I'm working with a dataset that lists companies and individual people, so that some entries have the field "Entity Name" and some have "Individual Name". I'd like to output a table with both of these fields shown under a single "Name" field. When I try to rename them both by this title, though, the second command overwrites the first one. Is there a way to have both fields listed under the same title, while keeping them as separate events? ... View more

Hi everyone, I have installed splunk db connector 2, using the last splunk version. I have follow the installation step, so I have installed mysql, jre and the db driver. Still I have a problem: RPC service down, I have active the debug mode to check where could be the problem, and these are the log: 04/08/2015 03:02:47 [CRITICAL] [rpcstart.py] RPC server has been terminated abnormally with error [[Errno 2] No such file or directory]. 04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] attempting to disable RPC server "rpcstart://default" 04/08/2015 03:02:46 [CRITICAL] [rpcstart.py] rpcstart failed with Exception: "[Errno 2] No such file or directory" 04/08/2015 03:02:46 [DEBUG] [rpcstart.py] UseSSL: False 04/08/2015 03:02:46 [DEBUG] [rpcstart.py] start running 04/08/2015 03:02:31 [DEBUG] [rpcstart.py] jcommand = [u'/opt/jre1.8.0_40/bin/java', u'-Xmx1024m', u'-XX:+UseConcMarkSweepGC', '-classpath', '/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/commons-logging-1.1.2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/mysql-connector-java-5.1.35-bin.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-http-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-api-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jackson-all-1.9.11.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/servlet-api-3.1.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/slf4j-log4j12-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-compiler-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-security-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-annotations-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-io-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/dbx2.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/avro-ipc-1.7.6.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/log4j-1.2.17.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/antlr4-runtime-4.4.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/jetty-util-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax-websocket-server-impl-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/slf4j-ext-1.7.7.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-client-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/javax.websocket-api-1.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-servlet-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/jcs-2.0.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-api-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-common-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/websocket-server-9.2.4.v20141103.jar:/opt/splunk/etc/apps/splunk_app_db_connect/bin/lib/ext/commons-io-2.4.jar', '-DSPLUNK_HOME=/opt/splunk', 'com.splunk.dbx2.rpc.RPCServer', u'127.0.0.1:9998'] May someone help me? Thank you! ... View more

Hi everyone, I have this search: index=main sourcetype=WinEventLog:Security | eval Logon_failur = case((EventCode==4625 AND (Status==0xC0000234 OR Status==0xC0000072 OR Status==0xC0000193 OR Sub_Status==0xC0000234 OR Sub_Status==0xC0000072 OR Sub_Status==0xC0000193)), "FailedToLogOn", EventCode==531, "AccountDisabled", EventCode==532, "UserAccountExpired", EventCode==539, "AccountLockOut" ) | bin _time span=1h | stats count by Logon_failur | where count>50 But I get this error: Error in 'eval' command: The expression is malformed. Expected XOR. The problem is that I cannot use XOR, because it is not what I'm trying to do. I need the first value and one of the succeeding values, and if both of them match, I will have "true". How can I do this? And second question, in your opinion, is the second part of the search starting from "bin" correct? Thank you ... View more

Hi to everyone, I have a quick question. Using the splunk framework I have create different query that produce lookuptable, a few of these are stored in search/lookups, other are stored in mynewapp/lookups, how can I say to my splunk framework to store all the lookuptable in the search/lookups folder? ... View more

Hi everyone, I have create a regular expression query that match in a long list of pathname 1 specific folder, and next cut everything that there is after this folder: index=main " | rex "\s\-\s\[(?<path_dd>.+)\specific_folder" | dedup path_dd | eval path="file:read:"+path_dd+"*" | sort by path| table path | outputlookup output.csv append=True Next, I have add inputlookuptable at the start of the query, this table contain always path name, and there is one only field per line: path So I have tried to edit the query like that: | inputlookup write_rules.csv | rex "(?<path_dd>.+)\/specific_folder" | table path_dd But it's not working, can anyone help me? Thank you Example of the file: /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/host-manager/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/examples/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/SESSIONS.ser /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/docs/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/manager/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/_/loader /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/xwiki-temp/aether-repository/org/apache/maven/doxia/doxia-core/1.3/_maven.repositories /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/xwiki-temp/aether-repository/org/apache/maven/doxia/doxia-core/1.3/doxia-core-1.3.pom /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/xwiki-temp/aether-repository/org/apache/maven/doxia/doxia-core/1.3/doxia-core-1.3.pom.ahc26f05574a43e4fce /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/xwiki-temp/aether-repository/org/apache/maven/doxia/doxia-core/1.3/doxia-core-1.3.pom.sha1.ahca7be2b392cec49e7 /home/jenkins/qa-automation-smcconnell/Automation/Tomcats/tomcat7/work/Catalina/localhost/xwiki_oracle/xwiki-temp/aether-repository/org/apache/maven/doxia/doxia-core/1.3/doxia-core-1.3.pom.sha1 ... View more