Hi jameskerivan, I'm not quite sure what you're trying to do. Maybe attach some more data will help clarify. The eval case expression looks okay. It will assign the values "Send Now" and "Send on" to the field trans, based on the matched contents of field tt. If you want to filter the log messages after the case statement then you could use a where or search command. For example: ...| eval trans=case(match("*ONE_TIME_NOW*", tt), "Send Now", match("*ONE_TIME_ON*", tt) ,"Send on") | where trans="Send Now" If this is not what you mean then maybe provide some sample data and the expected result. ... View more

Hi sjohnehta and pdjhh, I must apologise, I've been playing around this morning (v6.3) and find I've been completely wrong. Splunk cron schedule is clever enough to take owner's timezone into account and runs according to the user's configured time zone. Check nex trun time under Settings -> Searches, reports, and alerts -> Scheduled time. It is not at all dependent on the search heads running timezone, as I thought and offsets are not needed. I'm going to adjust my answer, so other users do not get the wrong information. ... View more

Hi sjohnehta, If I've answered your question, please accept it so that others may find it. ... View more

Hi tikmads, As maciep states it would be easiest to schedule two alerts. Just create one alert, clone it, then alter the cron schedule. You could also use a report for the alert search allowing you to change the saved search (report) in one place. The cron syntax is: 0 7-19 * * 1-5 (run hourly, 7am-7pm inclusive, Mon-Fri) 0 7-16 * * 6 (run hourly, 7am-4pm inclusive, Saturday) There are plenty of cron websites out there and Splunk's cron documentation can be found here http://docs.splunk.com/Documentation/Splunk/6.2.5/Alert/Definescheduledalerts#Use_cron_notation_for_scheduled_alerts It would be possible to have just one alert and then use the search to filter out results based on day and time etc. Look here for an example: http://answers.splunk.com/answers/180682/how-to-write-a-cron-schedule-for-a-single-alert-to.html Doing this may potentially add unnecessary complication to your search however, and run searches when it's not necessary to. Hope this helps. ... View more

Hi skovalenko, You can configure an entry in transforms.conf and specify multiple delimiters for the key=value (kv) pairs in the event. Here's the example entry from the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Admin/Transformsconf [multiple_delims] DELIMS = "|;", "=:" The above example extracts key-value pairs which are separated by '|' or ';'. while the key is delimited from value by '=' or ':'. You can test the DELIMS configuration you need with the kv command, like so... |stats count as _raw | eval _raw = "url = http://blahblah.net/live/md-global/external/1p_regprofile/livenation1p_regprofile_3128.ts?a=value1&b=value2&c=value3"; | kv pairdelim="?&" kvdelim="=" |table * To automate, you will need to add a REPORT entry in props.conf to point to the transforms.conf entry and also restart Splunk (or try "http://you_splunk_server:8000/en_GB/debug/refresh" first to reload the configuration). Here's a good blog entry on extracting kv entries - http://blogs.splunk.com/2008/02/12/delimiter-based-key-value-pair-extraction/ ... View more

Thanks for the examples. The current rex command will also match the microseconds (\w matches numbers too) on the timestamp which probably explains the count mismatch. If the filetype . suffix is always at the end of each event line then this regex will be far more accurate. ... | rex "\.(?<file_type>[a-zA-Z]+)$" | eval file_type=upper(file_type) The [a-zA-Z]+ will now only match letters and the $ is a special character denoting line end. This should help prevent false matches. ... View more

Hi sjohnehta, Yes, to be clear; cron is not timezone "aware" so you will need to apply an offset from your local time to the to the server's UTC time. There are plenty of timezone conversion web sites if you need help in working out your offset (run some tests). Setting your Splunk UI user's timezone does not affect cron style scheduling, so just leave your Splunk users UI timezone to match your local time. Another issue you'll have is when there is a change to/from daylights saving time (DST), or summer and winter time. The server running in UTC will not change for DST so suddenly your alerts will running a 1 hour early or late, depending on when they were set. ... View more

Hi sjohnehta, Splunk cron schedule is clever enough to take owner's timezone into account and runs according to the user's configured time zone. Check next run time under Settings -> Searches, reports, and alerts -> Scheduled time. ... View more

Also remember that a "." in a regex expression means any character. You have to escape the . character with a backslash if you want to match a literal . character. http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/AboutSplunkregularexpressions ... View more

I suggest either the sed or the replace() commands. For example, ... | rex mode=sed "s/xA3/£/g" OR ... | eval Cat1 = replace(Cat1, "xA3", "£") ... View more

Hi Hattrick, The _time field is treated specially when displayed in splunk. The easiest way would be to eval the _time value into another field with strftime() and then use the new time field instead. For example ... | eval mytime = strftime(_time, "%Y-%m-%d %H:%M:%S") | table mytime ... Hope that helps. ... View more

Hi deanamite91, Just use the "rename" command to rename your column headers. ... | rename "Efficiency Variance (xA3)" AS "Efficiency Variance (£)" ...<and so on>... ... View more

Hi rrustong, Have a look at this wiki page which has a good example of rolling averages over different time periods. http://wiki.splunk.com/Community:Search_Report:_How_To_Create_a_Table_of_Day_of_Week_-_Monthly_Average_Vs_Daily_Average ... View more

Hi Samir, You can use the REST API to get this result. For example: | rest /services/alerts/fired_alerts/- |stats sum(triggered_alerts) AS count BY savedsearch_name, severity |eval severity = case(severity==1, "Info", severity==2, "Low", severity==3, "Medium", severity==4, "High", severity==5, "Critical") |rename savedsearch_name AS Alert |table Alert severity count Hope this helps. ... View more

Hi nancylawrence007, I understand the issue but I'm still not sure what you exactly want from the examples provided. As far as I know regex cannot count delimiters, so that is not an option. Basically, you need to normalise the logs so they always have the same number of fields, for which the sed command is perfect. So either, add an extra ";" between "field6;field_7" in log1 (32 fields), or substitute the ";" before DATABASE01 field in log2 (31 fields), or remove the ";DATABASE01" section (31 fields) I'd recommend #1, as #2 means you would need to perform another regex on the substituted field to extract its two values, and #3 removes a field (though it could be extracted earlier). Anyway, the "rex mode=sed ..." run anywhere example below would do the trick (assuming log1's 6 & 7 fields are consistently a "number;ip_addr") for #1 option. |stats count as logs | eval logs="Jun 18 14:10:57 lec05674568 ABC[455135]: 2015-06-18 14:10:57;indexserver;lec056741;XBE;06;30893;11.91.6.128;lec056287312;9580;9599;LEC Audit - SYSTEM Logins;CRITICAL;CONNECT;SYSTEM;;;;;;DAPNAPS;UNSUCCESSFUL;;;;;;invalid username or password;;5562789;;|Jun 18 14:10:57 lec05674568 ABC[455135]: 2015-06-18 14:10:57;indexserver;lec056741;XBE;06;30893;DATABASE01;11.91.6.128;lec056287312;9580;9599;LEC Audit - SYSTEM Logins;CRITICAL;CONNECT;SYSTEM;;;;;;DAPNAPS;UNSUCCESSFUL;;;;;;invalid username or password;;5562789;;" | eval logs=split(logs, "|") |mvexpand logs | rex mode=sed field=logs "s/((?:[^;]+;){5}\d+;)(\d+\.\d+\.\d+\.\d+;.*)/\1;\2/" | eval log_fields=split(logs, ";") |eval field_count = mvcount(log_fields) Now, both logs have the same number of fields (as the field_count shows) and whatever regex extraction you are using will work. ... View more

Not exactly sure what you want, but maybe splitting the events into multivalue fields and then using multivalue eval commands will get the results you need. If will certainly give you a count of the number of fields. Anyway, here are some examples of how to use eval's mv commands to extract fields and will hopefully get you going (ignore the first half which is just creating the test output). |stats count as logs | eval logs="Jun 18 14:10:57 lec05674568 ABC[455135]: 2015-06-18 14:10:57;indexserver;lec056741;XBE;06;30893;11.91.6.128;lec056287312;9580;9599;LEC Audit - SYSTEM Logins;CRITICAL;CONNECT;SYSTEM;;;;;;DAPNAPS;UNSUCCESSFUL;;;;;;invalid username or password;;5562789;;|Jun 18 14:10:57 lec05674568 ABC[455135]: 2015-06-18 14:10:57;indexserver;lec056741;XBE;06;30893;DATABASE01;11.91.6.128;lec056287312;9580;9599;LEC Audit - SYSTEM Logins;CRITICAL;CONNECT;SYSTEM;;;;;;DAPNAPS;UNSUCCESSFUL;;;;;;invalid username or password;;5562789;;" | eval logs=split(logs, "|") |mvexpand logs | eval fields = split(logs, ";") | eval n1 = mvfind(fields, "LEC.*") | eval extract_field1 = mvindex(fields, n1) | eval n2 = mvfind(fields, "CONNECT") | eval extract_field2 = mvindex(fields, n1,n2) | eval n3 = mvfind(fields, "DATABASE\d+") | eval n3=if(isnull(n3), 5, n3) | eval extract_field3 = mvindex(fields, n3+1) | eval c = mvcount(fields) | eval extract_field4 = case (c==31, mvindex(fields, c-3), c==32, mvindex(fields, c-3)) | ... <etc> ... Also refer to the eval comand in the docs for further reference and even more mv commands that you can use to hopefully get the results you want. http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/CommonEvalFunctions#Multivalue_functions ... View more

I can't argue with that and agree your answer is best practise. I guess it all depends on the use case, environment and risk profile that chawagon03 is working with on the approach to take. ... View more

Hi Chawagon03, The splunk user is just like any other user on the LINUX system, so, assuming you're using local authentication, you need to set a local password for the "splunk" user. As the root user (or a system user with appropriate sudo permissions), simply use the "passwd splunk" command and set a password. For example: root@fwdr:~# passwd splunk Enter new UNIX password: Retype new UNIX password: passwd: password updated successfully root@fwdr:~# Hope this helps. ... View more

Though, thinking about it again, if the field time pattern is unique across all fields, then you do not need to worry about the number of delimiters (or sed) and the following would work too rex "([^;]+;)+(?\d\d:\d\d);" ... View more

Nice answer MuS. Just thinking that if the event ending is different, then you may also be able to just extract the time with something like this (if no other fields match the time pattern) . ... |eval Event_TimeStamp=_raw |rex mode=sed field=Event_TimeStamp "s/([^;]+;)+(\d\d:\d\d)(;.*$)/\2/" ... View more

Hi bravon, This search may prove more efficient, as it does not use a sub-search like map. index=_audit action="login attempt" OR (action=search info=completed) | eval matchtime = if(match(action,"login attempt"), _time, null) | eval extendtime = if(isnotnull(matchtime), relative_time(matchtime,"+300secs"), null) | reverse | streamstats last(matchtime) as matched, last(extendtime) as lasttime | where _time >= matched AND _time <= lasttime | reverse The reverse is necessary for the streamstats command to work correctly, as it needs to work from earliest to latest, in this case. On a larger dataset the reverse may prove less efficient than the map command. ... View more