What is the format of your ironport log events? Can you share a sanitized version of a few events? ... View more

Initially your checkpoint setting can be 0, and when the app runs, it will update it with the most recent checkpoint value (depending upon what you use as a checkpoint for this particular API.) Sometimes the API provides a uniquely identifying value that is an auto-increment numeric value. This will be the checkpoint, new events will have a value higher than the checkpoint value, and the API will return those based upon your API query logic. ... View more

Ideally, you would install a forwarder on each of the domain controllers that you want to collect Windows Event Log information for. There is a process that describes remote log collection, but that involves creating a domain account that Splunk can run as, and then giving that domain account the permissions to read those log files across all your domain controllers. This might be more complicated than just setting up a standard inputs.conf file that you can deploy to your domain controllers for collecting log information. ... View more

The inputs.conf file has to be located on the forwarder that is collecting the data. So you would need to make this modification on ourdcservera and not on the Splunk Enterprise server (oursplunkserver). ... View more

That's because the document you're referring to is telling you to make changes to props.conf, like I suggested. You're not talking about multi-line field extraction. You're talking about multi-event field extraction, because your events are not created properly at index time. In order to NOT change the event breaking AND extract fields across multiple events, you would have to group them in the same transaction somehow, and then extract the fields from that transaction. I don't recommend doing it this way, because it's trying to get around the fact that the events are not properly created in the first place. ... View more

You can try this: index=myindex ("example1" OR "example2" OR "event3" OR "event4" OR "event5" OR "example6" OR "example7") | eval type = case(match(_raw, "example1"), "Event1", match(_raw, "example2"), "Event2", match(_raw, "event3"), "Event3", match(_raw, "event4"), "Event4", match(_raw, "event5"), "Event5", match(_raw, "example6"), "Event6", match(_raw, "example7"), "Event7") | stats earliest(eval(strftime(case(type=="Event1", _time), "%F %T"))) as EarliestEvent1, earliest(eval(strftime(case(type=="Event2", _time), "%F %T"))) as EarliestEvent2, earliest(eval(strftime(case(type=="Event3", _time), "%F %T"))) as EarliestEvent3, latest(eval(strftime(case(type=="Event4", _time), "%F %T"))) as LatestEvent4, latest(eval(strftime(case(type=="Event5", _time), "%F %T"))) as LatestEvent5, latest(eval(strftime(case(type=="Event6", _time), "%F %T"))) as LatestEvent6, latest(eval(strftime(case(type=="Event7", _time), "%F %T"))) as LatestEvent7 Here is what it will look like with some dummy data: Without more detail of what exactly you're looking for and a sample of data / mock-up of what you want to see, it's difficult to provide what you're looking for. ... View more

Your explanation is very confusing, and I think you are using the wrong terminology. Sample data would be extremely helpful. Questions: - What is event1 (event2, event3, ... event7) ? - Is that a particular event that happens in a log somewhere? - How can you uniquely identify event1? - Is there an event code you can reference? - What is your overall goal for all of these searches? - Are you creating alerts? - Are you creating a report? - Do you want to display results in a dashboard? Providing context as well as sample data well go a long way in allowing others to consider options for your request. ... View more

You can also put a backtick character ` before and after the code you want to display. ... View more

Hi @dowdag , You'll first need to configure your sourcetype to break events properly. You should be using the following in your props.conf: [<Your sourcetypename>] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N This will ensure that your event breaks only happen after a line break that is followed by a XXXX-XX-XX year-month-day value. Once you have that fixed, you'll be able to extract the field values for the data you're looking for by using a simple extract in props.conf for your sourcetype: [<Your sourcetypename>] EXTRACT-transaction_and_payment_info = TransactionId=(?<TransactionId>[a-fA-F0-9-]+)[\S\s]+PaymentId=(?<PaymentId>[^,]+), Although, if KV Mode is set to AUTO, once you fix the line breaking issue, your fields might be associated properly anyway. ... View more

You'll need to make sure that both the lookup table (CSV file) AND the definition are created. Please refer to this: https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Knowledge/LookupexampleinSplunkWeb ... View more

This would work: EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+).*?\<\/COMPID\> But using: EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+) works as well. ... View more

Try: EVAL-action = case( match(actionTESTA, "Allow|Permit"), "allowed", actionTESTA=="Discard", "teardown", actionTESTA=="Refuse", "blocked", match(eventTESTA, "Connection closed|Incomplete connection closed"), "teardown") ... View more

earliest & latest statements in the search query ALWAYS take precedence over the time picker from the UI. ... View more

Then you would use a regex match for any non-whitespace character. As an example: Instead of [^\<]+ Use \S+ ... View more

Hi @josedgaravito , You could try this as well: ... [ your base search ] ... earliest=-1h | rex "Cámara (?<camara>[^:]+):" | stats count by camara | where count > 10 This should show results for camara having more than 10 events in the time frame specified. ... View more

Hi @rajanala , It looks like it should be installed on: A heavy forwarder & search head(s) It's recommended to put it on a heavy forwarder, where the data will be collected by the modular inputs, and then sent to the indexers. The search heads will need to get a copy for any search-time configurations. ... View more

I see what you're trying to do now. Try this: index=xxxx eventtype="perfmon_windows" object="LogicalDisk" (counter="% Free Space" host=cccc instance="C:") OR (counter="Free Megabytes" host=cccc instance="C:") | eval percentfree = case( counter=="% Free Space", round(Value, 4) ) | eval gbfree = case( counter=="Free Megabytes", round(Value / 1000, 2) ) | stats latest(percentfree) as percentfree latest(gbfree) as gbfree by host instance | eval gbused = round( ( gbfree / percentfree * 100 ), 2) - gbfree | timechart span=1m gbused by instance ... View more

Can you setup a "dummy" search head (new instance) and install only that one SAP TA/Add-on, and see if you get the same behavior? Also, if there are different versions of the TA, try the older version to see if the results differ. You could also disable the TA (this will turn off all the field extractions) and then create just the one specific EXTRACT line in the Search & Reporting App for the field extraction and see if that works? ... View more

You could also try @FrankVl 's suggestion about bloomfilters. I'm not sure if that's the right direction, but let us know if it works out. ... View more

Probably not, but it seems like it matches your situation regardless. There's a ton of troubleshooting that can be done, but I think that would require a better medium than Splunk Answers. ... View more

Does it work when you do: index=myindex sourcetype=mysrc message_id=* | search message_id = "AUK" ... View more

Very weird, check this blog post out, and see if it helps: https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html ... View more