Take a look at $SPLUNK_HOME/etc/system/default/segmentors.conf. You can add your own key/value segmentors by creating that file in ./local/. As always, test, test, test before deploying into production:) You can also check out http://docs.splunk.com/Documentation/Splunk/latest/admin/Segmentersconf ... View more

In props.conf insert: SEDCMD=s/(?sm)Key Length: 0(.+)//g That should remove everythign after "Key Length: 0" ... View more

To find the index config for the audit index, try this: on that specific search head: cd $SPLUNK_HOME find . -name indexes.conf | xargs grep audit That should show you a list of files that contain a definition for the _audit index. You can do thee same for any other. I would suggest forwarding data from the search head to the indexers though https://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/Forwardsearchheaddata This will alleviate the disk issue on your search heads and also allow you to search internal indexes centrally. ... View more

I don't believe you can edit the generated search directly. The generated search is what splunk will run and is based on your KPI search configuration (base search, data model, or ad hoc). As for the deep dive view, I think what is used to populate the swim lanes is the generated search w/a sparkline command ( something like: your_kpi_search | stats sparkline .....) ... View more

Can u paste what you are seeing as search string for base and deep dive? If you look at the KPI, go to the search & calculate tab, look at the search. At the bottom of that pop-up, click on "Generated Search". That is the actual search for that specific KPI (even though the base search runs only once for all KPIs). The "generated search" is the same search that will be used when, from a deep dive, you choose "Open in search" from the deep dive. Hope this helps. ... View more

You can create your own roles, and edit existing roles. Do you have something more specific you're looking to do? If you mean userA can see only one glass table, than you can create a role that has required functionality and limit that specific role using the permissions for the glass table(s) in question. Take a look at: https://docs.splunk.com/Documentation/ITSI/2.4.1/Configure/Configureusersandroles ... View more

I think I have it. This does th e "OR" check for DBNAME: \w+ and does not capture that. HTH REGEX = (?:\[tid:\s+\d+\]\s+\[DBNAME:\s+\w+\]|\[tid:\s+\d+\])(?P<message>.+) ... View more

How about something like this? in props.conf: REGEX = .+\[tid:\s+\d+\](?P<message>.+) This captures DBNAME: SAMPLE as well. Not sure if you want that or not. I'll work on it a bit more to see if I cna have a single regex to do it, but I imagine, knowing the name of DB might be useful? ... View more

Try this: In props.conf: TRANSFORMS-set = myfieldextract In transforms.conf [my_fieldextract] REGEX = "(\w+)":"([^"]+) FORMAT = $1::$2 That will extract all fields/values for you (i think:)) ... View more

Check the file permissions on that file maybe? ... View more

You should only need to restart the heavy forwarder(s). ... View more

I just realized this is still out there. Sorry I missed that. Have you seen: http://wiki.splunk.com/Set_up_Splunk_for_Cisco_IronPort_Web_Security_Appliance This might be the easiest thing to do, as Cisco_WSA_squid is a known sourcetype, and should make you life alot easier. ... View more

The FIELDS = needs to be a quoted string list as in: FIELDS = "status","message_id","message_delivered_date","message_delivered_time","service","payload" I see that difference and Ido not have DATETIME_CONFIG = CURRENT. I would remove that setting anyway, as the docs say this about it: DATETIME_CONFIG = * Specifies which file configures the timestamp extractor, which identifies timestamps from the event text. * This configuration may also be set to "NONE" to prevent the timestamp extractor from running or "CURRENT" to assign the current system time to each event. * "CURRENT" will set the time of the event to the time that the event was merged from lines, or worded differently, the time it passed through the aggregator processor. ... View more

sorry -too fast on the draw. I didnt see the additional info around possible 2nd "_"'s occurring. gdziuba's answer works perfectly (or so I think:)) ... View more

I just typed this all out, and now it seems to have dissappeared, so apologies if it all appears twice: I used the props and transfroms I inserted above and all worked for me. A few things - 1) check and make sure you have referred to the correct transforms stanza in your props,conf (coldfusionapplicaiton in your original post), or replace the contents of your stanzas in your props and transforms with the contents of mine above. Make sure to rename the REPORT-getfields to the correct value. 2) check that your sourcetype is not defined in multiple locations (mine are in $SPLUNK_HOME/etc/apps/search/local/ props.conf and transforms.conf 3) You can go to :http://localhost:8000/en-US/debug/refresh and click the refresh button(if on your laptop, or enter your splunk servername) and refresh props and transforms without having to restart splunk. ... View more

(?P<field1>\S+)_(?P<field2>\w+) ... View more

Try these: (sorry, I changed names, etc:) - u can insert TZ into props.conf if you have systems in disparate timezones. Props.conf: [cfapplog] SHOULD_LINEMERGE = False pulldown_type = 1 REPORT-getfields = cfapp_fields Transforms.conf: [cfapp_fields] DELIMS="," FIELDS = "status","message_id","message_delivered_date","message_delivered_time","service","payload" ... View more

can u paste a bit of source data by any chance ? maybe 2 or 3 lines, w/IP's changed ? ... View more

So - if a double quote exists, there is a pair of them around the message body? If no double quotes, than no "message" ? Just trying to picture it in my head. You can do a conditional pipe in the middle of the regex. Can you describe what would constitute a "message" or at least, what would precede a message? I think I can do it; just need a bit of detail first. ... View more

Try this one: REGEX= (?ism)"(\w+)":"([^"]+)|timestamp":(?P\d+) FORMAT = $1:$2 ... View more

There's only one double quote in your events above. Can u edit maybe? As well, if you could include the props.conf entries and/or transforms that come into play, that would help. If you're doing a tab separated extract, you might need to get more specific using transforms since tabs can appear within field values. ... View more

Sorry - just re-read your post. This should suffice, I think: "(?P<message>.+)" this will extract everything between double quote marks and assign the field named "message". (remove the single quote marks) If you can post the contents of your props.conf and a few more sample events, we can review and make sure it will work. ... View more