As described in Splunk Docs - inputs.conf you could Filter to remote Adresses, processes and users. remoteAddress = <regular expression> * A regular expression that represents the remote IP address of a host that is involved in network communication. * This setting accepts a regular expression that matches against IP addresses only, not host names. For example: 192\.163\..* * The input includes events for remote IP addresses that match the regular expression that you specify here. * The input filters out events for remote IP addresses that do not match the regular expression. * Defaults to unset (including all remote address events). process = <regular expression> * A regular expression that represents the process or application that performed a network access. * The input includes events for processes that match the regular expression that you specify here. * The input filters out events for processes that do not match the regular expression. * Defaults to unset (including all processes and application events). user = <regular expression> * A regular expression that represents the Windows user name that performed a network access. * The input includes events for user names that match the regular expression that you specify here. * The input filters out events for user names that do not match the regular expression. * Defaults to unset (including all user name events). ... View more

wich version of splunk are you running? and is it your outputs.conf or props.conf? ... View more

It should work like this: [ mycsv ] CHARSET=AUTO INDEXED_EXTRACTIONS=csv KV_MODE=none SHOULD_LINEMERGE=false category=Structured disabled=false pulldown_type=true HEADER_FIELD_LINE_NUMBER=1 FIELD_DELIMITER=, Can you give an example of your csv, inputs.conf and props.conf? ... View more

You can change the setting in the server.conf [license] report_interval = <nonnegative integer>[s|m|h] * Selects a time period for reporting in license usage to the license master. * This value is intended for very large deployments (hundreds of indexers) where a large number of indexers may overwhelm the license server. * The maximum permitted interval is 1 hour, and the minimum permitted interval is 1 minute. * May be expressed as a positive number of seconds, minutes or hours. * If no time unit is provided, seconds will be assumed. * Defaults to 1 minute, or 1m. ... View more

First of all only to get it right... you run this search two times? Once with index=sterling once with index=sterling_nonprod right? (only if not try "index=sterling OR index=sterling_nonprod") Second is the attribute permission_type available in both of your indexed datasets (indexes)? ... View more

Can you show the search you are running? ... View more

Yep in this case the answer of richgalloway is the more accurate. As I said. It only was quick and dirty. ... View more

you could try those two: rex field=_raw "RESPONSE_CODE:(?P<RespCode>\d+)" rex field=_raw "errorCode\":\"(?P<ErrorCode>\d+)" Edit: escaped quotes and used + thanks to richgalloway ... View more

in this case you have to be more granular. So in worst case you have to make an enviroment app for every app (or bundle) that you deploy with its own inputs.conf ... View more

You can deploy all three apps to your test enviroment. The only thing you have to change is the copy of Test Enviroment App to fit your other enviroments. If the Path changes in your enviroments there is no other way than take the whole stanza in the Enviroment app. you could do something like this IIS App [monitor://Z:/IIS/Log/] sourcetype = iis ignoreOlderThan = 1d ... Test Environment App [WinEventLog://Application] index = test_infrastructure [perfmon://Available Memory] index = test_infrastructure [monitor://Z:/IIS/Log/] index = test_iis disabled=1 ... [monitor://Y:/IIS/Log/] index = test_iis disabled=0 sourcetype = iis ignoreOlderThan = 1d ... ... View more

can you show us where you use the macro? ... View more

try @sundareshr updated answer 🙂 this is really great ... View more

This should work | gentimes start=11/01/16 end=11/31/16 | search starthuman!="Sun*" |rex field=starthuman "^(?<day>\C{3}).*" | eval daycount = if(day=="Sat",0.5,1) | stats sum(daycount) ... View more

you could try this: index=index_cbo (CNPJ="12018955000155" OR CNPJ_WS="12018955000155") but I didn't really understand why you need a subsearch... maybe it would help if you pastebin a small sample of your data and give us a preview of the table you expect to see after your query ... View more

ok then you can use this data. Why don't you use the "c" attribute of the user? normally there should the country of the user be. and you could use the department attribute for the external users. ... View more

Ok, how can you seperate them? Are they all in an Active Directory? Do they use diffrent subnets? ... View more

Can you give some more information? What Datasources do you have? It is possible to make performance dashboards and filter to regions. I did something like this. A Worldmap where the locations with a bad latency get marked. ... View more

You can do it like this: [yourSourcetype] LINE_BREAKER=(\r\n+)\d{2}-\d{2}-\d{4} If your event starts like 20-06-2016 ..... as twinspop said. LINE_BREAKER is preferred over BREAK:ONLY_BEFORE_DATE ... View more

You could make your own sourcetype in the props.conf there you can use the parameter LINE_BREAKER = [regular expression] like [yourSourcetype] LINE_BREAKER=\r\nCalling-Station.* ... View more

There is a little mistake. The mvzip command uses an comma as seperator so the semikolon in the rex command must be replaced with an comma. Than it works perfectly! Thank you again ... View more

Thank you very much. This worked and is faster than my subsearch. ... View more