Hi all, In the middle of a search, I have two string fields, one is called A and the other B (both have the ";" as delimiter but the number of values inside is variable): A=test;sample;example B=test;sample;example;check I would like to compare the two string and have the difference as result in a new field called C (so suppose C=check). Is there any way to achieve that (like doing an Excel VLOOKUP without performing a sub-search that can affect the search performance)? Thanks a lot, Edoardo ... View more

Hi All, I have one question about ITSI indexes. Our Splunk Indexer has 1 disk “fast” and 1 disk “slow” with more capacity (it is not that slow but performance are lower than the fast one). On the “fast” hot and warm buckets are present, instead on the “slow” cold buckets are there. This set-up is valid for all of our indexes, except for Splunk ITSI ones. In fact currently Splunk ITSI has reached 30GB in our "fast" disk (with approximately more than 1 year of data) and I would like to set-up a limit of 20GB on “fast” disk volume:home and the rest on the “slow” one volume:cold . We don’t usually inquiry data older than 1 month with ITSI. I would like to change indexes.conf configuration as follow: AS IS [itsi_summary] homePath = volume:home/itsi_summary/db coldPath = volume:home/itsi_summary/colddb thawedPath = $SPLUNK_DB/itsi_summary/thaweddb TO BE [itsi_summary] homePath = volume:home/itsi_summary/db coldPath = volume:cold/itsi_summary/colddb thawedPath = $SPLUNK_DB/itsi_summary/thaweddb #added to limit index size on fast disk homePath.maxDataSizeMB = 20480 Do you see any contraindication on moving the coldPath from volume:home to volume:cold? Thanks a lot, Edoardo ... View more

Hi All, I am trying to clean the support ticket description to help the cluster command on the clusterization. I have found the "Splunk NLP Text Analytics app" that permits to use the cleantext function, but it allows to define single words to clean the text, basically because the analyzed text is tokenized. Do you know if there is a more efficient way than the one indicated below to perform a cleanup on a text cleaning the defined sentences instead of single words? index ="myindex" host="myhost" sourcetype="mysourcetype" source="mysource" | eval description=lower(description) | eval description= replace(description,"the user reports", "") | eval description= replace(description,"the user complains that", "") | .... I would like to create a lookup table that join over the sentences and clean them from the description field. Do you have any suggestion or better approach? Thanks a lot, Edoardo ... View more

Hi All, We are ingesting batch application logs in an index (let's call it "myindex") with a scripted input that run every 5 minutes in our UNIX Production Machine. The scripted input run with this crontab: */5 * * * * so it start at the minute 5th, 10th, 15th etc... and it takes few seconds to run. After that the logs are ingested by Splunk and indexed in "myindex". Due to the fact that they are custom logs, we have written several regular expression to extract valuable fieds, but due to the fact that the regular expression are too much, and they are applied at Search Time, this is slowing down the SPL execution on large data subsets. For this reason we have implemented a Scheduled Report that save the output in a Summary Index (let's call it "mysummaryindex"). The Scheduled Report run every 5 minutes, extracting the last 5 minutes of data, with this crontab set-up in Splunk: 2,7,12,17,22,27,32,37,42,47,52,57 * * * * so it start at the minute 7th, 12th, 17th etc... and it takes few seconds to run. We have delayed the run of 2 minutes to give time to Splunk to index the data. Here below you can find a schema of what we have explained above: So now it comes the question 🙂 Due to the fact that there are long running batch jobs, the _time of our events represent the "start" of the batch jobs, and when they will be indexed in "myindex" they could refer to the past. For this reason we have to find a way to "force" the Scheduled Report to extract based on _indextime instead of _time. I have look at this post: https://answers.splunk.com/answers/171/using-indextime-to-specify-time-range.html and tried to apply it to the SPL in the Scheduled Report as follow: index="myindex" sourcetype="mysourcetype" host="myhost" AND source="myfiles.*" _index_earliest=-5m@m _index_latest=@m | rex field=_raw "myregularExpression1..." | rex field=_raw "myregularExpression2..." etc... but it seems it is missing some data (saying that it is even not very simple to compare what it should have pick up and what it has summarized). Do you see something wrong? Thanks a lot, Edoardo ... View more

Hi All, We have installed the Splunk_TA_nix (Splunk Add-on for Unix and Linux - https://splunkbase.splunk.com/app/833/) in the Search Head (/opt/splunk/etc/deployment-apps folder), added a /local folder with inputs.conf enabling all the scripts supported for AIX (based on what is indicated here https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Releasenotes) but after have deployed the app in the forwarders that are running on AIX we are getting those errors in eventgen.conf: Checking mgmt port [8089]: open Checking conf files for problems... Invalid key in stanza [sample.dhcpd] in /home/myuser/opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 4: interval (value: 10). Invalid key in stanza [sample.dhcpd] in /home/myuser/opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 5: earliest (value: -10m). Invalid key in stanza [sample.dhcpd] in /home/myuser/opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 6: latest (value: now). Invalid key in stanza [sample.dhcpd] in /home/myuser/opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 7: source (value: sample.dhcpd). Invalid key in stanza [sample.dhcpd] in /home/myuser/opt/splunkforwarder/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 8: sourcetype (value: dhcpd). and lot more with same error. Do you know how can we solve it? Thanks a lot, Edoardo ... View more

Hi All, We are trying to cluster a Description field with cluster command in this way: | cluster t=0.5 labelonly=t showcount=t field=Description match=termset | table cluster_label cluster_count Description Do you know if is it feasible to know which are the most common words or string, on each cluster, the algoithm has used on the Dataset to generate the clusterization? I would like to add one column on the right to my output table containing the patterns that have generate this cluster (that are linked to Description field). cluster_count | cluster_label | Description | words 120 | 1 | Bla bla bla ciao ciao | bla, ciao 80 | 2 | Day after day is better | Day Thanks a lot, Edoardo ... View more