"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
E Mc Hate's Discussions
How can I recover from paused indexing due to low disk space?
3 Replies
Hi All,I am getting this message "indexing has paused because low disk space", then I tried to follow the one in the splunk manual on moving index data, but nothing seems to change, message is still…Continue
Started this discussion. Last reply by Brian P Osburn Aug 11, 2010.
E Mc Hate's Page
Gifts Received
E Mc Hate has not received any gifts yet
Latest Activity
Brian P Osburn replied to E Mc Hate's discussion How can I recover from paused indexing due to low disk space?"Where did you move the index to? another drive? Just need to make sure the space really is freed up.
Check…"
E Mc Hate replied to E Mc Hate's discussion How can I recover from paused indexing due to low disk space?"did that and its still showing paused index. unless I move the wrong index but doesn't gave me any error except that paused message."
Brian P Osburn replied to E Mc Hate's discussion How can I recover from paused indexing due to low disk space?"Need to clear out some disk space, and then restart...that should clear up the message"
E Mc Hate posted a discussionHow can I recover from paused indexing due to low disk space?
Hi All,I am getting this message "indexing has paused because low disk space", then I tried to follow the one in the splunk manual on moving index data, but nothing seems to change, message is still there. can someone help me? I am running splunk on windows 2003 svr. See More
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- systems and network support
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
