You would make both our lifes a lot easier if you could provide some example data and a mockup of what you would like your results to look like 😉 ... View more

I just put that search into my Splunk, and it is perfectly valid. The only thing that I had to remove is the useother=´useother´ part - because I don't have that macro. Just in case, can you post the content of that macro? ... View more

Hey, you're right, I missed that part. I've to admit I don't know why there's a Powershell add-on when Powershell support is already built-in. The built-in seems to use the 5 positions, so, yeah, yours should work (and also, it seems to work, if not reliable. You could try setting schedule = 300 to run it every 300 seconds, also the execution time wouldn't be aligned to :*5 and :*0. Also, you could try to search index=_internal host=yourhost ExecProcessor to see when the ExecProcesor schedules your input and for what time/schedule - maybe you can see any strange behavior in those logs. ... View more

Do you have any other ( or ) in the rest of your query? ... View more

I'm surprised that the input is running at all. Common inputs have 5 positions. Powershell inputs however use the Quartz Syntax, so they have 6 positions: Check this manual for details: https://www.quartz-scheduler.net/documentation/quartz-2.x/tutorial/crontriggers.html Edit: If you change your crown format, it should work properly. <- Only true for the Powershell add-on. ... View more

For CSV-like data, DELIMS work pretty well. Take a look at this for example: https://www.splunk.com/blog/2013/03/11/quick-n-dirty-delimited-data-sourcetypes-and-you.html However, if your data changes its format, that might be problematic. If the new column gets appended last, it might work just defining more fields in your transforms. Basically, when your data changes its format, you should ingest it with a different custom sourcetype that fits your data. 😉 ... View more

From the manual: There are universal forwarder packages available for all platforms except HP/UX You could: - put those files on a file share and mount that file share an a supported system - send your logs via syslog, if supported - maybe other workarounds I didn't think of ... View more

I see two possible ways: What would most likely be the "cleanest" way is creating a custom alert action. You could then schedule a search and have your custom alert action trigger, it being provided with the result of that search. I've not done this yet and please be aware that Splunk still runs Python 2 (sadly). You could start on that here. The quick and dirty approach would be run Splunk CLI and have it output the results in CSV style, then load that CSV into your python and there you go. The CLI command could be like this: splunk search "index=badguys yoursearchhere | stats count by something" -output csv -auth admin:changeme Pick your poison. 😉 Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Did you try setting your search time range to "all time"? ... View more

Did you follow these instructions? http://docs.splunk.com/Documentation/AddOns/released/JBoss/Configureinputs Did you see, that JMX seems to require another Splunk TA to be installed? I've no experience on JBoss, so I've no idea of the details 😉 ... View more

The PDF export for dashboards built into Splunk is not really pretty, and there's sadly no way to improve on it. You can do a workaround, like setting up a system that opens a dashboard in actual browser and then uses some browser plugin to screenshot it. There's actually an app for that in development by Splunk PS, but it's not public yet. You might be able to get by contacting support... Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Yeah, the broken symlink says that your... symlink is broken 😄 You should check with your docker admin who set up that link from the outside into the containers, because it obviously doesn't work. I've too little knowledge on docker to fix that, but if you login as the user Splunk is running as, and do a less /docker/log/containers/d.log , you should get an error message, too. Therefore, the file is simply not accessible, which is an OS/filesystem issue, not a Splunk issue. ... View more

Be aware that data pre-processed by an HF is much larger on the network than what an UF sends. You might add complexity without reducing the data stream, plus you have to do all the parsing work on the HF then 🙂 ... View more

The only information I could find on this is in this question/answer: https://answers.splunk.com/answers/225758/splunk-on-chromebook.html Be aware that that question relates to Splunk Enterprise, so the concers about too little ressources do not apply. What I take from that post is that it's basically possible, because Splunk has no dependencies, and just "works" after unpacking it. You might however run into permission issues, or logs being in different locations, so you might have to adapt your inputs, but it should work. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Yes, UFs don't parse data, so you can still do that on the indexers. HFs can also output uncooked data, there is an option for that in outputs.conf, however I've no experience with it and only heard(!) that it might still cause trouble. If you have the choice, and no need for pre-processing, but only use it as a concentrator, maybe plus syslog collector, I'd always choose a UF and do the parsing on the indexers. It also saves on network bandwidth, because cooked data is 2-3 times "heavier". 😉 ... View more

If you're comparing your regexes you will see that the regex for that field is missing a single character 😉 ... View more

Hey, you're regexes are good, but need to contain "named capture groups". The name of such a capture group will determine the field name in Splunk. I fixed your regex for SrcIP, see this regex101 link, it will help you fix your other regexes accordingly: https://regex101.com/r/1QfM2q/1 But: shouldn't that app you're using already extract those fields? ... View more

Then try this: | rex "OPPORTUNITY_JOB:\s+List\s+size:\s+(?<listsize>\d+)[\D|$]" ... View more

Did you try including the sqlite3 package too? ... View more

I fixed the regex in the comment above, sorry, I made a copy&paste error. The line you showed this time is different from it's structure, however, this regex should work for all lines: | rex "-\s+(?<jobtype>[^:]+):.*?(?<jobcount>\d+).*?$" Be aware that this regex is rather generic, because the log formats are different, and it might capture the wrong data in some cases. ... View more

| rex "Writer\s+-\s+(?<jobtype>[^:]+):\s+Batch.*?successful.*count\s+:\s+(?<jobcount>\d+)\s+and" The \s+ always mean "one or more whitespaces, e.g. space, tab, newline etc. ... View more

That would definetely be something to check. 🙂 Also, EXTRACT happens before REPORT, but they're sorted by ASCII-order, not by the order they appear in the file. Therefore (just as an example), an EXTRACT-test_format would happen after an EXTRACT-application , and it would also happen after an EXTRACT-ZZZ , because uppercase letter come before lowercase in ASCII. Just want to make sure. For more infos on search-time sequence order, check this: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence ... View more