Hi all, I have 2 indexes: index="abc" with fields uri , a , b , c and index="xyz" with fields url , x , y , z Now the fields url and uri have the same values in both indexes, but this is just a change in the field name. I want to search both the indexes for all fields a , b , c , x , y , z by url index="abc" or index="xyz" | eval url=uri | stats values(a),values(b), values(x), values(y) by url Problem is it is only showing the fields a , b and not x , y in stats results. any help !! ... View more

Hi all , i am trying to merge my results from 2 searches running over different indexes that have a common field "url". index ="abc"| join url [search index="xyz" | eval url=uri | fields + url, a,b,c ] i have used the eval command because in index "xyz" field name is uri but the values are same. What i am looking of is To merge these 2 results and output uncommon fields from index "abc" and index "xyz along with "url". Please help ... View more

HI all , I want o index specific files inside a zip folder. Directory structure is like this. D:/Reports/abc.zip/x(empty folder)/y(empty folder)/z(empty folder)/abc.txt,pqr.csv,lmn.csv Also the tool will generate same zip structure i. D:/reports but the zip file name will be different. Rest all the structure beneath the .zip will be same like below D:/Reports/abc.zip/x(empty folder)/y(empty folder)/z(empty folder)/abc.txt,pqr.csv,lmn.csv D:/Reports/123.zip/x(empty folder)/y(empty folder)/z(empty folder)/abc.txt,pqr.csv,lmn.csv I have 2 questions How to index lmn.csv file only. How to make sure that indexed lmn.csv file should be overwritten as soon as there is a new lmn.csv file genrated by toll in D:/reports. PLs help !! ... View more

Hi , I am trying to index Vulnerbility Scanner reports in Splunk. I have configured my Vulnerbility Scanner to store the reports in a location D:\reports . So it creates files in directories like D:\reports\abc.zip\1\en\vulnerability.csv . Everytime scanner will run it willl log a report in D:\reports\ .So that means in abc.zip\1\en\vulnerability.csv only the zip file name will change.So i have configured the following in inputs.conf [monitor://D:\reports\...\vulnerability.csv] initCrcLength = 1024(changed it because reports have common headers) crcSalt = <SOURCE> disabled = false But i am not able to see the files being indexed. pls help !! ... View more

HI All, I have some concerns on archiving of logs of clustered indexes. 1.How to do archiving of clustered indexes since if we go by normal script, duplicate copies will be archived because of cluster. How we can cluster only one unique bucket across the cluster. What is the best practice to do this ? 2.How we can archive the data from Splunk to Amazon S3 directly since to access Amazon S3 we need to provide parameters like Amazon Secret key, Amazon Key id, name of S3 bucket. How we can achieve this ? Donot wanna uSe shuttl as it maintain its own index and my searches have a huge dependency on main index. Please provide some inputs on it. Lohit ... View more