Hi Splunkers, I getting two types of logs: 1>fireeye 2>dlp on the same port(514). two logs are being indexed to main index. now i want to separate those two to different indexes are 1>fireeye 2>dlp. at the same time i need to override source type also for both. please help me on this......... ... View more

Hi, I am getting the logs from SBG,but splunk couldnt able to index those logs. I need to index those logs. I did field extraction for first 3 fields are common in every event. The main problem is The next fields depend up on the 3rd field that is action. Now i want to extract those fields and i need to name it for search purpose. below are the example events. 1> jul 7 04:02:01 wipro-blr-out01 ecelerity: 1404685921|cb5bdd57-f792c6d000001154-e6-53b9ce619b84|ACCEPT|203.91.221.85:50090 2> Jul 7 04:02:01 wipro-blr-out01 ecelerity: 1404685921|cb5bdd57-f792c6d000001154-e7-53b9ce61f951|IRCPTACTION|[email protected]|annotate 3>Jul 7 04:02:01 wipro-blr-out01 bmserver: 1404685921|cb5bdd57-f792c6d000001154-e7-53b9ce61f951|VERDICT|[email protected]|content_300|default|legal disclaimer if u see above events fisrt 3 fields are common so i named it. Now i want name the rest of fields by using following search. index=main sourcetype=ec_sbg_outbound action=accept----- now i will get all the events of action=accept it has only one field after action so i need to name for that field. like that i have to do all the action types.. please help me in advance thanks..... ... View more

Hi, I have installed splunk forwarder on linux which is having symantec Brightmail Gateway. and i tried to forward the data from that machine to splunk indexer that forwarder sending data only one file under the folder. The path which i have given while adding the monitor: '/var/log/mail/symantec/inbound' under the inbound i want to read everything which has extension of type '.gz' i am getting error that is "parameter should be in this format '-parameter value' " while try to give the path like '/var/log/mail/symantec/inbound/*.gz' can anyone tell me why its happening like that please....... ... View more

Hi [index=main host=syslog status="deny"| top src_IP | table src_IP ]:::::this is my sub search. and it will produce top 10 src_IPs like below. 10.0.0.0 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.5 10.0.0.6 10.0.0.7 10.0.0.8 10.0.0.9 Now I want to check the status where status="start" OR status="accept" for the above src_IPs in the same index and host. Please help me in this.. Thanks in advance. ... View more