When I do this I just something like: host=* "string" NOT ([|inputlookup stuff.csv | fields ] )| ... View more

If I understand your question correctly you are looking for a character value for the number that is inside the CHAR parentheses? To do that you would need to use the rex I mentioned earlier to get it as a field and then use a lookup table to find the resulting translation. Splunk doesn't have a function for pulling this information directly. So something like this should work: lookup.csv number, ascii 13, "carriage return" sourcetype=mydata | rex "SQL: CHAR(?<char>\d)" | fields char | lookup chart AS number OUTPUT ascii AS "character" This will take the numeric values you see and translate them to the ascii values you are looking for. You will have to create the lookup table, but that is just a csv that follows the pattern that laid out. ... View more

I think you want something like this: sourcetype=mydata | rex "SQL: CHAR(?<char>\d)" | stats values(char) ... View more

The issue is that evt/evtx files are binary and can't be imported natively to Splunk. You can install Splunk for Windows if you are using a full Splunk installation and that will allow some support for indexing the events from event viewer. Or if you have the universal forwarder installed you can configure windows scripted inputs to capture events from the events viewer and forward them to Splunk. -kate ... View more

Hi, You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there. ~Kate ... View more

I think you would have to create a 3 different searches (or a mabye a master searcj with some post-processes to display results...?) and display these results individually. The SingleValue module is pretty limited at what it can display: SingleValue (extends DispatchingModule) This module waits for the search to complete and then renders a single field from the first row of the results ... View more

I think you can get close to what you want to do: You can configure a script to run when an alert or scheduled search is run. This can be the python script that you want to initiate. Splunk supports using the results a search in the script itself with the SPLUNK_ARG_8 option. This is a gzip'd file that you have to read and put into a dictionary to use. Once your script is done doing it's thing you can then write the results back to Splunk by dropping a file into the sinkhole directory (/opt/splunk/var/spool) so that they get splunk'd again and are available for searching. ... View more

I think the best way to do it would be to use: rex field=Total "$(? \d+,\d{3}.\d{2})" That should get you the number cleanly, however it will still have the comma in it. Splunk may or may not be OK with that.... If it's not happy with that you can always use the eval tonumber(x,y) function and force the behavior ... View more

I was thinking something more along the lines of this: sourcetype= "A string!" | eval error="A string!" | stats c(error) as e, values(host),values(source) by sourcetype | where e > 0 You can either keep the where in the search and alert when events are found OR you can take it out and put it in as the conditional alerting custom condition. In this context it will send you the host/source and sourcetype information as the results of the search. ... View more

You can still do one of 2 things in this case: You can create a new field out of the 3 fields already created using eval. Something like: eval currency=field1+field2+field3. The advantage of this is you can add formatting in if needed. You could also just do the field extraction again from the _raw data and ignore the fields it pulls out altogether and only use your new one. The believe the regex for that currency section would look something like this: (d{1,2}.d{3}.d{3}.d{2}) ... View more

I would add a field extraction to pull out just the number from either the field or _raw data. If you pull out just a number into a field then Splunk will treat it as a number and you can perform functions on it. ... View more

I think the best way to accomplish that is to make your alert condition not based on your results but instead a custom condition that way you can modify your results to be the host/sourcetype/source and provide those in your email instead. ... View more

Yes the same logic should apply to the deployment server indexes. ... View more

No problem, you can either: Make the local file immutable (chattr +i) this will prevent any accidental changes/deletions to the file as the immutable flag would have to be removed prior to changes. Keep both file identical (just be careful of changes - like adding summary indexes or new indexes) ... View more

Hi, The TimeRangePicker module uses the times.conf file which is (unless customized) under the etc/system/local directory under your search head(s). You can only use values which are defined within that file and custom time isn't an actually defined element. I believe you can use a workflow action to get around this but I think it would need a start and end field within each event to make it happen with the TimeRangePicker correctly; disclaimer: I've honestly never tried it out. The way I usually work around this is by using an extended search box to provide an earliest and latest window that I pass onto the search, the only downside is that they will have to type those values in which isn't the most user friendly. ... View more

Hi, You need to change the directories in local/indexes.conf to point to where you want the hot/warm, cold and frozen data to reside and restart splunk. ... View more

Hmm...OK maybe we could tackle this in a different way. The next things I'd try doing is going back to the universal forwarder on the windows boxens, and then a windows(there seem to be differing comments on whether it will work on linux) indexer with the http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows app loaded? This might be able to read those EVT files correctly? It definitely sounds like an API related issue that the forwarder can't parse the files so the indexer is likely rejecting it as binary input. Maybe with the app on the indexer will do the trick. ... View more

well the universal forwarder will just forwarder data and NOT parse it (i.e. run it through the props/transforms actions) so it will not have the api available to parse and the linux indexer will not have the api either...so. I'd recommend a heavy forwarder (or basically a full splunk instance with the web turned off) on the windows host in this case so that you can parse the data at read time and then forward it over already cooked to the linux indexer. ... View more

Hi, Lookup tables are typically stored at the search head and not the indexer. Is this an indexer & search head instance (i.e. doing both?) You can verify lookups from the search head by going under the Manager -> Lookups ad see where you file is listed and can verify the file contents by logging into the box and taking a look at that path. @Kate ... View more

Hi, Have you checked if the app is enabled at the indexer and is listed in the etc/apps directory after it replicates the bundle over from the search head? You can check that status of installed apps with ./splunk display app . If it is disabled you can enable it by ./splunk enable app If you are running deployment server you could also just roll it out that way. @Kate ... View more

I don't believe you can add another line but you could modify the placement of the warning indicator (although it won't be dynamic) Here's the link to the available properties for the gauges(Advanced XML) http://docs.splunk.com/Documentation/Splunk/4.3.3/Developer/CustomChartingConfig-ChartLegend#fillergauge ~Kate ... View more

I believe in the windows version the inputs.conf is located under the etc/apps/search/local directory. You also should probably exclude the JPG files in that inputs.conf file as it is binary and will throw that type of message in the splunkd.log (/var/log/splunk/splunkd.log) Thanks, Kate ... View more

I don't think Splunk would recognize it as a word, but maybe as a non-whitespace character? ^/{1}.\/(? \S+) Thanks, Kate ... View more