I have built an app that has a summary dashboard with several panel charts running off of scheduled searches. There is also a form search that prompts the user to input an IP address, which then populates charts specific to that one IP. The app works great for our needs, however there is one slight inconvenience, you have to remember an IP from the summary dashboard and manually enter it on the form search on the next page. Is there a way for a user to click on a chart and populate the form search? I would like the user to have the choice of clicking a chart to find out more on a specific IP, or manually enter it if they would like or if it isn't present in the chart. Thanks in advance for the assistance. ... View more

There are several servers with universal forwarders loaded that are sending logs to our Splunk environment. These servers are all running the same applications, however some are production and some are development. There is nothing in the logs themselves to differentiate between prod and dev. The idea I had would be to key in on the Metadata:Host field to make this determination. However this is not working. Below is my config. Let me know what I am doing wrong. Thanks transforms.conf [app_dev] SOURCE_KEY = MetaData:Host REGEX = (ho*dev) FORMAT = environment::"dev" props.conf [app_dev] REPORT-app_dev = app_dev I am able to use actual tags to accomplish this, but was hoping to "tag" logs with a field extraction so that my field could be called "environment" and the values could be either "dev" or "prod". The code provided above is only for dev, but prod is similar. ... View more

In our environment, we have a CIFS share that is used to store all colddb. Warm is rolled to cold when the hot/warm volume hits 200GB. maxVolumeDataSizeMB = 204800 I know how much data is being stored locally on the indexers versus the CIFS, but I would like to know how many days worth of data is stored locally on the indexers. I am about to do some basic calculations looking at what we typically index in a day, but that does not factor in the compression that Splunk does. I was wondering if there is a search that could be constructed that could show the oldest timestamp of data in the warmdb. That would be exactly what I need. The reason I need this is to appease our auditing department which is not comfortable not knowing the exact days stored locally versus on CIFS. Thanks in advance. ... View more

Following on from; http://splunk-base.splunk.com/answers/7001/udp-drops-on-linux Are any of you showing drops for syslog-ng in /var/log/messages? I believe we are experiencing syslog drops and trying to determine the best way to correct it. It is my understanding that is syslog-ng is dropping logs, than it would show in the /var/log/messages. I do not see any drops, only processes. We are processing on average 25k syslog messages every minute, but sometimes spike to 50k a minute. I do not know, however, if it would show the linux UDP kernel buffer dropping messages. Right now, syslog-ng is configured with default settings and no linux kernel UDP buffer adjustments have been made. Any assistance would be appreciated. ... View more

We are sending anti-virus logs to Splunk. I am trying to create a search that would first, find logs indicating event "A" which is a virus was detected, then look ahead 60 seconds for event "B" which is a virus was cleaned. I want to show only logs that find event "A" but NOT event "B". This basically are the events that we would need to manually correct. I also want to ensure that the computer and virus names the same in both log events. Below are some samples of the logs. Any assistance would be appreciated. Thanks in advance. 01/14/2012 08:15:14 PM LogName=Application SourceName=AV Server EventCode=600 EventType=3 Type=Warning ComputerName=av-server1 User=SYSTEM Sid=S-1-5-18 SidType=1 TaskCategory=System OpCode=None RecordNumber=17037 Keywords=Classic Message=Virus/Malware: TROJ_GEN.R49C7AE Computer: workstation01 File: C:\System Volume Information_restore{93998DF6-4B0C-40FB-9311-0B790FF41A3C}\RP292\A0028002.dll Date/Time: 1/14/2012 20:15:14 Result: Virus detected 01/14/2012 08:15:45 PM LogName=Application SourceName=AV Server EventCode=500 EventType=3 Type=Warning ComputerName=av-server1 User=SYSTEM Sid=S-1-5-18 SidType=1 TaskCategory=System OpCode=None RecordNumber=17038 Keywords=Classic Message=Virus/Malware: TROJ_GEN.R49C7AE Computer: workstation01 File: C:\System Volume Information_restore{93998DF6-4B0C-40FB-9311-0B790FF41A3C}\RP292\A0028002.dll Date/Time: 1/14/2012 20:15:43 Result: Cleaned ... View more