This method works, but I just migrated from Splunk4.3.2 to Splunk6.1, I have to do this for all users saved searches? Going to be a pain.... ... View more

Thanks Jcoates, I installed the app on all 8 of our production indexers in the $SPLUNK_HOME\etc\apps directory bounced them last week, but still no windows related events from the host with the TA app. I am submitting a case on this.. ... View more

well that was easy, Thanks. Forgot about using the regex command directly in search. ... View more

Yann, ok thanks i'll go this route ... View more

What version of splunk are you running on those search heads? Using an F5 vip on a v4.3.4 search head pool results in this : http://splunk-base.splunk.com/answers/51844/excessive-session-lock-files-using-up-inodes?page=1&focusedAnswerId=59120#59120 ... View more

Sowings thanks for the response and confirm It's what i suspected. we have many agents ill probably have to update them all with puppet since we have no deployment server. ... View more

@sadkha - the syntax is wrong for your lookup in the fourth line. Here is a link to the lookup command. So I think that what you want might be: | lookup dnslookup clientip as Client_Address OUTPUT clienthost as ComputerName But I am not sure that I know what your field names are... ... View more

Ayn, another follow up question 🙂 If i wanted to match on a string anywhere in the _raw events, But seems rather slow on large indexes. Perhaps there is a better way. index=www NOT uri="/dot_clear.gif" [|inputlookup watchlist_string_lookup | eval query="_raw=".watch_string."" | fields query] | lookup ga ip as clientip | table date_month, date_mday, date_hour, date_minute, date_year, clientip, country, org, status, referer, uri, host, source, sourcetype, index, other, watch_string ... View more

Kristian, our IT guys were using older pre-universal forwarder clients for a while. I was looking for the updated strings to use for the universal forwarder. Thanks for the link to the docs didnt catch that. ... View more

Thanks for the reply Dwaddle, it's lower risk data for us a not so critical index(in terms of needing data for audits etc) I'll compare space savings before / after. ... View more

Hey Gerald, how ya been?? I'll give macro's a try, I had to read up on them as not really used them before. It seems like this will work, after testing the search with the following syntax, using a macro definition as so regex _raw!="(\[sysd\.NOTICE\]\: WDOG\: Strobing the watchdog)|(\[sysd\.NOTICE\]\: WDOG\: Uptime" "System memory)|(ACE-4-313004\: Denied ICMP)|(.*list [a-zA-Z0-9\-]+ denied)|(ras\d+.*Connected to \S+ port \d+)" and using a search string to call the macro should work index=net sourcetype=syslog source="/logs/syslog/central_netlog_repository.log" | `net_macro` I plan to maintain the regex's to filter out certain events going forward. Basically i am trying to replace a python script that filtered out log events with all these matching regex's, from our "net" index. This was a previously asked question. http://splunk-base.splunk.com/answers/49995/looking-to-replace-a-custom-python-syslog-filter ... View more

It may be worth looking at a new project one of the Splunkers is working on, where you could archive off some of these buckets to reclaim space but still have them available as needed -- http://blogs.splunk.com/2012/07/02/shuttl-for-big-data-archiving/ ... View more

I did a GeoASN install in a distributed environment today and had sismilar problems. Solution: Install all the components (listed in the README) and the app on all searchheads and indexers. ... View more

Hey d would the internal regex macro be constructed with the answer i posted in ? http://splunk-base.splunk.com/answers/49995/looking-to-replace-a-custom-python-syslog-filter ... View more

yep that was it lookup was looking for "ip" field while access_combined defaults to clientip ... View more

message fixed in 4.3.4 ... View more

Our populating search was this btw: index="vip" sourcetype=vipservices | transaction TR startswith="Operation Start" endswith="Operation End" | eval elapsed_wait=elapsed_operation-elapsed_request | sistats count, avg(elapsed_operation) as total-avg, perc80(elapsed_operation) as total-80, perc90(elapsed_operation) as total-90, perc95(elapsed_operation) as total-95, perc98(elapsed_operation) as total-98, perc99(elapsed_operation) as total-99,max(elapsed_operation) as total-max, avg(elapsed_responder) as resp-avg, max(elapsed_responder) as resp-max, avg(elapsed_request) as req-avg, max(elapsed_request) as req-max, avg(elapsed_wait) as wait-avg, max(elapsed_wait) as wait-max by host, JURHASH, OP ... View more

I've seen situations before where the licensing connection went wonky, and my (quick and dirty) solution was to take the indexer out of the pool, then add it back. YMMV. ... View more

Thanks Damien i forgot about disabling them in the search peers section, it looks like when they are disabled you cannot search on them explicitly though with splunk_server="name" would be nice to have that option to search splunk indexers on demand but keep them disabled a percentage of the time. ... View more

I've never used haproxy/keepalived but I think that for practical matters here they'd function similarly. ... View more

For option 3, keep your transform. Just change <instance> to <instance_raw> in your REGEX. You can create the lookup very easily from the Splunk Manager UI: Build a CSV file on your desktop that contains the data you need. The first row MUST be a header; the column names will be the field names in your lookup. Go to Manager » Lookups in the Splunk UI Add a new Lookup Table File. This is where you will upload the CSV file from your desktop into Splunk. Add a new Lookup Definition. This is where you tell Splunk that you want to do a file-based lookup, using your Lookup Table file from the previous step. Add a new Automatic Lookup. Here you tell Splunk how to use your Lookup Definition automatically, and tell it which fields to retrieve, etc. Be sure to set permissions on each of the items: the table, the definition, and the automatic lookup - if you want them to be used by others. Once the lookup is created, you can see that it adds additional entries to props.conf and transforms.conf. If you want to edit them directly, take a look at Setup a fields lookup based on a static file ... View more