Going by your requirement, I assume you want to see transactions started in a particular time frame that took longer than a certain duration with the end potentially outside the selected time frame? Here's a thought, untested and in pseudosplunk: sourcetype, host, and whatever (eventtype=req OR eventtype=ack) | transaction unique-id | where duration > two hours | where start time is in your time frame ... View more

You may be looking for this: TIME_FORMAT=%m%d%H%M%S TIME_PREFIX=^\S+\s+ Note, the prefix may be wrong for other types of data you have. It just skips over the first word. ... View more

I don't think splunk does bitwise operations. After all, for bitwise operations you first need an agreement on how a number looks like in bits, and that doesn't feel splunky. However, you can shimmy your way around that with a bit of maths. You already said how shifting is nothing else than dividing by a power of two and then flooring the result, that's the first step. Second, a bitwise and throwing out a number of starting bits and keeping all the bits after that is nothing other than a modulo operation. For instance 0x123 & 0xff is 0x23, yes? Going decimal, 0x123 is 291, doing 291 % 256 yields 35 - which is 0x23. ... View more

Depending on your specific problem, you may be able to drop the subsearch through something like this (untested, pseudosplunk): source and whatnot, from yesterday midnight to now | chart count by EventCode date_mday | where yesterday = 0 AND today > 0 Note, you still need to figure out a way to address the columns for today and yesterday correctly. ... View more

You're looking for a regular expression to parse out each line into a variable fieldname according to the key? First, to get the variable fieldname, you need a props.conf and transforms.conf entry like in this question: http://splunk-base.splunk.com/answers/23409/dynamically-extract-field-names-from-multiline-event Second, the regular expression would look something like this (untested): ^([A-Z_]+)\s+(.*) ... View more

If you want to swap the dates you can just swap the 2 and 3 in the sed command. ... View more

I'm assuming you want a count of accesses by time, grouped by those three categories. Note, this is in pseudosplunk (trademark!). some search grabbing one event per access to the relevant page | eval traffic_category = "local", "internal", or "external" depending on IP | timechart count by category ... View more

Sounds like a task for summary indexing. ... View more

How about this? ... | timechart span=1m count, sum(field) as sum_field | streamstats window=1440 sum(count) as total_count, sum(sum_field) as total_sum You'll get the total_count and total_sum for the previous 24 hours before any minute you like. Using that you can eval the floating 24h average. ... View more

Did you restart the forwarder after adding the apps folder? ... View more

You could use the approach of comparing floating point numbers with each other. There, you do not test floatA == floatB because rounding errors and other nastiness may lead to two different values while mathematically both would be equal. Instead, you define a tolerance within which two values are considered equal: abs(floatA - floatB) < tolerance. How large the tolerance should be depends on the specific use case. In your situation you could do the same, not look for equal timestamps but rather look for timestamps that are "almost equal". To put some numbers to it, if you get two files every hour but they're off by up to a minute you would not get them with equality but would get them with a tolerance of a minute. That relies on the tolerance being smaller than the gap between unrelated events of course. Ideally, you would have another means of correlating the two files as Drainy mentioned. ... View more

You can make the forwarders point to individual server log files as well. For a large number of forwarders you can use the deployment server to roll out any configuration changes to similar forwarders in one go. ... View more

I see you already found a solution yourself - accept that answer if you're satisfied to mark the question as resolved. ... View more

You could append the searches one after the other to get a single result with I presume one line per search, then set an alert for that humongous search. Alternatively, since you're running on the same source you could extend the stats to include more than one column. Which one of these ways is nicer depends on the searches. ... View more

Am I right in assuming that you want to raise an alert when the indexed volume of the previous day (or the current day?) exceeds a certain amount? The easiest way to achieve that would be to filter the license usage events down to the relevant time frame straight away in the first search / the time picker. Then you have no issue filtering out the irrelevant days further down the query. The alert condition would then just check if there is a result for the day in question that passed the >1000MB filter. ... View more

Ah, I guess I missed that you already have sort-of aggregated values in your event. How about something like this: ... | stats sum(Count) as s by status | eventstats sum(s) as total | where status >= 200 AND status <= 400 | eventstats sum(s) as subtotal | head 1 | eval ratio = subtotal / total | fields + ratio This first calculates a total of all sums, then kicks out the rows for status<200 and status>400, then calculates a total of those remaining, and evals the ratio. ... View more

Over here there is a field extraction windows_snare_syslog : REPORT-syslog that maps to the field transformation syslog-extractions. Are you not seeing that, or is that not doing what you expected? ... View more

Note, -2d@d refers to today, yesterday and the day before yesterday. You'd get today and yesterday with -d@d. ... View more

Have you tried specifying the input manually in inputs.conf? ... View more