CL has just been added to the app. The scripts should help you provide FTP automation, as well as QAUDJRN exports. ... View more

You could simplify the syntax for that search, using timechart: host=* | timechart by sourcetype. When no data is coming in, the chart should still update, as long as you have a real-time range selected. The "null values" combo box has a selection to treat null/missing data as 0 or to connect it to the next value. ... View more

I tried your stanzas in my lab, and the events are being filtered properly. I tested with your original RegEx (which is more efficient than using no anchor, but doesn't account for possible odd multi-line behavior). You might contact support to see if there is an issue when using a forwarder. One other option might be to try specifying the transform using host or source , to see if it's limited to sourcetype . One other consideration: My lab is eating the security eventlog as a file, rather than using WMI. The structure is exactly the same; however, the issue may have something to do with the input. Cheers ... View more

You can test your RegEx in Search, before you hit the drawing board with props/transforms. Use: ... | regex "EventCode=(4634|4624|4769)" to make sure your events show. ... View more

If you remove your ^ anchor, it should work: REGEX=EventCode=(4634|4624|4769) EDIT: Don't forget to restart Splunk after making/changing an index-time transform. ... View more

One more note: an index-time extraction will not apply to data that has already been indexed; it will only operate on new data being indexed after the extraction is defined. It will also require you to restart Splunk to activate it. IMO, use a search-time extraction. Search-time changes to props.conf can be loaded using this search syntax: "| extract reload=t" ... View more

Another side note: you can test a search-time extraction in the UI using the REX command. If you search, "* | rex "ERROR(? .*?)\n" and check the field picker for "topten", you can see if it's working properly. ... View more

It's difficult to provide help, without sample data. If you're confident the RegEx should work, then the problem looks to be: 1. In the FORMAT clause, remove the quotes surrounding $1. It's a variable, not a string -- it references the first capture buffer in the RegEx, stuff surrounded by (). 2. The portion of your REGEX clause that you would like to capture in $1 needs to be buffered, so enclose the portion of the RegEx that contains the data you want, like this: ERROR(.*?)\n This would capture anything between ERROR and newline into topten. On a side note, is there a reason you are doing this at index time? I would recommend using a search-time extraction, like this, and scrap your fields.conf and transforms.conf entries: props.conf: [log4jlog] EXTRACT-topten = ERROR(?<topten>.*?)\n Cheers ... View more

Copy the stanza into $SPLUNK_HOME/etc/apps/unix/local/inputs.conf and override whatever values you want to change in the new file. For instance, set interval= . Values specified in conf files in /local will override those in /default ... View more

Almost! It would be like this -- and it will create a new field from the RegEx: ... | rex field=myfield "(? \S+)$" ... View more

For the *NIX app, the scripted inputs can be found in $SPLUNK_HOME/etc/apps/unix/default/inputs.conf. Copy the parameters you want to change, and place them in $SPLUNK_HOME/etc/apps/unix/local/inputs.conf. If you modify the values in /default, they will be overwritten when your app is updated to a new version. Note the "interval" parameter in the iostat.sh stanza in inputs.conf: [script://./bin/iostat.sh] interval = 60 sourcetype = iostat source = iostat index = os disabled = 1 HTH ... View more

Note: You will need to create the respective index, prior to running the collect command. ... View more

Click Manager-->Indexes, then "Enable" the _audit index. It should then be fixed when you restart Splunk. ... View more

Stop Splunk, make a backup of $SPLUNK_HOME/etc/passwd, then remove the file. When you restart Splunk, it should allow you to login with the defaults: admin/changeme ... View more

I'll edit the answer to show how to add the CRC salt. Use as the value. ... View more

What is the scenario/use case (there may be a better way to accomplish this)? What IP's are you trying to track, and how are you discovering them? With NBTSTAT, you should only see hosts in your broadcast domain, or those that unicast with your host. Are you running this on the WINS, looking for cached NetBIOS names from clients who have made NBN registrations? The NBN cache has a default timeout of something like 10 minutes -- you might need to adjust the registry entry to cache them longer. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\CacheTimeout Your script that runs NBTSTAT should do the translation, if you want them done prior to indexing. I recommend having it provide both the IP and NetBIOS name to the indexer. This way, you won't have to rely on the DHCP logs, but can use them as another measure to ensure the validity of your data. You are correct, Splunk can do the correlation between your DHCP logs and NBTSTAT script data, based on lease time and timestamp. You might even want to correlate them to WINS events, and SPlunk can do this, too. As a side note, the Windows DHCP app might be of assistance here: http://splunkbase.splunk.com/apps/All/4.x/app:Windows+DHCP ... View more

Your posted config should work, except for the monitor. If I understand what you're trying to accomplish, I would expect it to look like this: [monitor://C:\Program Files\Splunk\etc\apps\my logs\home_logs\] disabled = false recursive = true host_segment = 8 index = my_indx crcSalt = <SOURCE> EDIT: added crcSalt to resolve 'too small' error. This will index everything in the home_logs folder and all sub-folders. Recursive is the default, but declaring it will help ensure there's not an override somewhere else. ... View more