Several thousand remote hosts connecting to a collector at 2 geographically distanced datacenters. One of the collectors should be getting bytes_seen > zero If neither collector sees bytes_seen > zero, then the controller is assumed to be down and an alert needs to be raised. Trying to table RemoteDevice  DatacenterCollector BytesSeenWestCoast    DatacenterCollector    BytesSeenEastCoast                RemoteDeviceStatus Device-1              Collector-WestCoast      50                              Collector-EastCoast                     0                              Up Device-2              Collector-WestCoast      104                            Collector-EastCoast                     0                              Up Device-3              Collector-WestCoast      0                                 Collector-EastCoast                     0                              Down In this scenario, Device-3 should be marked down, and an alert generated. Expecting to use a lookup table file for a list of all the remote devices Splunk needs to receive the events for from the datacenter collectors.   ... View more

Counter 1 - Perfmon: Inbound Data rate Counter 2  - Perfmon:Outbound Data rate source="Perfmon:PostilionPostbridgeInterchanges" My values look something like this:  0.007956853689073186 I am looking for the difference between the two counters and to reduce the number to 3 places behind the decimal point, if possible. ... View more

I am using the following command which gives me what I am looking for regarding a single indexer, but I would like a table listing all my indexers and heavy forwarders and the average tcp_KBps. I am trying to determine any network impact with and without compression. index=_internal host=* source="*metrics.log*" destIp=REDACTED.* component=Metrics group=tcpout_connections | timechart avg(tcp_KBps) AS avg_KBps HOST Average KBps indexer-a 400.33333 indexer-b 8000.9999 syslog-a 500.33333 syslog-b 1000.55555 ... ... View more

I have a dozen /24 subnets that I am looking to find any IP addresses on that subnet in my search as well as a addresses from several /25 and /26 subnets. Thanks, in advance. ... View more

I had a multi-site SHC with 1 SH on one end and 3 SHs on the other end. Documents I find recommends an odd number at each site. One of my 3 servers was marked "down" by the Deployer but the SHC Service was still working. The failing server was rebuilt with a backup that was taken before the server was configured as part of the SHC. So, when the server came up it was no longer configured for the cluster and SHC Service broke. The single server at my site1 was configured to be the captain, so I am trying to figure out why this failed. What would rebooting splunk on the Deployer and/or on the search heads cause the SHC Service to fail if the server running the captain is not having any issues? And what can be done to prevent this from happening in the future? ... View more

[sslConfig] sslVersions = *,-ssl2 slVersionsForClient = *,-ssl2 Per the documentation * The syntax is the same as the 'sslVersions' setting above. Those entries are identical, so I don't understand why I am getting an error for one and not both. ... View more

I am trying to figure out how to configure my cluster master to generate a token and HEC configuration information/files to my index cluster. The documentation is not clear as to how this is done. I believe, in the global settings for the token, I can configure the ouptpuGroup with the indexers in my cluster and thereby load-balancing across the bunch of them. Not sure about the configuration needed to do this. ... View more

I am using index=pcf and I am getting plenty of events. The documention says that the following sourcetypes are configured automatically but those parameters show up in my search as event_type. Firehose event type Splunk sourcetype Error cf:error HttpStartStop cf:httpstartstop LogMessage cf:logmessage ContainerMetric cf:containermetric CounterEvent cf:counterevent ValueMetric cf:valuemetric From the ingested events, it appears that I am getting all the events that would be needed to populate the dashboards in the Add-on for Cloud Floundry ... View more

How do I get daily totals (column) for a list of e-mail addresses (column) for registration failures? E-mail Address Day1 Day2 Day3 Day4 Day5 Day6 Day7 Total-Failures-for-individual Address1 2 4 6 Address2 1 5 6 Address3 3 3 4 10 Total Daily 6 9 3 0 0 4 0 ... View more