Below is the props.conf at $SPLUNK_HOME/etc/system/default: [SPLUNK_SERVICE_Log] lookup_table = namelookup Id OUTPUT Name I added same entry under $SPLUNK_HOME/etc/apps/search/default But it didnt made any difference and the error persist Below is the transforms.conf at $SPLUNK_HOME/etc/system/default: [namelookup] external_cmd = namelookup.py Id Name external_type = python fields_list = Id, Name However, when I run below search, I get "Error in 'lookup' command: The lookup table 'name_lookup' does not exist." source="Test_Log.txt" | xmlkv entry | lookup namelookup Id OUTPUT Name | table Id, name Script location : $SPLUNK_HOME/etc/apps/search/lookups/namelookup.py The script runs perfectly well as standalone program but gives error when called from Splunk. Any idea why this is happening? I restarted Splunk after I modified props.conf/transforms.conf. This is on version 4.1.5. Thanks! ... View more

I am trying to add the DB2 database module (i.e ibm_db-1.0.3-py2.6-win32.egg) to Splunk Python on Windows 2008 Server 64 bit OS I found a similar question here: http://answers.splunk.com/questions/8/can-i-add-python-modules-to-the-splunk-environment http://answers.splunk.com/questions/6033/adding-python-module-to-splunk When I did the steps mentioned in the posting, it doesn't extract anything. So please let me kno where i am going wrong. Here are the steps Copy the ibm_db-1.0.3-py2.6-win32.egg file to c:\Splunk\bin Extract Python Module using below command didn't do anything: cd c:\splunk\bin splunk cmd python setup.py install Opens up a new command prompt window and immediately closes it. I am sure it didnt do anything as i didnt find aynthing extracted in the folder C:\Splunk\Python-2.6\Lib\site-packages I also tried copying setup.py to c:Splunk\bin but it didnt help. Then i tried the following command which didnt work either $ splunk cmd ./ibm_db-1.0.3-py2.6-win32.egg So i am not sure if their is an easy way to add python module to Splunk. Please note i am using Python version of Splunk i.e. 2.6 ... View more

I have read the documentation and successfully extract values using static lookup from a csv file into my search results. But i would like to achieve a similar behaviour from database i.e. connect to database and extract value from table into my search results. I use Splunk 4.1.5 and have following questions: Is their a specific DB2 driver which needs to be loaded into Splunk in order to talk to database What type of driver - Is it JDBC-ODBC driver Do we need to write lookup script to talk to database or it can be done by modifying configuration files If it has to be a lookup script , then i guess it has to be Python script. So what about Java Developers who doesn't know Python ? I guess their is a opportunity to learn Python. But whats the learning curve and where to start? how to setup a JDBC connection to DB2 database in the Splunk config files How to use the DB2 connection to lookup a table in Splunk at search time? I wish their is a step by step tutorial for this as it involves multiple steps/vendor specific drivers. Anyways an example with a sample code to connect to DB2 database would be greatly appreciated. ... View more

I have researched extensively splunk Documentation and Google to check if Splunk provides features like SQL commands "IN" or "Exists" . The link (Splunk For SQL Users) doesnt talk about IN or Exists so wondering if this feature is available in Splunk. Here is the search query which is suppose to return multiple rows for contractId, memberId combination as one contractId will have multiple memberIds. But it displays only the first match of memberId and ignores the rest, after adding "max_match=999" it displays all the memberIds but in single row whereas expected result has to be in multiple rows i.e. contractId, memberId combination per row Here is the XML <DataNode node-type="Roster"> <TransactionAttributes> <entry key="CONTRACT_ID">contract1_100</entry> <entry key="MEMBER_ID">member1_100</entry> </TransactionAttributes> </DataNode> <DataNode node-type="Roster"> <TransactionAttributes> <entry key="CONTRACT_ID">contract1_100</entry> <entry key="MEMBER_ID">member2_100</entry> </TransactionAttributes> </DataNode> <DataNode node-type="Roster"> <TransactionAttributes> <entry key="CONTRACT_ID">contract1_100</entry> <entry key="MEMBER_ID">member3_100</entry> </TransactionAttributes> </DataNode> Here is the splunk query source="Test_Log.txt" | xmlkv entry | rex "(?i)\<TransactionAttributes\>\<entry key=\"CONTRACT_ID\"\>(?<contractId>[^\<]+)" | rex "(?i)\<TransactionAttributes\>\<entry key=\"CONTRACT_ID\"\>\w+\<\/entry\>\<entry key=\"MEMBER_ID\">(?<memberId>[^<]+)" |where contractId="123" |table contractId, memberId The query produces following results in single row contractId memberId contract1_100 member1_100 member2_100 member3_100 whereas Expected Results is contractId memberId contract1_100 member1_100 contract1_100 member2_100 contract1_100 member3_100 ... View more