DS runs 6.3, Forwarders run 6.2 ... View more

Any resolution on this agarrison? ... View more

Getting a HTTP Status 403 error when clicking on the link ... View more

Sorry, I can't see the link below. Its a broken link for me ... View more

Hmmmm. The only other suggestion I can make (other than getting a sample of the data and the REGEX you are using and helping debug, which I am happy help with BTW) is to ask about where the extractions are being stored. Specifically, are they in the props.conf of the app in which you are executing the search? ... View more

Does the sourcetype name remain the same for events over time? That is, is the sourcename for events that occur today (when extraction is not working) the same as the sourcename of events that occur yesterdau (when extraction is working) ... View more

Do extractions work for events older than 24 hours? Or do they just not work at all for any event, no matter their timestamp? ... View more

Are you defining extractions against sourcetype or source? Are you able to provide the configuration you have defined in your props.conf? ... View more

Hi bidahor13 A couple of observations: 1. It looks like the transferedBitsIn and transferedBitsOut fields are calculating a per second value. If this the case, then using average would be more appropriate than sum in your timechart 2. If you want to calculate a percentage utilisation, then you need to divide bandwidth used by bandwidth total It would be a good to get a sample of data so we can give more specific pointers ... View more

Any luck with this? I'm looking into Splunk-PRTG integration at the moment and was hoping not to have to re-invent the wheel if possible. ... View more

@yuwtennis Did you end up getting an answer for this? ... View more

Yep. I can confirm that the token_safe you specified in the XML makes it work. Thanks so much! ... View more

Hi @laserval and @alexiri, I'm also experiencing the same issue, did you ever get to the bottom of it? ... View more

CCMS (and far more!!) data can be retrieved from SAP via the SAPninja data collection framework and then indexed into Splunk via RFC or direct file indexing. Please refer to this answer for further discussion ... View more

The good thing about SAP is that it logs a lot of information about internal activity and performance. Unfortunately, it is not readily accessible. A Project was launched in late 2011 called SAPninja, which provides a way of harvesting SAP log and performance data and staging it in a way for ready ingestion by Splunk (and other applications). There's also a Splunk App launched at the same time called Splunk For SAP. Check out this thread for further discussion. ... View more

nawneel There are two components to this solution The SAPninja data collection framework - This can be downloaded from http://code.google.com/p/sapninja and deployed on your target SAP system. Note - This is a reasonably involved process and will typically require your SAP/Basis administrators to perform this on your behalf. The Spunk app that can be downloaded from Splunk base Once SAPninja has been deployed within your target SAP system and is collecting data, the two main ways of retrieving data from SAP into Splunk are: Scripted Input - A perl script (part of the SAPninja package) is placed on the Splunk indexer and a scripted input defined. This perl script initiates an RFC against the target SAP system File Indexing - SAPninja can be configured to dump performance data into files on the target SAP system. A Splunk universal forwarder can then index these files ... View more

Missing slash. Ouch. The %e space pads and works fine. I can confirm that the following following config in props.conf works: TIME_FORMAT=%e/%m/%g %H:%M:%S TIME_PREFIX=[(] ... View more

Thanks for the suggestions yannK. I've removed the double space from the TIME_FORMAT and also tried enclosing in brackets but still no good. ... View more