Yes, you're correct. The chart will do; For Each OrganizationID, count of events per FieldsName. ... View more

( ref: https://answers.splunk.com/answers/2378/running-a-saved-search-from-the-command-line-interface-cli.html ) In a script, run a Splunk search, $SPLUNK_HOME/bin/splunk search '| savedsearch "$saved_search_name$" -app $my_app_name$' -auth admin:changeme ... View more

I agree with ddrllic. ... View more

Also, can you send us example of a file path and the configuration you used? ... View more

Have you restarted Splunk? F.Y.I. [monitor://\C:\Logs\location\log\*.log] Splunk will translated this stanza to; [monitor://\C:\Logs\location\log] whiltelist = [^\//]+\.log ... View more

Your idea itself sounds good. Sorry but the UI input for post script is to check executable file (script) in a proper location. So, you need to avoid argument in the Alert action script field. ... View more

Unfortunately Splunk does not ship any connector or logger software to monitor the port, you need to find a third party tool to monitor the port and convert the signal to human readable data. The tool output needs to be passed to a standard out or write to a log file where Splunk can monitor. ... View more

I agree. Please keep in mind that host stanza in props.conf cannot be defined by host field in inputs.conf. If you're looking for a certain source ip address who is sending udp packets, you need to specify the source IP. ... View more

Assuming your log files exists in C:\Logs\ or sub directories. - inputs.conf [monitor://\C:\Logs\....log] Or, you can make use of white list - inputs.conf [monitor://\C:\Logs] whitelist = \.log$ ... View more

I suggest to contact the author of the app. It all depends on how the app designed. ... View more

Are you talking about RS-232 virtual COM port? If so, I doubt there is any ready-to-use solution. If not, can you describe a little more detail a virtual COM port? OS and the data output format? ... View more

Missing Uploaded user name... 🙂 But, basically this is great! ... View more

How about using ( Foo=$searchText$ OR Bar=$searchText$ ) Or, maybe you can do input selection for two drop-downs ; one for Foo and the other for Bar. Then, you can use the similar query ; ( Foo=$vaalue_foo$ OR Bar=$value_bar$ ) ... View more

Great. We got confused with your question and what you're looking for. So, the value is not Duration. It is date time information in epoch time in seconds. Please keep in mind that the result will be changed tomorrow because the string is assuming date information. ... View more

Maybe you want to add day information, too. Well, this person is not looking for the value... Without dur2sec() function, this could be a solution. ... View more

Maybe you can try to change format of the JobStepsExecustionDuration to meet dur2sec() requirement <your search> | rex field=JobStepsExecutionDuration mode=sed "s/^([^:]+)(:)/\1+/" | convert dur2sec(JobStepsExecutionDuration) I tested this with the following search and it worked. | stats count | eval JobStepsExecutionDuration="0:00:00:05" | rex field=JobStepsExecutionDuration mode=sed "s/^([^:]+)(:)/\1+/" | convert dur2sec(JobStepsExecutionDuration) ... View more

Please update this description with more detail information you described in a part of answers so that readers can understand your question clearer. ... View more

Can you provide sample logs and example of what you're trying to do? ... View more

Glad to see it helped. ... View more

Splunk itself does not have a feature to do this in configuration file, and I doubt one regex can parse all possible tree structures. If you need to do such things, you need to create multiple regex for each tree. But, probably you need to know your tag names. Assuming your main goal is to parse tree structure of xmlstring field, you can do ugly workaround using spath. <Your base search> | eval orig_raw=_raw | eval _raw=xmlstring | spath | table * You should find xml path as fields. If this is acceptable, you might want to create a macro to reduce typing this extra field extraction every time. ... View more

Agree with Jrodman. This "hack" is not supported. Actually this caused unexpected behavior in an example user tied. Splunk doc should mention this hack is not supported. ... View more