I wanted to make a search - report accelerated. Search query : index=*| chart count over host by tag::action usenull=false Summary span i set is 1 day I get 81k events results for this search. So, wont this be accelerated , since it fails to meet 100K events . Conditions: The number of events in the hot bucket covered by the chosen Summary Range must be equal to or greater than 100k. You will see a Summary Status warning that says Not enough data to summarize when this condition exists. Please advise. ... View more

I do index an unstructured log file , where i want to extract email_id in that. Since, email ids are present in different location of the log entry , Splunk's field extraction method doesn't help me. Is there any trick to resolve this ? ... View more

Sample log: Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: PCI bridge to [bus 11-11] Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: bridge window [io 0xf000-0x0000] (disabled) Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: bridge window [mem 0xd3d00000-0xd3dfffff] Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: bridge window [mem 0xd5300000-0xd53fffff 64bit pref] Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.7: PCI bridge to [bus 12-12] props.conf: [my_custom] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true I set the above property to break that single event , but it seems it doesnt work, since the Timestamp is same in all the events does it always consider this as a single event ? or any other settings to include in my props ? Please help Source : http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Indexmulti-lineevents ... View more

I want to extract fields from a customized log (no pre-defined/standard log structure) I do need to extract a field name "Description" where it has its appropriate values at different locations in various events. Using multilple REGEX alone I can able to locate the values. Can i use multiple REGEX to extract a single field ? My config files: props.conf [myprops] REPORT-Description = extract_desc transforms.conf [extract_desc] REGEX = (,DESC,) REGEX = (\((\d|)\)) FORMAT = Description::$1 FORMAT = Description::$2 I am trying to achieve as above , Is this correct way ? ... View more

I wanted to upgrade Splunk version 5.0.4 to 6.04. Splunk Instance: License Master Server Platform : CentOS Please Suggest whether i can directly install the new rpm on top of the existing instance? Does it require a downtime (restart)? I have several Indexers connecting with these master license servers. (indexers are already running v6.0.4) Please advise. ... View more

Is there any online regex tool to create regular expressions for given sample data ? ... View more