We are using the UF to monitor multiple files which are to be considered transient.  All we want to do is get them forwarded then remove them.  We are using the splunk list inputstatus command to verify files have been forwarded, but even after removing them from the monitored location, the files still show as been open for reading using the inputstatus command.  How long should it take for the UF to recognize the file is no longer present and should no longer to be monitored? Is there a way to explicitly remove a file from being monitored without needing to restart the UF or add files to the blacklist?  I see there is a remove operation under https://<server>:<port>/services/admin//monitor.  What does that do? ... View more

I want to build a system where an external event consumer periodically pulls newly indexed events from Splunk on a scheduled basis (e.g., every 15 or 30 minutes, or hourly). The concern I have is that the indexing of events by Splunk can be interrupted due to licensing issues or due to network or server issues where a forwarder is temporarily prevented from sending events. When the forwarding or indexing of events is restored, we will be indexing old events with timestamps set by the props.conf to the old times. So in queries from the external system, I want it to be able to query for events indexed in the last X minutes independent of the event timestamp. This will allow me to pick up old events that were recently indexed without overly complex queries. Is this concept possible to implement in Spunk? ... View more

I have a saved search: source=/opt/app/workload/MCRRepo/*/*.csv | rex "(?.*),(?.*),(?.*),(?.*),(?.*),(?.*)" | search componentName=ServiceComponent* measurementName=transactionAttempts | sitimechart span=5m per_second(counterValue) When I run the normal version of this query over a 24 hour period: source=/opt/app/workload/MCRRepo/*/*.csv | rex "(?.*),(?.*),(?.*),(?.*),(?.*),(?.*)" | search componentName=ServiceComponent* measurementName=transactionAttempts | timechart span=5m per_second(counterValue) I get per_second ranges of up to 7000 TPS which matches the expected range of my data. But when I run the query against the summary index using the query over a 7 day or longer period: index=summary search_name="MCR_TPS" | timechart span=5min per_second(counterValue) I get per_second ranges up to 200K . What am I missing? The TPS should still range up to 7000 TPS for each of the 7 days. ... View more

I have an xml sourcetype, with multiple events correlated with a corrID field. For one class of events, I have a "begin" event <beginTrans> and an "end" event <endTrans>, each with a "timestamp" field <timestamp>. The timestamp field is also used as the time of the event when indexed. See examples below... <TdrType><eventType>beginTrans</eventType> <timestamp>1487803204730</timestamp> <corrID>1487803204657_281de495-1a0c-48d4-b354-23f56d2a71ad</corrID> </TdrType> <TdrType><eventType>endTrans</eventType> <timestamp>1487803204736</timestamp> <corrID>1487803204657_281de495-1a0c-48d4-b354-23f56d2a71ad</corrID> </TdrType> I am trying to do a query that does a time diff between the correlated events based on the timestamp. Here is my query. sourcetype=xmldata | xmlkv | search beginTrans [search sourcetype=xmldata endTrans | xmlkv | rename timestamp AS endTimestamp | table corrID] | rename timestamp AS beginTimestamp | eval cmeTime = endTimestamp - beginTimestamp | table corrID, beginTimestamp, endTimestamp, cmeTime I have tried variations on this that use appendcols, eval, and fields but haven't found a combination that works. In all cases, endTimestamp is always blank and so cmeTime is also blank. If I run the subsearch by itself, then endTimestamp has a value. Any guidance? ... View more

I have a log that contains multi-line events, some events contain java stack traces. Here is an example log: INFO 2017-02-06 17:57:36,026 com.loadbalancer.http.SynchHttpProducer [82] - Details of successful transactions: 2017-02-06 17:57:35, 727 [SECU] AUTH date:2017-02-06PST17:57:35-0800 login:loging status:SUCCESS 2017-02-06 17:57:35, 727 [SECU] AUTH date:2017-02-06PST17:57:35-0800 IP:fqdn login:login status:SUCCESS INFO 2017-02-06 17:57:39,111 com.targethealthcheck.HeartbeatHealthCheckService [374] - TargetHost for IP fqdn marked as AVAILABLE INFO 2017-02-06 17:58:05,524 com.monitoring.AbstractPrinter [90] - [STAT][PING] [STAT][PING] Checked by Manager : true [STAT][PING] Checked by Load Balancer : false INFO 2017-02-06 17:58:05,525 com.alu.e3.monitoring.AbstractPrinter [90] - [STAT][PROV] INFO 2017-02-06 17:58:05,526 com.alu.e3.monitoring.AbstractPrinter [90] - [STAT][TOPO] WARN 2017-02-06 17:58:05,543 com.monitoring.AbstractPrinter [94] - Error during printing stats for category SYNCHRO java.lang.NullPointerException at com.monitoring.StatMaker.getVariance(StatMaker.java:89)[494:e3-bundle:6.4.4.1] at com.monitoring.StatMaker.getSigma(StatMaker.java:101)[494:e3-bundle:6.4.4.1] at com..monitoring.StatMaker.toString(StatMaker.java:136)[494:e3-bundle:6.4.4.1] at java.lang.String.valueOf(Unknown Source)[:1.7.0_79] at java.lang.StringBuilder.append(Unknown Source)[:1.7.0_79] at com.monitoring.SpeakerSynchronizationTime.logStatsGateway(SpeakerSynchronizationTime.java:235)[494:e3-bundle:6.4.4.1] For this I used the following props.conf: [ngeag_e3] NO_BINARY_CHECK = true SHOULD_LINEMERGE = true TRUNCATE = 0 MAX_EVENTS = 2048 BREAK_ONLY_BEFORE = FATAL[\s]+|ERROR[\s]+|INFO[\s]+|WARN[\s]+|DEBUG[\s]+ DATETIME_CONFIG = TIME_FORMAT = "%Y-%m-%d %H:%M:%S,%3N" TIME_PREFIX = FATAL[\s]+|ERROR[\s]+|INFO[\s]+|WARN[\s]+|DEBUG[\s]+ MAX_TIMESTAMP_LOOKAHEAD = 23 category = Custom description = Log file containing AME events disabled = false pulldown_type = true LINE_BREAKER with SHOULD_LINE_MERGE = false did not work for me because the LINE_BREAKER would be: LINE_BREAKER = (FATAL[\s]+|ERROR[\s]+|INFO[\s]+|WARN[\s]+|DEBUG[\s]+) This would remove the log type (FATAL|ERROR|INFO|WARN|DEBUG) and also removes the time prefix such that the timestamps don't work. The above config works mostly but my events are sporadically being split unexpectedly. When I show source, I will see strange modifications to the log where the log line gets split mid word: INFO 2017-02-06 17:57:36,026 com.loadbalancer.http.SynchHttpProducer [82] - D etails of successful transactions: 2017-02-06 17:57:35, 727 [SECU] AUTH date:2017-02-06PST17:57:35-0800 login:loging status:SUCCESS 2017-02-06 17:57:35, 727 [SECU] AUTH date:2017-02-06PST17:57:35-0800 IP:fqdn login:login status:SUCCESS INFO 2017-02-06 17:57:39,111 com.targethealthcheck.HeartbeatHealthCheckService [374] - TargetHost for IP fqdn marked as AVA ILABLE INFO 2017-02-06 17:58:05,524 com.monitoring.AbstractPrinter [90] - [STAT][PING] [STAT][PING] Checked by Manager : true [STAT] [PING] Checked by Load Balancer : false Not only is the line getting split, but it is not merging into the prior event. Any ideas why the lines are getting split or why they are not getting merged? ... View more