does it support negative/positive lookahead and lookbehind? your (?!) is a negative lookahead, you need a positive lookbehind if using "domain/" maybe this ([A-Za-z]{1,10}([0-9]{1,5})?)(?=\()|(?<=/)([A-Za-z]{1,10}([0-9]{1,5})?) or ([A-Za-z]{1,10}(\d+)?)(?=\()|(?<=/)([A-Za-z]{1,10}(\d+)?) but a single pos lookahead should suffice ([A-Za-z]{1,10}(\d+)?)(?=\(realm\)) ... View more

i think the better option is of course to not run things as root when they dont need to, better yet, non-root in chroot environment is ideal. start syslog-ng per the link i provided. i will also suggest to run syslog-ng not as same uid as splunkd. you can configure syslog-ng.conf with destination owner,group,perm settings for the files. files should be owned by syslog, grouped with splunkd uid, and perms 640. so, you can run syslog-ng as one uid, splunkd as another uid, and you can have syslog-ng write files using yet another uid, etc. do not rely on logrotate to handle owner,group,perm. ... View more

what i notice in v4.3.1 for linux is that source types are created in weird ways. if you create a new source (file) and you dont preview the data and you use manual source name, the source is not added to the props.conf file and will never be seen in the "list" when creating a new source, but, if you use the same name again it will complain with a "that name already exists" error message. but if you preview the data and select "create new source" it will populate props.conf with the new source type and will be available in the "list". but no place to edit/delete sources from the GUI? ... View more

i was using the GUI to create a new source definition, etc. when i went to timestamp tab i could not get the GUI to recognize the iso date in the data. ... View more

http://www.balabit.com/wiki/syslog-ng-faq-non-root ... View more

i changed my syslog template to ("$WEEKDAY $DATE $TZ $HOST $FACILITY [$LEVEL] $MSG\n") ... View more

i added those two lines to /opt/splunk/etc/system/local/props.conf and bounced the service, it is still logging host=Tue ... View more

perhaps you explained why i see what i see, but that would be completely confusing since the source page gives the options to define hostname by path segment, and offers no text explanation or options to override the default "syslog" definition as you explain it. this falls into my book of klugeyness. ... View more

maybe the issue is my defined path of /logs/syslog/linux/.../log perhaps Splunk is not expanding this before assigning hostname from path, so it tries to extract it from the raw data? if so this is not documented, i would expect it to expand the path before extracting the hostname from path for the log file it reads, etc. i rely on my syslog-ng config to properly store host data in a correct location regardless of how the raw data may be formatted, meaning raw data may have wrong hostname but syslog-ng puts it in correctly defined path, etc. why just this one linux host and not all my data? ... View more

ok, the data is syslog data and it does have abbreviated weekday as a field, however, this is not the definition of assigned hostname by path segment for the data source, so perhaps a bug in Splunk? Specify which segment of the source path to set as the Host field. For example: 3 (sets to 'hostname' for the path /var/log/hostname/) my syslog-ng data gets written as template("$DATE $TZ $WEEKDAY $ISODATE $HOST $FACILITY [$LEVEL] $MSG\n") example raw syslog entry: Apr 1 00:10:01 -04:00 Sun 2012-04-01T00:10:01-04:00 host01x03 cron [info] crond[21399]: (root) CMD (/usr/lib/sa/sa1 1 1) ... View more

i thought gzip's got CRC check but bzip did not? is bz2 in the list of files for bzip? i typically blacklist \.(gz|gzip|bz|bz2|z|zip)$ so to avoid even a CRC check, etc. blacklist for /var/log for my sles 11.1 (lastlog|\.(gz|gzip|bz|bz2|z|zip))$ also, if the file was written to after the rename the CRC check would still match since it looks at only the 1st 256bytes. in this case it seems like events can be missed since Splunk will not see the new file as new, etc. ... View more

all good info. CRC will indeed skipped non bzip rotated file, but will indeed re-index the bzip's. so i think my Q is solved. ... View more

you can also edit the role to include other indexes that will be included by default, hence no need to use index=xyz ... View more

what is the significance of 1.23457x10^-6 ?? that is a rather small number. if 10E-6 with hundreths at that unit scale is the resolution you need then regex out 8 digits, so 0.00000123 ... View more

can you give more info on what you mean by "text box showing %". showPercent property has default value of true http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/CustomChartingConfig-chartlegend#ratiobarchart ... View more

check out this Answer. http://splunk-base.splunk.com/answers/43487/iteration-function-syntax it is what you want, however, it wont be possible to display it in a timeline, only a table showing top 5 error codes with top 10 src per error code along with the count(src) per error code. so you can create a view that uses "earliest=X" and "latest=Y" to get your results for any timeframe. the timeline snafu is that for each error code event it may have been recorded at different times during the timeframe chosen. you could perhaps bucket the top5(error code) then top10(src) per bucket, say for 10m time slices, but that chart will be messy. is total count per search timeframe good enough? PLEASE NOTE, reporting on src IP may be mis-leading if the IP comes from DHCP and is not static, so you could have two different IP's in the list which could be the same host, or same IP that has been shared by different hosts during the timeframe of the search, etc. so be careful on how you report this data. ... View more

then i dont quite understand the results, because when i click over to the events view it shows all of the returned events from the search, so doesnt the additioanl pipe act upon those results? actually, index=cisco_firewall | top error_code limit=5 gives me all of the events that have count(error_code) in top 5 of all error code counts. it tables 5 lines, but the raw event list is huge. ... View more

ok, i get a weird output. i am expecting 50 lines in my table, but it only shows 28 and only 3 of the top 5 error codes. my table display is 50 per page. let me run some tests. ok, ran some tests, found why. there's an extraction issue for some events with specific event codes. as example: %ASA-5-304001 does not follow the same log format as say %ASA-4-106021 or %ASA-4-106023. could be a daunting task to find all of the problem codes and fix the extraction for each, but maybe not so bad for say top 10 or 20 error codes, etc. ... View more

nah, this doesnt work the way i need. this only gives table of the top 10 src for the top 5 error codes. i need the table to show top 10 src per each of the top 5 error codes. so the output table will have 50 IP's, 10 per error_code, etc. and to add more complexity, would like a "count(src) by error_code" next to each of the IP's (this will indicate how many times this IP caused the event with this error code). ... View more

you can see extracted fields from a general search on the left side, it will show you the fields which you can then use to act on in a search, eg "filename", etc. ... View more