We have our servers spitting out UDP 514 to a load balancer to spread the load over a pair of splunk indexers. The important thing to remember is that udp is one way. Your load balancer will not be able to tell if there is something listening on UDP on the target devices. If the box goes down, yes, a ping test will pick that up. But if the UDP listener goes down - nothing. The traffic will go down a black hole. We worked around this by having the same process listening on UDP 514 and TCP 514. That way the load balancer can at least check that the recieving process is up on the target boxes by polling TCP 514. You can still use UDP for the actual messages though. You will lose any messages until the load balancer determines one process has stopped. The universal forwarder uses TCP. So I'm not sure if you'll still have the same concerns as your "syslog-ng TCP" solution. Aside from pre-parsing logs : syslog-ng PE 4.2 has RLTP and disk buffers, which is approximately what the universal forwarder offers. (minus failover). rsyslogd does everything that the universal forwarder does in terms of buffer and failover. ... View more

... | eval error=if(match(_raw,"(?i)ERROR"),"error", "OK") | table error _raw Will create a field called error that contains either "error" or "OK" depending if the word "error" is anywhere in the message. This is NOT case sensitive. ... View more

autoregress is going to be the simplests solution for you. i.e. somesearch | autoregress myfield as prev_myfield | eval display_field=if(prev_myfield=="toto",myfield,"anomoly") if you need something more advanced than auoregress, streamstats allows you to do "by" clasuses etc. ... View more

Its the timechart command that does the binning, so no amount of advanced charting voodoo will correct the ranges of data. The only thing I can think of is something like this : * | addinfo | eval modifier=60*tonumber(strftime(info_min_time,"%M")) | eval _time=_time-modifier | timechart span=1h count by sourcetype | eval _time=_time+[ search * | head 1 | addinfo | eval modifier=60*tonumber(strftime(info_min_time,"%M")) | return $modifier ] This looks at the minimum time for the search, gets the minute, offsets the data by that much so it snaps to the hour cleanly, does the timechart, then corrects the offset. The subsearch does depend on you setting the earliestTime in the timerangepicker, and not hardcoding it into the main search. If you're hardcoding it into the main search, everything becomes much simpler, because you might as well just replace "modifier" with minutes*60 ... View more

Yep. Easiest was to make it a multivalued field. ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})" that'll split longfield into lines of no more that 50 characters. ... View more

Right. Splunk doesn't know that what you're displaying is a date. So you need to have the column in a sortable format, then change the way its displayed. Since you already mention is sorts ok when you have %Y-%m-%d, im guessing you're formating _time, or another epoch field ( in the example mydate ) instead of doing | eval mydate=strftime(mydate,"%Y-%m-%d") do | fieldformat mydate=strftime(mydate,"%d/%b/%Y") the underlying data is sortable, but the displayed values are readable dates, so sorting will work. ... View more