"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
splunk-search.exe process
Can someone tell me what the splunk-search.exe process is doing on a client that is configured for SplunkLightForwarder?
I'm noticing that it starts up roughly every 30 seconds, and runs for for about 2-5 seconds using 80-95% of the cpu during that time.
is splunk-search.exe needed when running a SplunkLightForwarder? If it can't be disabled, can is it possible to throttle it back?
thanks,
Views: 21
Replies to This Discussion
-
Permalink Reply by Michael Wilde on -
Check to see if that forwarder has any scheduled searches running and disable them. Some apps have scheduled searches in them.
-
Permalink Reply by Atul Mistry on -
no saved searches, but I was able to resolve the issue by re-enabling the SplunkLightForwarder.
thanks,
-
Permalink Reply by Michael Wilde on
-
Weird. Splunkd.log might contain some evidence of what was going on.
© 2012 Created by Michael Wilde.
