sorry but there was a mistake copying the regex: \n*(?<myfield>.*Failed\))\n* Bye. Giuseppe ... View more

try this \n*(?.Failed))\n you can test it on https://regex101.com/ Bye. Giuseppe ... View more

Set your tags starting from eventtypes creation, assigning a tag to an eventtype as you want complex, don't start from creating a new tags, you'll reach your target. Bye. Giuseppe ... View more

Your regex seems to be correct (backslashes before underscore aren't needed). verify sourcetype. bye. Giuseppe ... View more

Without a log example I can only suppose that you did some of my same old errors: wrong sourcetype wrong regex Had you verified your regex in Splunk or regex101.com? can share an example? bye. Giuseppe ... View more

You can do it also using web interface: Settings -- Forwarder and Receiving -- Configure Forward Bye. Giuseppe ... View more

it's the same thing : Client Computer : (? .)\n Object DN : (? .)\n Object Class : (? .)\n Object GUID : (? .)\n Action : (? .)\n Old Value : (? .)\n New Value : (? .)\n Request ID : (? .) You have to extract every field inserting \n at the end Bye. Giuseppe ... View more

Insert in your html tags the following line <ul> <a target="_blank" href="/app/atm">ATM Monitoring</a> </ul> where atm is the main directory of the app. Bye. Giuseppe ... View more

If you want to extract only the string after message= but not the other lines, you have to insert \n at the end of your regex, see below: Message=(?.*)\n if you want to try this regex use https://regex101.com/ Bye. Giuseppe ... View more

What is your problem? Can you explain it? Splunk usually manage upgrade of a single file with insert of new lines, without particular configurations. Are you using a Forwarder or is a local file? Bye. Giuseppe ... View more

You can also modify it in your searches at search_time: | eval yourfield=if(yourfield="WARNING","WARN",yourfield) in this way tou maintain logs as originals and show them as you want Bye. Giuseppe ... View more

Sure, because Splunk Universal forwarder optimize and compress data before send them to the Indexer. In addition, you can configure a network bandwidth value so you don't fill your network. see: - http://blogs.splunk.com/2011/10/24/choosing-a-forwarder-or-not/ - http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/useforwarders Bye. Giuseppe ... View more

I had a similar problem and I solved it loading data in a separate index instead a lookup table. Bye. Giuseppe ... View more

insert your request in the Partner Portal as an enhancement. Bye. Giuseppe ... View more

I used tscollect. your_search | table fields... | tscollect namespace=blueacoat_stats and in searches I used | tstats count FROM blueacoat_stats | ... Bye. Giuseppe ... View more

Using Summary indexing I found a large benefit in terms of performances (also ten times quicker!), for example with BlueCoat logs that have billions of events every day! Problems are that it's impossible to delete a part of summarized logs, but only the full tsixd file (I asked to Splunk to take in consideration the opportunity to insert the delete functionality), this means that you cannot do errors in summarizing, because you cannot delete them. In addition using Summary indexing there is a delay in data access because logs are indexed two times and you have to wait that logs are indexed before to summarize them. In my case I have a larger delay because I have to be sure that logs are really all arrived before summarizing. There aren't many checks on the summary indexing operation, so there is the risk to index twice a log or lost it. At the end there is a greater disk space occupation, but in my case is less of the problem. In conclusion: use it because is really useful but attention! Bye. Giuseppe ... View more

try something like this index=nitro_prod_comm_pci com.impl.AgnosticOmsTokenTranslator "Calling translate" | eval nsearch="search1" | append [ search index=nitro_prod_comm_pci com.impl.AgnosticOmsTokenTranslator "Message translation is successful" | eval nsearch="search2" ] | append [ search index="nitro_prod_comm_email" INFO EmailType=Order_Confirmation | eval nsearch="search3" ] | stats count by nsearch Bye. Giuseppe ... View more

And in addition, if you modify or add a .conf file, you have to restart Splunk!. Bye. Giuseppe ... View more