not really sure what you are wanting [\d]{1,2}/[\d]{1,2}/[\d]{4} will grab 3/7/2012 or 12/12/2012 , etc. ... View more

i also get this message in email for a scheduled pdf report An error occurred while generating a PDF of this report: Failed to fetch PDF from appserver at https://splunk:8000/en-US/report/: ... View more

this looks like a bug. when i create the source from file and preview it, Splunk correctly shows each event, but when i finish setting up the source and look at the data from a search it only shows that 1st line, not all of the event data. ... View more

Splunk shows just this for the source data of an event (why does it truncate the data?) 2012-04-05 15:38:29 syslog.prod.org [UDP: [10.219.0.134]:1086->[10.222.1.253]]: but the raw log file shows this for same event 2012-04-05 15:38:29 syslog.prod.org [UDP: [10.219.0.134]:1086->[10.222.1.253]]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (124678725) 14 days, 10:19:47.25 SNMPv2-MIB::snmpTrapOID.0 = OID: CSAMC-SNMPv2-MIB::csaTraps.1 CSAMC-SNMPv2-MIB::eventID = INTEGER: 10329635 CSAMC-SNMPv2-MIB::ruleID = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::hostName = STRING: "hostB.prod.org" CSAMC-SNMPv2-MIB::eventTime = STRING: "2012-04-05 15:38:29.617" CSAMC-SNMPv2-MIB::severityCode = INTEGER: 2 CSAMC-SNMPv2-MIB::eventCode = INTEGER: 164 CSAMC-SNMPv2-MIB::processName = STRING: "<remote application>" CSAMC-SNMPv2-MIB::fileName = Wrong Type (should be OCTET STRING): NULL CSAMC-SNMPv2-MIB::sourceIPAddress = Wrong Type (should be IpAddress): NULL CSAMC-SNMPv2-MIB::destinationIPAddress = Wrong Type (should be IpAddress): NULL CSAMC-SNMPv2-MIB::eventText = STRING: "The process '<remote application>' has triggered too many log records in the last few minutes. Further messages will be logged at a decreased rate for 10 minutes." CSAMC-SNMPv2-MIB::hostID = INTEGER: 209 CSAMC-SNMPv2-MIB::currentHostIPAddress = Wrong Type (should be IpAddress): STRING: "10.132.194.158" CSAMC-SNMPv2-MIB::hostOSType = STRING: "W" CSAMC-SNMPv2-MIB::sourcePort = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::destinationPort = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::eventType = STRING: "Administrative" CSAMC-SNMPv2-MIB::ruleDescription = Wrong Type (should be OCTET STRING): NULLCSAMC-SNMPv2-MIB::ruleModuleID = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::ruleModuleName = Wrong Type (should be OCTET STRING): NULL CSAMC-SNMPv2-MIB::buttonCode = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::userName = STRING: "myDOMAIN\\WSecGat_Px" CSAMC-SNMPv2-MIB::flags = INTEGER: 0 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (124679186) 14 days, 10:19:51.86 SNMPv2-MIB::snmpTrapOID.0 = OID: CSAMC-SNMPv2-MIB::csaTraps.1 CSAMC-SNMPv2-MIB::eventID = INTEGER: 10329637 CSAMC-SNMPv2-MIB::ruleID = INTEGER: 1374 CSAMC-SNMPv2-MIB::hostName = STRING: "hostA.prod.org" CSAMC-SNMPv2-MIB::eventTime = STRING: "2012-04-05 15:38:29.999" CSAMC-SNMPv2-MIB::severityCode = INTEGER: 2 CSAMC-SNMPv2-MIB::eventCode = INTEGER: 179 CSAMC-SNMPv2-MIB::processName = Wrong Type (should be OCTET STRING): NULL CSAMC-SNMPv2-MIB::fileName = Wrong Type (should be OCTET STRING): NULL CSAMC-SNMPv2-MIB::sourceIPAddress = Wrong Type (should be IpAddress): NULL CSAMC-SNMPv2-MIB::destinationIPAddress = Wrong Type (should be IpAddress): NULL CSAMC-SNMPv2-MIB::eventText = STRING: "The 'Service Control Manager' service logged event code 7036 into the system event log: The LiveUpdate service entered the running state. " CSAMC-SNMPv2-MIB::hostID = INTEGER: 2206 CSAMC-SNMPv2-MIB::currentHostIPAddress = Wrong Type (should be IpAddress): STRING: "10.10.10.10" CSAMC-SNMPv2-MIB::hostOSType = STRING: "W" CSAMC-SNMPv2-MIB::sourcePort = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::destinationPort = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::eventType = STRING: "NT Event log"CSAMC-SNMPv2-MIB::ruleDescription = "" CSAMC-SNMPv2-MIB::ruleModuleID = INTEGER: 280 CSAMC-SNMPv2-MIB::ruleModuleName = STRING: "CSA Service Monitoring" CSAMC-SNMPv2-MIB::buttonCode = Wrong Type (should be INTEGER): NULL CSAMC-SNMPv2-MIB::userName = Wrong Type (should be OCTET STRING): NULL CSAMC-SNMPv2-MIB::flags = INTEGER: ... View more

ok, misread the question, but the again, not really sure what the question is. timechart will chart the data from the search and if a day has no data then that day avg will be zero. i believe the timechart will have a timeline of whatever your search was, so if you say only sat and sun over last 3 weeks then timechart will show 3 weeks with only data on sat and sun, etc. ... View more

pls escape backslashes with a \ otherwise we readers see confusing stuff because this forum takes a single \ as a special char. a real pita imho. ... View more

example (mon-fri) index=cisco_esa (date_wday=monday OR date_wday=tuesday OR date_wday=wednesday OR date_wday=thursday OR date_wday=friday) index=cisco_esa (date_wday!=saturday AND date_wday!=sunday) example (sat and sun only) index=cisco_esa (date_wday!=monday AND date_wday!=tuesday AND date_wday!=wednesday AND date_wday!=thursday AND date_wday!=friday) index=cisco_esa (date_wday=saturday OR date_wday=sunday) then pipe as needed. see http://docs.splunk.com/Documentation/Splunk/4.3.1/User/UseDefaultAndInternalFields ... View more

i read the directions, still doesnt work. the raw log file has a bunch of ascii data but Splunk only shows part of it for some reason. when i say "syslog-ng" i mean i use -Ls with snmptrapd instead of -Lf, this allows me to have better control over where the data goes, etc. snmptrapd -M /usr/share/snmp/mibs -m +ALL -Lf /logs/snmp/hostA --disableAuthorization=yes or snmptrapd -M /usr/share/snmp/mibs -m +ALL -Ls 0 --disableAuthorization=yes the latter cmd logs the same data as the 1st, but Splunk seems to have a problem showing/parsing the 1st. ... View more

i am working on alternate solution, using snmptrapd and my syslog-ng. snmptrapd is not dynamic enough to handle numerous snmp traps from different hosts, etc. thnx. ... View more

binary? tcpdump shows ascii data. ... View more

nope, i dont think the where clause can act on results of the chart, only fields within the search. renaming using AS only changes the name in the chart. this search fails to display the data the way you want. index=cisco_firewall error_code=106023 | chart count(error_code) AS number by src where number>50 however, i am sure there is a way to get what you need. ... View more

wow, if you post the data pls post the real data (sanitize is ok) but dont add chars. the regex you have is way too long, shorten preface to \d{3}\s+ simpler is faster ... View more

CSA sends snmp traps to udp 162. setup a src on udp 162. sourcetype has to be cisco_csa ... View more

i fixed my indexing issue. i now have metadata tagged as host=Mon when it should be host=myHost, etc. ... View more

ok, well, you dont need math to achieve this space saving endeavor. using scientifc notation simply modifies the units via # notation. and, you dont save byte space simply by converting to scientific notation, you only save byte space if you roundoff/truncate. you can SEDCMD the input data and normalize it say to E+3 or E+6 (whatever, etc) then round/truncate. then perhaps do a custom field extraction and name it with units attached, eg "kB" or "MB" or whatever. you can roundoff/truncate/normalize with SEDCMD, etc. ... View more

i notice this too but my data is from v8.2, must be an extraction issue in the base app? ... View more

i just used " and it finds the whole 2nd timestamp there's only one " prefacing the timestamp so i dont see any need to define all of the preface, plus its probably faster just using " ... View more

i cant re-index the data, i'll get same results, reason being is that the raw data format has changed and is defined as sourcetype=syslog, hence it will incorrectly tag some data as host=myHost and some of it as host=Mon. i need a way to edit the metadata, etc. i could re-index if i modified syslog source type, but i would rather not do that, etc. ... View more

i think it is common approach to use regex(? regex)regex to search/define things. back-references are rather straightforward, see http://www.regular-expressions.info/brackets.html ... View more

example index=cisco_esa (date_hour<=16 AND date_hour>=9) 9am to 4:59:59:999pm it will bucket the events using 1hr slots, so you get 8 slices per day, but you can modify that is needed, etc. ... View more

then props.conf shows (in GUI, etc) # your settings MAX_TIMESTAMP_LOOKAHEAD=50 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_PREFIX=" ... View more

your raw data has wrong $TZ so Splunk doesnt know any different unless you tell it this source has specific $TZ. i used your raw data above, i then create a new source, preview the source, adjust the timestamp, i use quotes " as the preface and it highlights the 2nd timestamp including the -0400, and then you can choose UTC for TZ, etc. your 1st time "130" looks like ms and not sec. is this format a option from your ironport web appliance? i dont get that format from my ESA's using syslog. ... View more