"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Forwarding setup
I am a real Splunk newbie, and trying to figure out forwarding.
I've installed splunk on server1 and server2. Server1 is my main server, and I want to forward data to it. I've set up server2 to forward to server1, and server1 to receive from server2. The log files confirm that they are talking to each other.
Now, how do I set up a data input, reading something like /var/log/messages and forward that data to server1?
Thanks in advance.
I've installed splunk on server1 and server2. Server1 is my main server, and I want to forward data to it. I've set up server2 to forward to server1, and server1 to receive from server2. The log files confirm that they are talking to each other.
Now, how do I set up a data input, reading something like /var/log/messages and forward that data to server1?
Thanks in advance.
Tags: Forwarders
Views: 192
Replies to This Discussion
-
Permalink Reply by Mark Sleeper on -
Have you turned on lightweight forwarding on server2? If not you still have access to the web interface, that will make it easier to set it up. On server2 you need to go into Manager > Data Inputs > Files & Directories and add your /var/log directory. If you add /var/log instead of /var/log/messages you'll get all the other important sub-directories as well... like /var/log/secure!
Once you've added the directory and saved the configuration you should be able to use splunk on server1 to search the logs from server2. I don't remember how long it took before I started seeing the forwarded logs but I don't think it was over 15 minutes.
Mark
© 2012 Created by Michael Wilde.
