Hello!
I'm trying to create a custom multikv.conf stanza for the first time, and am having trouble getting it working. Here is an example of the events I'm working with:
Object ID V...
We have events coming in from stdout, such as the top command, where a single event captures a multi-line structured data output, e.g., this is a single Splunk event:
PID USER PR NI VIRT...
Hi Splunkers,
So I'm getting started with multikv extractions, and I've come across this issue. I'm attempting to generate a report (based on the output of Solarwinds) that will graph the a...
Hello! I have a dataset that I'd like to add a new field to where I can arbitrarily define the values with manual input without downloading and reuploading the data. I've tried editing the table but...
Hi,
I'm trying to successfully parse out some fields from unstructured log file.
Below is a snippet:
Tue Jun 16 00:15:27 EDT 2015
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND ...
...Is there something different about the way that multikv keynames are extracted that doesn't work with a subsequent eval? How can I display the value in KB?
Search:
sourcetype="P...
I have recently created a field extraction on one search head that I have assigned all apps and users to read and write and was wondering how long is would take for a change done in one search head t...