The best way to set the sourcetype is in inputs.conf The best way to do regex on the host field is a transforms with SOURCE_KEY = MetaData:Host The best way to set the host field is in inputs with a reference to a directory where the host information is stored. Complicated regex is never recommended. And when regex can't be avoided, it can usually be simplified a lot. If the first three points have received due diligence, a link to the regex101 test plus the primary objectives of the regex should be provided. Currently, it appears that regex is not necessary. ... View more

And: SHOULD_LINEMERGE = true. And unless more than 100 "=" is a deal breaker, you might as well just let it stop at 5: [your_sourcetype] BREAK_ONLY_BEFORE = \={5} SHOULD_LINEMERGE = true ... View more

Among the simpler options entirely sidestepping Splunk are syslog, or network directory share to the app. Unless you are looking to leverage the data compression of Splunk during forwarding to limit bandwidth or the file tracking and tailing on the client, a data stream separate from Splunk forwarding should work well enough. So, if you don't want Splunk to touch the data, is there any reason why another option cannot be considered? And for the record, Splunk can be configured to send the data uncooked from the universal forwarder to the app, but as you noted, there will still be a limited degree of interaction with the data. ... View more

Your forwarder should send the data to two forwarders: a heavy forwarder with the TA for processing and forwarding to index and another machine which indexes separately without processing for distribution to the app. ... View more

After verifying the time on the server and client, one solution is to refresh the webpage so that it can present you with the option to bypass/accept the SSL certificate in cases where a warning may be present. ... View more

There is no search involved here. What do you mean? ... View more

I am in Houston getting ready for Hurricane Harvey to come in Friday through Monday. I would like to improve that app and even create a Cloud version, but I just can't find the time yet. All development help on the app is welcome. It still needs more extractions and dashboards. ... View more

I downvoted this post because "sum(active_hist_searches)" doesn't have any real meaning. if i reported a million times in an hour that there was 1 active search, you would see 1 million searches as "total". ... View more

Here is a much more elegant solution which can plot all days on the same day in timechart: | eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day. ... View more

Here is a much more elegant solution which can plot all days on the same day in timechart and does not require the use of an app: | eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day. ... View more

Here is a much more elegant solution which can plot all days on the same day in timechart: | eval series=strftime(_time, "%m-%d") | eval time_delta=(now-_time)/86400,time_day=ceiling(time_delta),_time=_time+time_day*86400 | eval day=case(time_day=0,"Today",time_day=1,"Yesterday",time_day=8,"SD last week") | timechart fixedrange=false sum(count) by day This allows you to plot any time range by series or to assign nice names in the case statement to each day based on its relation to the current time/day. 86400 is the number of seconds in a day. ... View more

I think that you meant to make this a reply to my comment on your answer above... ... View more

So is the solution then to configure a props to extract the field first so that it is available before the transform's report call? Or is there a better solution? ... View more

Here is the transform stanza: [ds_msg_client_handshake] CLEAN_KEYS = 0 REGEX = \/handshake\/reply\/(?P<deploy_client_name>[^\/]+)\/(?P<deploy_client>\S+) SOURCE_KEY = channel ... View more

The channel field is extracted by default against the splunkd sourcetype. I didn't do anything to extract "channel". You can see the events in your own deployments by searching: index=_internal sourcetype=splunkd component=PubSubSvr reply handshake PubSubSvr | dedup channel | table channel deploy* ... View more

search time ... View more

Altering what segments can be searched with TERM involves changing the segmenters.conf: http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Segmentersconf Be aware that changes in the characters for major and minor segmenters in the default stanza will have a big effect on ALL data indexed and the disk space required for indexed data. To affect a particular sourcetype, reference it in the stanza name. .. Or to your other question and more simply/safely, you could just create a transforms that indexes a field of interest at index time which could key on an indexed field and would be called from props on a sourcetype basis. ... View more

Have you done it with that app? Can you recommend the best way to configure it to index the information of interest? ... View more

I filtered out some events and found these: DESKTOP-X {"timestamp":"2017-07-18T23:06:25.020252Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol"} DESKTOP-Y 07-18-2017 18:06:24.514 -0500 WARN DistributedPeer - Peer:https://192.168.0.103:8089 Failed to get server info from https://192.168.0.103:8089/services/server/info response code=401 DESKTOP-Y 07-18-2017 18:06:24.512 -0500 WARN GetRemoteAuthToken - Unable to get authentication token from peeruri="https://192.168.0.103:8089/services/admin/auth-tokens". DESKTOP-Z 07-18-2017 18:07:03.658 -0500 WARN AdminHandler:AuthenticationHandler - Denied session token for user: splunk-system-user DESKTOP-X {"timestamp":"2017-07-18T23:06:50.074866Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol"} Perhaps something in one of those? What exactly should I be looking for? ... View more

I filtered out "current_size=0" and only found some old events: index=_internal blocked=true NOT "current_size=0" | table host _raw DESKTOP-Z 07-15-2017 01:02:00.551 -0500 INFO Metrics - group=queue, name=tcpin_cooked_pqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1006, largest_size=1006, smallest_size=0 DESKTOP-Z 07-14-2017 01:02:03.697 -0500 INFO Metrics - group=queue, name=indexqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=989, largest_size=989, smallest_size=0 DESKTOP-Z 07-12-2017 01:03:08.728 -0500 INFO Metrics - group=queue, name=tcpin_cooked_pqueue, blocked=true, max_size_kb=500, current_size_kb=499, current_size=1006, largest_size=1007, smallest_size=0 ... View more

Forwarders are 6.6.2 SSL is turned off, I believe. Here are some of the errors; I guess there are a few problems here but not sure what they mean or what to do about them: index=_internal error OR warn| table host _raw DESKTOP-X {"timestamp":"2017-07-18T20:55:23.198225Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol"} DESKTOP-X 2017-07-18 15:55:23 ERROR [12572] (CaptureServer.cpp:2151) stream.CaptureServer - Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol DESKTOP-Y 2017-07-18 15:54:52 ERROR [4604] (CaptureServer.cpp:2151) stream.CaptureServer - Unable to ping server (f58c7e0a-7060-45dd-855e-80784cd6348d): Unable to establish connection to localhost: unknown protocol DESKTOP-Y {"timestamp":"2017-07-18T20:54:52.120805Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (f58c7e0a-7060-45dd-855e-80784cd6348d): Unable to establish connection to localhost: unknown protocol"} DESKTOP-X {"timestamp":"2017-07-18T20:55:18.185058Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol"} DESKTOP-X 2017-07-18 15:55:18 ERROR [6380] (CaptureServer.cpp:2151) stream.CaptureServer - Unable to ping server (5f43b1e8-b496-4a99-98ae-f557d42eabd5): Unable to establish connection to localhost: unknown protocol DESKTOP-Y 2017-07-18 15:54:47 ERROR [6648] (CaptureServer.cpp:2151) stream.CaptureServer - Unable to ping server (f58c7e0a-7060-45dd-855e-80784cd6348d): Unable to establish connection to localhost: unknown protocol DESKTOP-Y {"timestamp":"2017-07-18T20:54:47.112086Z","agentMode":0,"level":"ERROR","message":"Unable to ping server (f58c7e0a-7060-45dd-855e-80784cd6348d): Unable to establish connection to localhost: unknown protocol"} DESKTOP-Z 2017-07-18T15:56:23-0500 [CRITICAL] [rpcstart.py], line 381: action=rpc_server_has_been_abnormally_terminated error=Unsupported JRE version detected Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rpcstart.py", line 379, in <module> _start_rpc_server(sys.stdin.read()) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rpcstart.py", line 363, in _start_rpc_server run(configs) File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\rpcstart.py", line 156, in run raise Exception("Unsupported JRE version detected") Exception: Unsupported JRE version detected DESKTOP-Z 2017-07-18T15:56:23-0500 [CRITICAL] [jre_validator.py], line 76 : Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\bin\dbx2\jre_validator.py", line 31, in target self.process = subprocess.Popen(self.command, **kwargs) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 390, in __init__ errread, errwrite) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 640, in _execute_child startupinfo) WindowsError: [Error 2] The system cannot find the file specified ... View more