Failed Attempts to Logon to Splunk Web

The following Splunk Search Query will return all users who have failed to logon to the Splunk Web console. This query will also include an average (from eventstats).  

Continue Reading →

License Usage by Index per Day

The following Splunk search query will output license usage for each index for each day for the week to date. It will also output an average for each index over the course of the given time period.  

Updated / Revised – 8/12/2016

Continue Reading →

Percentage of Daily License Usage

This Splunk search query will indicate the percentage of license used for the current day. This is already shown in the licensing tab under settings, however this query is extracted if you would want to use it within a dashboard or any other reason. NOTE – splunk_server= should be set to your license master.   […]

Continue Reading →

Top 5 License Consuming Hosts

The following Splunk search query will return the top five licensing consuming hosts:

Continue Reading →

License Usage by Sourcetypes

The following Splunk query will return results for license usage by sourcetype:

Continue Reading →

Last Time a Forwarder Checked In

The following Splunk Search Query will return results based on the last time a forwarder (universal forwarder, heavy forwarder, or otherwise) checked in. The query is a modified version of a query that was packaged with the Deployment Monitor app.

Continue Reading →

List of Universal Forwarders with Version

The following Splunk query will return results of any host using a universal forwarder to transmit data back to a Splunk indexer. The query will return hostname, version, as well as architecture (64-bit vs 32-bit).  

Continue Reading →

Comparing Stats Time Over Time

This search will lay a count of something (in this case, just a count) on a timechart, with a corresponding count on the same time frame axis. With this simple search, you can modify to view any variable over just about any time frame. Modify the “index” and “stats” command, as well as the […]

Continue Reading →

Detailed list of Universal Forwarders Reporting to Indexer

The following query will list in detail information on the universal forwarders checking into the indexer. I’ve renamed some of the fields to be more user-friendly.

Continue Reading →