No update? ... View more

This problem can be solved if you have Lookup Editor installed in your SplunkCloud search head. In that app, there's a way to configure a new KV Lookup and that includes taking care of collections-conf name. ... View more

Enlightening. Thanks. ... View more

^ prolly the fastes way to do it ... View more

If your logs from outerspace use atomic clock that is programmed to represent the current UTC, taking into account the effects of Einstein's generalrelativity (curvature of spacetime), then there shouldn't be any problem. The problem you will have to deal with is the delay in _indextime . See, your log's _time is the information your search timepicker will look after. Say your spaceship has a log at 2020-03-01T00:00:00 about a malfunction of one of its thingamagjiggies. Your search head that is on Earth has an alert that looks after "malfunctions on one of the thingamajiggies" every 5 minutes. It will cause an issue if the log arrives on your Earth-bound indexer 6 minutes late. Because at 2020-03-01T00:00:00 and at 2020-03-01T00:00:05 , the alert wouldn't be able to detect the log (because it's not ingested yet). And at 2020-03-01T00:00:10 , the alert would've already missed it. There are however tweaks that can solve these types of issues. In short, having a Splunk forwarder from outerspace wouldn't cause much headache as long as the network is alright (heck, I've seen NASA livestreams from low-orbit space, forwarding logs wouldn't be that hard). ... View more

If you wish to append slightly varying timestamps on the raw logs, I think it's best to do this pre-ingestion...like via a python script. I can imagine a loop through all the logs and appending timestamp. ... View more

what a freaking life saver. i was on fast mode ... View more

Not an answer but just curious as to why wouldn't you perform there filtering in the first level search, such as index=server site=login NOT [| inputlookup savedfile | fields test_ip | rename test_ip AS ip] ? ... View more

Try this | makeresults | eval _raw = "\"header.JMSDestination\"=\"topic/testTopic/Durable-Non-Subscription/20\"" | rex "testTopic\/(?<field1>[^\"]+)" | rex field=field1 mode=sed "s/\//./g" | rex field=field1 "Durable-(?<field2>.*)$" ... View more

By paper, it should capture this [ FIELDNAME = The quick brown fox jumps over the lazy dog. ] If you try it on | rex or on regex101.com, it does work. But when implemented on transforms.conf, it only captures "The"...so, the field value will be "FIELDNAME = The" instead of entire "FIELDNAME = The quick brown fox jumps over the lazy dog." It's not appropriate anymore to show evidence that the regex is working via | rex or regex101.com because as I've said before, it does work via those mediums. But not when used in transforms.conf for index-time field extraction, it doesn't. Out of frustration, I've changed the strategy of capturing the fields by enclosing values with double quotes (e.g. [ FIELDNAME = s0m3 vaLu3 ] becomes [ FIELDNAME ="s0m3 vaLu3" ] ) using SEDCMD on props instead of transforms.conf. Thanks for the help. ... View more

Same issue, mate. I've used your transforms and it still fails to capture the entire thing and halts at whitespace [aap_fields_discov] REGEX = \[\s*(\S+)\s\=\s(.*?)\s\] REPEAT_MATCH = true WRITE_META = true ... View more

My old Regex also works on | rex but it does not on transforms.conf ... View more

Edited transforms.conf with your regex. Stopped Splunk. Deleted index using "clean eventdata" (don't worry, it's a dev machine). Then restarted Splunk. Re indexed the file using one-shot. Still fails to capture the entire value. It stops at whitespace . ... View more

Same result ... View more

The differentiating information is host, not name of index. Also, you don't install wineventlog on an indexer because and indexer should be a dedicated server (cluster of servers) which purpose is solely for indexing. ... View more

Assuming that the 10 companies are in the same network the "single site" you're referring to, there shouldn't be any problem. Install Universalforwarders or Heavyforwarders on the 10 companies you mentioned. And using your Deployment Server, you can install apps you can manage--all remotely. These are apps such as TAs that collect logs from different sources and/or configuration files (e.g. outputs.conf) that tells Splunk to send logs to your intermediate Heavyforwarder (or direct to the indexer cluster). Each company "may" have their own indexes but if you configure them to send logs to your indexer, that should solve the issue. However, if the 10 other comapanies you're referring to are in totally different network of their own, then, you might want to consider other solutions like using HEC on a heavyforwarder that has rules to allow incoming HEC posts. ... View more

Not an answer but just wanted to point out that this portion | where (strftime(_time, "%Y-%m-%d") >= "2019-12-09") AND (strftime(_time, "%Y-%m-%d") <= "2019-12-10") might not work as expected. It's better to make comparison operation like greater than if the time is in epoch, rather than formatted in string. maybe consider doing |where _time >= strptime("2019-12-09", "%F") AND _time <= strptime("2019-12-10", "%F") ... View more

Making time snap to the next 10th minute | makeresults | eval now = now() | eval now_snapped_to_next_10th_min = relative_time(now(), [| makeresults | eval now = now() | convert ctime(now) | rex field=now "\d(?<min>\d)\:(?:\d{2})$" | eval min = 10 - min | eval min = if(min == 10, 0, min) | eval adder = "\"+" . tostring(min) . "m@m\"" | return $adder]) | convert ctime(now*) timeformat="%F %X" ... View more

this is how it should be done. upvoted ... View more

@wmyersas I think it's much more recommended now that Splunk is moving to "compute" rather than daily volume type of billing customers. Search time extractions will defo use more compute to load into RAM rather than displaying fields that have already been burned onto the disk. ... View more