Hi bruceclark, You could use the Splunk sedcmd to make the reformat the input data into proper json format. Using your example data I've got the Splunk to recognise it as json with the following configuration in props.conf . [my_reformatted_json] DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n]+)\s*{ SHOULD_LINEMERGE = false MAX_EVENTS = 256 NO_BINARY_CHECK = true category = Custom disabled = false pulldown_type = true # use sed to massage the data to make is json compliant SEDCMD-1addleadfieldquote = s/([\w\[\]]+:\s)/"\1/g SEDCMD-2addtrailingfieldquote = s/:\s/": /g SEDCMD-3addkvcommas = s/(\w)(\s*)([\r\n])/\1,\3/g SEDCMD-4addvaluequotes = s/(:\s+)([[a-zA-Z\-\/][^,]+)/: "\2"/g SEDCMD-5striplastkvquotes = s/(,)([\r\n])(\s+\})/\2\3/g SEDCMD-6addbracecommas = s/(\}\s*)([\r\n])(\s+\")/},\2\3/g Not sure if this have very good preformance over a very large data set. You may need to increase MAX_EVENTS also if number of event lines is greater than 256. OR You could also use props and transforms to extract field value pairs from the input data. For example props.conf ... [my_json] REPORT-json-extr = json-extr transforms.conf ... [json-extr] REGEX = ([\w\[\]]+):\s+(?!{)([^\r\n]+) FORMAT = $1::$2 MV_ADD = true REPEAT_MATCH = true This would only extract lines with matching field: value pairs from the input. But maybe that's all you need anyway. Hope this helps. ... View more

Hi JdeFalconr, I suggest saving each host specific search into a dashboard panel, i.e. run each search and save the search as a panel into an existing pie chart dashboard. index=myindex | stats count by host,sourcetype| where host="your_hostname" |table sourcetype count Not sure what version of Splunk you have but in 6.x there is a post search dashboard functionality that allows you to run the base search in your dashboard and then post searches (i.e. the where host=... |table ... ) for each dashboard panel. http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Savedsearches#Basic_post-process_example Hope this make sense and helps. ... View more

Hi ragedsparrow, I guess your INDEXED_EXTRACTIONS = csv is configured in the forwarder's props.conf (Splunk v6) then the forwarder will be parsing the csv file into a structured stream first and then passing it to the indexer ready for immediate indexing (i.e. the indexer will not parse the file again). Refer to the following in the docs: http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Extractfieldsfromfileheadersatindextime#Caveats You will need to deloy your props configuration to your forwarders, or define another sourcetype for the csv files and ensure the INDEXED_EXTRACTIONS does not happen on the forwarder so the data is forwarded to the indexer in an unstructured state. Hope this makes sense and helps. ... View more

The date string in Example1 is not a quoted string so the field value breaks on the first whitespace after the equals sign (default behaviour). All the other ExampleX fields are single value strings. Note, in the following run anywhere example, the Example1 value is quoted and default key value (kv) field extraction works okay. | stats count as _raw | eval _raw="Nov 2 2015 11:06:00:200AM , Example1=\"Nov 2 2015 11:06:00:260AM\" , Example2=ALONGNUMBER, Example3=7 , Example4=7 , Example5=STANDARD, Example6=AGuestAccount , Example7=SomeCommand, Example8=example-server, Example9=5992, Example10=60" |extract However, you can't expect to be able to change you source data so that it's a quoted string, so Splunk also allows you to define delimiters for the kv field extraction. Here's another run anywhere example where Example1 is not a quoted string and the kv splits on the comma. | stats count as _raw | eval _raw="Nov 2 2015 11:06:00:200AM , Example1=Nov 2 2015 11:06:00:260AM , Example2=ALONGNUMBER, Example3=7 , Example4=7 , Example5=STANDARD, Example6=AGuestAccount , Example7=SomeCommand, Example8=example-server, Example9=5992, Example10=60" | extract pairdelim="," kvdelim="=" Best of all, Splunk can be configured to automatically extract kv fields using props and transforms configuration. I suggest you read the following Splunk blog article for more details. http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/ Hope this helps. ... View more

Hi sidekix24, You could use the addtotals command to give you row totals and then a foreach command to to iterate over each field to calculate a percentage value. Here's an untested example of what I mean. ...|chart count by RequestFormat group |addtotals |foreach 1 2 5 10 15 20 25 28 timeout [ eval <<FIELD>=round(('<<FIELD>>'/Total)*100, 1) . "%" ] Hope this helps. UPDATE: fixed untested example. ... View more

Hi stwong, If you run is the following search is the result greater than 10,000? source="/tmp/sendmail.txt" from="<[email protected]>" |stats count If so, you are hitting the default subsearch limit of 10,000 results. http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Aboutsubsearches *..., by default subsearches return a maximum of 10,000 results and have a maximum runtime of 60 seconds. * This can be increased in the limits.conf file. Hope this helps. ... View more