Hi Everyone, I have one requirement. Below is my search query to show "no.of users logged in" for every 1 hour. index=ABC sourcetype=xyz "PROFILE_LOGIN" |rex "PROFILE:(?<UserName>\w+)\-" |bin _time span=1h |stats dc(UserName) as No_Of_Users_Logged_In by _time I am getting like below: _time No_Of_Users_Logged_In 2022-11-28 10:00 1 2022-11-28 11:00 2 I want when I click in the first row/timestamp/ No_Of_Users_Logged_In, it should show the raw logs of the events where the logged-in usernames are present in that particular time (if the time stamp is 10:00, then it should show raw events from 10:00 to 11:00). These events should open in new search . Also, can you guide me how to view these in panel below the table using drilldown. It should be only show when we click on the values. (It’s an additional request to know the possibility) Please guide and help me. xml code snippet : <row> <panel> <title>Number of Users Logged In</title> <table> <search> <query>index=ABC sourcetype=xyz "PROFILE_LOGIN" |rex "PROFILE:(?<UserName>\w+)\-" |bin _time span=1h |stats dc(UserName) as No_Of_Users_Logged_In by _time</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">6</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> </table> </panel> </row> ... View more

Hi All, I am trying to restart the Splunk UF agent in my Linux server, but it is throwing the following error. "Removing stale pid file... Can't unlink pid file "/opt/ca/splunk/splunkforwarder/var/run/splunk/splunkd.pid": Read-only file system" My splunkd.pid file permission set as following: -rw-r----- splunk splunk splunkd.pid The agent was not running since 2 weeks and I did not make any changes lately. I have no clue why it is throwing that error. Could someone please help me to fix this issue. Thanks in advance. ... View more

Hi All,  I am planning to upgrade Splunk Enterprise from version 7.3.3 to latest available version in Linux servers . Basically , its a distributed environment with multi-site Splunk Indexer cluster, search head cluster with a cluster master, deployment server, , and deployer.  Someone, please show me the exact path for these upgrade procedure. Please reply for the following. 1.  How to upgrade multi-site indexer cluster? 2. how to upgrade search head cluster and cluster master? 3. How to upgrade deployment server? 4. How to upgrade deployer? 5. what are the backup procedures and measures to be taken while upgrading? 6. What are the best practices to be followed while upgrading? 7. What is the order of upgrade? 8. What are the common issues faced while upgrading the license master, indexer, search head and all?   Grab some energy and please help me in answering these questions.  Thanks in Advance.   ... View more

Hi all, I want to integrate 5000 network elements into splunk via syslog. So, 5000 directories will be created where the data is collected respectively. Could anyone suggest me how to write inputs.conf to monitor all these 5000 directories.   Its quite difficult to write 5000 stanzas. Looking for a simplied solution. Please help ... View more

@gcusello Please help me for the below questions: 1. How to upgrade syslog-ng from older version to newer version? 2. How to install syslog-ng in Linux server? Please help with all the steps. ... View more

Hi All, Please help me in extracting the response values of the below XML snapshot. Finally , I want to display a table like below. After mapping all these values perfectly, I would like to display a line graph based on measobjldn. For example, my problem statement is to display the cpu_avg values of 4 different components(management 1, management 2, management 3, management 4) separately., where measinfoid= statistics. I used the below query but it is a hard coded query. How can i map all the values perfectly without hard-coding the values. index=AAA sourcetype=AAAB host=xxx | spath | rename measInfo.measType as Request_type, measInfo.measValue.r as P_value, measInfo.measValue.r{@p} as P_type, measInfo.measValue{@measObjLdn} as MeasobjLdn, measInfo{@measInfoId} as Measinfo_id | table time,host, Measinfo_id ,P_type,P_value | eval temp2=mvzip(P_type,P_value,=) | mvexpand temp2 | rex field=temp2 (?.+)=(?.+) |table _time host Measinfo_id P_type P_value |search Measinfo_id=statistics AND P_type=2 |streamstats count as sno by _time |eval ObjLdn=case(sno==1,"management 1",sno==2,"management 1",sno==3,"management 1",sno==4,"management 1") |table _time host InfoId P_type P_value sno Measobjldn |stats values(P_value) as P_Value by time,host,Measobjldn |xyseries _time Measobjldn P_value Please correct this query and help me ... View more

Hi All, I am trying to extract the multiple response values for a single request. After using "spath" command, the result is shown below. Here, I didn't extract any values and just tabulated the needed information. So, in the XML file, ALB city has 4 streets. Each street contains 4 members. This is single result . Now I want to break it as 16 results with all details as shown below. My query looks like index=ab host=xy source=*y.xml |spath |table _time host City_Name Street_name Person_code Person_role The above query gave the results shown in the first pic. Now i want to get the results as shown in the second picture. Please help me in framing the query for the latter part to get the expected results. Thank You. ... View more

Hi All, I am trying to extract the multiple response values for a single request. After using "spath" command, the result is shown below. Here, I didn't extract any values and just tabulated the needed information. So, in the XML file, ALB city has 4 streets. Each street contains 4 members. This is single result . Now I want to break it as 16 results with all details as shown below. My query looks like index=ab host=xy source=*y.xml |spath |table _time host City_Name Street_name Person_code Person_role The above query gave the results shown in the first pic. Now i want to get the results as shown in the second picture. Please help me in framing the query for the latter part to get the expected results. Thank You. ... View more