. I hope 7.2 or more will be a solution 🙂 ... View more

trial converted in dev for my case. But my old free licence is recreated during the instal. I don't know where is the information that I need to erase to do a real fresh start on Ubuntu. ... View more

I tried to uninstal and reinstal everything (no more opt/splunk directory). and... I still have the error. ... View more

another particular case in my lab machine is that for safety reason it's not connected to the net. Is it youre case too ? I've made the update using an USB key. ... View more

I've the same bug coming from a 6 free version with 3 violations to a 7.1 developper license. The hash of my free license is : hash FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF is_unlimited False label Splunk Free I can't remove it. Is it the same for you ? Have you try to set up an authorize.conf file ? *1. [role_Administrator] 2. srchDiskQuota = 1000000* I have right problem on my lab machine for the moment and can't test this fix. ... View more

Thank's. Yes. I did it with the web interface. Is there a SPL command to include all time period ? ... View more

Just to know, did you modify one of this settings ? "search_process_memory_usage_threshold = * To be active, this setting requires setting: enable_memory_tracker = true * Signifies the maximum memory in MB the search process can consume in RAM. * Search processes violating the threshold will be terminated. * If the value is set to zero, then splunk search processes are allowed to grow unbounded in terms of in memory usage. * The default value is set to 4000MB or 4GB. stack_size = * The stack size (in bytes) of the thread executing the search. * Defaults to 4194304 (4 MB) status_cache_size = * The number of search job status data splunkd can cache in RAM. This cache improves performance of the jobs endpoint * Defaults to 10000" What is you usage per core ? perhaps did you already made empirical settings and compare the processing time obtained for the same search ? ... View more