I seen some videos from youtube and splunk docs sites but they are very high level. I am exploring predict in our project but I find a lot of limitations with predict in combination with timechart. Can someone please share their experience or point me to the URL where I can read further? If there are any ebooks I can buy, let me know please. I wonder if splunk ML toolkit is more appropriate rather than using the SPL directly? many thanks in advance. ... View more

i created a saved report. avgTrafficVolume as admin (saved it as global permission) Confirmed it is in the reports list Confirmed it is in the savedSearches.conf find . -name 'search.conf' -exec grep avgTrafficVolume {} /dev/null \; ./etc/apps/search/local/savedsearches.conf:[avgTrafficVolume] Run the loadjob command in splunk web |loadjob savedsearch="admin.search.avgTrafficVolume" Expected: the saved report is run Actual: Error in 'SearchOperator:loadjob': The savedsearch argument format is invalid. Expecting 'user:application:savedsearch-name'. Did I do anything wrong? What do I need to do to get the loadJob to work? ... View more

I have been staring at this problem for eons but I'm stuck. I have two dynamic lookups. volumeCheck (external lookup), fields defined=ip, volumes, vrank Result; volumeCheck always return vrank=UNK . I expect vrank to be GREEN or AMBER top10InboundPortProtocol (external lookup), fields defined=port,protocol,rank Result: returns GREEN, AMBER or RED (works) I checked the logs and I can see that volumeCheck is returning on the stdout RED or GREEN but on splunk search, it is showing vrank=UNK. I can't see any exception or error in splunkd.log FYI, i set in the dynamic lookup, minimum matches=1, Default matches to UNK I have done many dynamic lookups but this one stumped me. FYI my splunk search: index="flowintegrator" src_port=21 |eval thisUser=src_ip + "_"+ dest_ip | bucket _time span=1d | eval diff= floor((now() - _time)/86400) |eval diff="row"+diff | chart avg(bytes) over thisUser by diff|eval row1=if(isnull(row1), 0, floor(row1))| eval row2=if(isnull(row2), 0, floor(row2))|eval row3=if(isnull(row3), 0, floor(row3))|eval row4=if(isnull(row4), 0, floor(row4))|eval row5=if(isnull(row5), 0, floor(row5))|eval row6=if(isnull(row6), 0, floor(row6))|eval volumes=row1+";"+row2+";"+row3+";"+row4+";"+row5+";"+row6|**lookup volumeCheck ip as thisUser, volumes OUTPUT vrank** Help. ... View more

I tried various combinations but failed index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as volume by thisUser|predict thisUser index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser|predict avg_bytes This works but I can't predict. index="flowintegrator" src_port=21 |eval thisUser=src_ip + "="+ dest_ip | timechart avg(bytes) as avg_bytes by thisUser Help ... View more

I tried to setup $SPLUNK_HOME/etc/log.cfg to change its current logging (RollingFileAppender) Attempt 1 - failed : encountered parsing errors appender.A4=org.apache.log4j.DailyRollingFileAppender appender.A1.File=${SPLUNK_HOME}/var/log/splunk/splunkd.log appender.A1.DatePattern='.'yyyy-MM-dd Attempt 2 - failed due to parsing errors appender.A1=RollingFileAppender appender.A1.fileName=${SPLUNK_HOME}/var/log/splunk/splunkd.log appender.A1.filePattern=${SPLUNK_HOME}/var/log/splunk/splunkd.log-%d{yyyy-MM-dd}-%i Help. what can i do to change the logging? I thought splunk supports the standard log4j 2 ... View more

Hi All, The older version does not support RFC 5424. And in the latest doco, it mentioned that forwarding to 3rd party supports the old style syslog (RFC 3164). Please confirm. If not, please tell us the work around on how we can support the newer syslog format. If we need to add an add-on, we will do so. Kindest Regards Ricky ... View more