in my logs the "connectionid" on one _raw log and the fcid I tried this sourcetype=foo | rename connectionid AS transactionid fcid AS transactionid | transaction transactionid and it seems to work but there has to be a better way. ... View more

Separate a field values and use the parts to make a new field. My host names have four components in the name separated by a dash: i.e. "location-group-function-number.domain.com" I would like to separate the parts of the name and recombine them as: "Loc-num" I used this regex to go from the FWDN to the netbios name: rex field=host "^(?<name>.+)\.domain\.com" I tried using the makemv delim=”-“ name but this just gives me more values for “name” I though of using three regex functions one to each part then use strcat to put them back together but this seems a bit to much code for a simple task I have this format: host=”Loc-Grp-Func-##.domain.com” For readability on the report I would like: name=”Loc-##” Any suggestions would be helpful ... View more

in the outputs.conf file there is a place to send logs to multiple indexers [tcpout:my_indexers] server = xxx.xxx.xxx.xxx:9999, yyy.yyy.yyy.yyy:9999, zzz.zzz.zzz.zzz:9999 As I understand it this will send 1/3 of the logs to each indexer I would like to setup an outputs.conf that will send all the logs to different indexers. One for one group of analysts and another for the second group of analysts. We can not share the indexers on a distributed search from the searchhead. Thanks for any help you can give ... View more

I can write a search like this: | dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" | Search * How would I do a dbquery Join Statement for two different databases??? | dbquery "DB1|DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP" This doesn't work!! Any help would be great ... View more

I have authentication logs like below: ,AUTHN_METHOD_FOO,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,123!@#123!@#123!@#asdfgdvfd,username,FIRST,LAST, I want to use regex to build transform for a field called username and first and last I had this but it didn't work rex "(?i)AUTHN_METHOD_*+,*+,*+,*+,*+,(?P<username>[^,]+)" Any help would be great!!! ... View more

I require and RSA pin&tokencode to be entered in the password field on the splunk login page. My managment has asked if I can change the word PASSWORD on the login screen to PIN & TokenCode I think the place to do this is the; share/splunk/search_mrsparkle/templates/account/login.html on this line; <p> <label for="password"><%doc>TRANS: Prompt the user to enter their password to login</%doc>${_('Pin & TokenCode')}</label><br /> <input type="password" name="password" id="password" ${'' if enable_login_form else 'disabled="true"'} /> </p> I would like to put these changes in the /system/local/something.file so that the change does not get overwritten with updates. Where should I put the custom modification and what should the file name be? ... View more

I am calling from a large VOIP network. My outgoing phone number is different from my actual desk number. When i call Splunk Support the new phone systems does not recognize my number since it it the general outgoing number. How do I fix this so I can call into splunk support? ... View more