Just realized 🙂 Thank you @martin_mueller. ,Just realized. Thanks @martin_mueller ... View more

Yup...you got it ... View more

Unfortunately, that's the format they are in. Multilines with no spaces 😞 ... View more

Not sure if you got the answer. With v6.2, png should be inside Splunkhome/etc/apps/appname/static/ Name: appIcon_2x.png Refresh or Restart. Hope this helps ... View more

xmlkv and path should help you. Please refer this answer http://answers.splunk.com/answers/54957/how-to-extract-data-from-xml.html Hope this helps. Thanks, Raghav ... View more

Not sure if i understood correctly, let's say relay can hold relay = something.gov.ab.ca as well as relay = somewhere.google.com ? if so, you can use base search|rex field=_raw "relay=\w+\.(?<Domain>.*)\s" Pardon me if i am going tangents, can you post sample for relay=xxx.google.com as well? I assumed the pattern as "something.google.com" Hope this helps, Thanks, Raghav ... View more

Thanks a ton @aweitzman. Culprit here is me, just realized that my config file reads "props.confs". See if you can throw a punch at my face through your next comment 🙂 ... View more

Please add a back slash before S+ and s. It disappeared from my post. ... View more

The address you are trying to extract is part of a key value pair Try this: .....|rex field=_raw "relay=\S+(?.*)\s" ... View more

Adding to what @acharlieh has mentioned, if you mention the extraction under default stanza, it should take precedence and apply to every sourcetype. Example The following stanza extracts an ip address from _raw EXTRACT-extract_ip = (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}) [foo] ....... [bar] Hope this helps. Thanks! Raghav ... View more

Could you please post me your props stanza and sample log you created to replicate this? I want to see where the heck i am doing wrong. ... View more

This is what i found in the logs :'EVAL-foo' in stanza [aaa]: The expression is malformed. An unexpected character is reached at '”:”,””)'. ... View more

CALLING_STATION_ID is a field in the actual data. Example log XXXXXXXXX= S13456 PORT-ID = 1//1/1/1 FRAMED-IP = 1.2.3.4 NAS-PORT-TYPE = 5 CALLING-STATION-ID = 12:ae:45:y2:35:3d NAS-IP-ADDRESS = x.y.x.xy And is extracted by splunk at the index time. ... View more

Tried, didn't work. EVAL-MACID = replace(CALLING_STATION_ID,"([-:.])","") in props.conf, restarted splunk and MACID is not in there. Also tried ...=replace(CALLING_STATION_ID,"([-|:|.])",""), no luck here either. Any different route you recommend? Thanks, Raghav ... View more

Adding to @MuS , with 6.x above, application.css and application.js are ignored. You have to link the stylesheet in the simple xml code. Oh and use firebug to get the classes eg.fieldset and add a reference in your application.css . I have done something similar a week ago to an app. Thanks, Raghav ... View more

Google maps app is not supported starting 6 and above. However, splunk has maps builtin. Search for iplocation. Here's an example search ...|iplocation ip|geostats count by ip hope this helps ... View more

Use this too see if the index you are referring to exists: |REST /services/data/indexes|dedup title|table title. Also check the inside db/to see if the index is listed. ... View more

See Martin's post http://answers.splunk.com/answers/177866/why-am-i-getting-splunk-enterprise-setup-wizard-en.html. I guess 'wait' is the answer for a patch according to that post. ... View more

Alternative,Splunk 6.x and above has built-in maps .Search for iplocation. Here's an example search sourcetype=iplogs|iplocation ip|geostats count by ip. Hope this helps ... View more

See This: "The Splunk Web service installs but does not run Beginning with Splunk Enterprise v6.2, the splunkd service handles all Splunk Web operations. However, on Windows instances, the installer still installs the splunkweb service, although the service quits immediately on launch when operating in normal mode. You can configure the service to run in legacy mode by changing a configuration parameter in web.conf. See "Start Splunk Enterprise on Windows in legacy mode" in the Admin manual. Important: Do not run Splunk Web in legacy mode permanently. Use legacy mode to temporarily work around issues introduced by the new integration of the user interface with the main splunkd service. Once you correct the issues, return Splunk Web to normal mode as soon as possible." Link : http://docs.splunk.com/Documentation/Splunk/6.2.0/Installation/Aboutupgradingto6.2READTHISFIRST ... View more

My bad. Here's the path : Splunk/etc/system/local/alert_actions.conf (which you've mentioned already on the primary post). Very Interesting. Cool thing would be, see if you can install Splunk ENT Trial on a different machine and try the above process. If it works, free license needs to be blamed 🙂 ... View more