Hi at all, I have a very strange behavior in one of my searches: I extracted a field from a raw as a part of a word: 2016-04-13 12.12.45 ZZ1234567890123456789 and I need to take only the first 8 letters after the date ZZ123456 ; I use the following regex ^.{20}(?\w{8}) . It runs and I can extract my field and show it in my tables. The problem is when I want to search using my field because if i write: index=xxx sourcetype=xxx Myfield="ZZ123456" I don't get any results. If I instead write: index=xxx sourcetype=xxx | search Myfield="ZZ123456" I find the correct log. The problem seems to be in the field extraction because if I extract the full string ^.{20}(?\w{21}) , the search runs in both the situations, but if I want to use only a part of it, the search doesn't run. Now I'm modifying all my searches, but it's a long job that I'd like to avoid. Anyone has an idea of how to intervene? Thank you in advance. Bye. Giuseppe ... View more

Hi at all, I installed the Splunk App for BlueCoat on my Splunk Enterprise 6.3.3. I installed the App following the tips and it seems to see all the logs correctly. My problem is that all the charts in dashboard don't show results because there are too many data. I tried to insert the parameter charting.data.count=0 in every chart but with no result. Anyone can help me? Thank you. Bye. Giuseppe ... View more

I did a dashboard panel that shows stats count results with a pie chart. I'd like to show in the panel title the total number of events (not the result number). I already used tokens to do this in other dashboards and usually runs well. This is an example: <title>Status ($Antivirus_count$)</title> <search> <query>index=XXX ...| stats count by Status</query> <progress> <set token="Antivirus_count">$job.eventCount$</set> </progress> <cancelled> <unset token="Antivirus_count"></unset> </cancelled> ..... but in this last panel, I have a very long search string with three piped stats count and where clauses; at the end I have a stats count command to show. I don't understand why in this panel, the result is always 0! If I try to use as Token job.resultCount instead of job.eventCount , the title correctly shows the number of stats (2). Anyone knows if there are situations where it's not possible to extract job.eventCount ? Thank you. Bye. Giuseppe ... View more

Hi at all, I installed Splunk App for BlueCoat. I loaded some test data and now I have to delete them before loading the production data. Logs are loaded in the "bcoat_logs" index and I have no problems to delete them. Instead, the problem is that App loaded logs also in a tsidx index and I don't know how to delete them. Can anyone help me? Thank you. Giuseppe ... View more

Hi at all, I have to send logs to a third party system by syslog. I configured my system and I'm able to send events to a third party system, but the receiver needs to have logs in raw or CEF format and Splunk sends syslogs in a different format. Is it possible to change the logs format or to send raw logs by syslog? Thank you. Bye. Giuseppe ... View more

Hi at all, I noted that in all my forms with Post Process Search, the Export in CSV button is disabled, even if I force it with link.exportResults.visible=true option. Anyone know if this is expected behavior or I have to modify something? Thank you. Bye. Giuseppe ... View more

Hi all, I found a very strange behavior related to Search Modes: - I have an index with many millions of events migrated from ArcSight, - if I run a search in Fast, Smart, or Verbose Mode, I have three different results! - Using the same search on a similar index with less buckets (4 instead of 167) I have always the same result in the three Modes. - Using the same search on the same index with less results (limiting the time period) I have always the same result in the three Modes So probably the problem is related to a limit in the max number of buckets used in the search. Someone can suggest to me where I could find the problem (and the solution!). Thank you in advance. Bye. Giuseppe ... View more

Hi at all I have to show the subtotal of a stats command, but the problem is to sort the results. My search is: tag=GP2 | stats count by code day | appendpipe [stats sum(count) AS Totals by code ] | sort code -count Using this search, I can sort only by code, but I have to sort by totals as shown below. Code day count totals Code1 2015-01-16 20 Code1 2015-01-15 15 Code1 35 Code2 2015-01-15 12 Code2 2015-01-16 10 Code2 22 In other words, I want to group results by Code, to sort by Total and in every code to sort by count. I found the way to sort only by Code, is it possible to do this? thank you. Giuseppe ... View more

Hi at all, I have to separate the results of a transaction to separately show each event. I'd like to do this because I have to aggregate events into a transaction to verify some rules (eventcount), but after, I'd like to separately show events. How can I do this? thank you. Bye. Giuseppe ... View more