I guess it depends on your environment? Are you monitoring that file from a universal forwarder installed on the server? Or some other approach? If you're using a uf, maybe just stop splunk on that box temporarily. Of if that's not option, maybe you can use one of these cli commands to remove/disable the monitor. i don't see disabled listed there, but here's an older thread that makes it look possible ... View more

The cold path would be defined in indexes.conf. But you might be better off using btool to get the settings for that index: splunk btool indexes list [your index name] But out of curiosity are you saying that the data is being deleted instead of rolling to cold? Or is it remaining warm? Or something else? Knowing what's happening might allow to provide more specific troubleshooting steps. ... View more

Were you getting that message before modifying props.conf? Because it looks like Splunk recognizes the timestamp with the default config in my environment. It could be possible that not all of the events are breaking correctly or some events don't have a timestamp. With respect to what you were trying, the TIME_PREFIX setting should indicate what prefixes your timestamp (not the format of your timestamp). So in this example, it might be just a ^ (beginning of the event). And your TIME_FORMAT I don't think needs a + sign and the minute should be a capital M: "%Y-%m-%d %H:%M:%S". I'd also recommend using MAX_TIMESTAMP_LOOKAHEAD, so that Splunk doesn't find a timestamp where you don't want it to. So maybe something like this? TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD=20 ... View more

I am not a cron expert, but you might have to break that up into multiple cron schedules, e.g. sunday 22-23:45 (/15 22,23 * * 0), monday 12am through Friday 23:45 (/15 * * * 1,2,3,4,5) , Saturday 00-05 (*/15 0,1,2,3,4,5 * * 6) ... View more

I see, so something like this maybe? index=level3 host=Test | eval _time = 'Opened D' | timechart count Also, if Opened D is in the source data, do you also want to use that as the timestamp of the event when you index the data? That way it will already be the same as _time and you won't have to do any evals. ... View more

What is the question here? Are you trying to troubleshoot the error message or do you really just want to eval a field to _time? ... View more

hey samjenk, glad that worked. I have been able to use a lookup table created by outputlookup. I'm not sure I have ever tried using one from the same search where I created it, but seems like it should work. Of course, not sure if Splunk does any optimizing behind the scenes resulting in the lookup search running before the outputlookup runs? But it looks like you tried to do them in separate searches too. And you were able to display it with inputlookup. So I have no idea why that wouldn't work. When I first saw your post, I tried on my home machine (6.4.x). And was able to successfully use the lookup command against a table I had just created with outputlookup. I would suggest abandoning the search you're working on and see if you can just do it with a simple example. And then troubleshoot from there. For example, I think I used something like this to create mine: index=_internal earliest=-60m | stats count by component | outputlookup test.csv ... View more

So are you using the dbconnect app? If so, I think you should be able to manage the inputs from that app (at least with version 1.x). If that doesn't work, then you can use btool to find where that configuration is on the file system. It will be under whichever app you were in when you created the input in Splunk Web. Something like: [splunk home]/bin/splunk btool inputs list --debug Side note, I do think that some versions of dbconnect break the data inputs page. So if you are using that app, review the release notes to see if that's what you're running into. ... View more

That seems to look right. What version of Splunk? Do you get any events from the dc in Splunk (internal events included)? Any other events from the event log on that dc? Any event log events from any forwarders? Where is your inputs.conf located? ... View more

So you don't want that correlation search anymore? If not, and it's already gone from savedsearches, just remove the stanza from correlationsearches.conf too. Depending on your environment, that might be accomplished a few different ways, e.g. cluster, (local or on the deployer) or standalone. Side note, we are a few versions behind on ES, but I think removing a correlation search from the web should be possible. If that doesn't work and you think it should, maybe open a case with Splunk. ... View more

Sure, you can probably do something similar to what the TA does. Because although there seems to be a lot going on with it, it really boils down to running the various scom cmdlets to gather data. So you could create your own scripted inputs to run those cmdlets, e.g. get-scomalert, get-scommonitor, get-scomoverride etc. SCOM has a ton of powershell cmdlets available to gather all sorts of data. Or set up scheduled tasks to run those cmdlets and output the results to log files and just ingest those log files. Also, if you're familiar with the scom database schema and have access to it, you could install the dbconnect app to ingest data directly from the database (personally, I'm not familiar with the database schema). ... View more

Not inherently that I could tell. For example, i think they store the credentials in the rest interface, so you wouldn't be able to do that with a uf. I just went ahead and built a Windows heavy forwarder and installed the SCOM console on it. And so once the TA was installed, I was able to use the app's web interface to configure servers/credentials/inputs. ... View more

Not sure why your lookup isn't working, but you might be able to accomplish the same thing with join. Something like this: {your first search} | rename src_ip as first_ip | table sid first_ip | join type=left sid [search {your second search} | table sid src_ip] This should join your two data sets together by sid ... View more

Could be a few reasons. Does the calculated field actually produce results for the second sourcetype? For all events or just some? what are the permissions for the cloned calculated field? ... View more

I got that error when I first tried to install the TA on a universal forwarder. But this TA needs to run on a heavy forwarder (or search head etc). I believe that particular function is doing a rest call against the box to get the splunk version. Do you have it installed on a universal forwarder? ... View more

I ended making a fewchanges. I'm not sure if anyone else is/will want to do something like this, but thought I'd share in case. First, I did comment out the g_timestamp dictionary items for some of the cmdlets. I don't want to ingest only new items. I want to ingest all items each run. $g_timestamp = @{ # events "Get-SCOMAlert" = "TimeAdded" 'Get-SCOMEvent' = "TimeAdded" #"Get-SCOMMonitor" = "LastModified" "Get-SCOMDiagnostic" = "LastModified" "Get-SCOMTask" = "LastModified" "Get-SCOMRecovery" = "LastModified" "Get-SCOMDiscovery" = "LastModified" #"Get-SCOMOverride" = "LastModified" #"Get-SCOMRule" = "LastModified" "Get-SCOMTaskResult" = "LastModified" "Get-SCOMAlert | Get-SCOMAlertHistory" = "TimeAdded" # mgmt 'Get-SCOMManagementPack' = "LastModified" 'Get-SCOMResourcePool' = "LastModified" 'Get-SCOMUserRole' = "LastModified" 'Get-SCOMRMSEmulator' = "LastModified" 'Get-SCOMManagementServer' = "LastModified" 'Get-SCOMRunAsAccount' = "LastModified" #'Get-SCOMGroup' = "LastModified" 'Get-SCOMRunAsProfile' = "LastModified" Second, i updated props.conf to set the timestamp to none for a custom sourcetype. The original props is applied against the wildcarded sourcetype, and is configured to use one of the date fields in the event itself. So I created the new sourcetype that is more specific and should therefore win the timestamp conflict. [microsoft:scom:custom] DATETIME_CONFIG = NONE TIME_FORMAT = TIME_PREFIX = TZ = UTC And finally, after configuring the inputs I wanted from the web, I manually set the sourcetype to the custom one in inputs.conf and restarted Splunk. [powershell://_Splunk_TA_microsoft_scom_internal_used_Prod Metrics] index = tester schedule = 0 0 6 ? * * script = & "$SplunkHome\etc\apps\Splunk_TA_microsoft-scom\bin\scom_command_loader.ps1" -groups "monitor","override","rule" -commands "get-scomgroup" -server "SCOM Prod" -loglevel DEBUG sourcetype = microsoft:scom:custom disabled = 0 I don't think this is ideal and maybe not the best approach, but it's working for our needs. If I had more time, I think I would have tried to find where in the script to put some logic to determine which field to use for the timestamp (including current time) and written a separate field for the timestamp to each event. Then use that field in props for all events. That would give us more flexibility. ... View more

A couple ideas in general for getting that one string into all of your events for comparison. Use the join command to put the two searches together. You can eval some field in both searches to the same value and then join on that field. Something like this: index=b | eval tmp="match" | join tmp [ search index=a | eval SPLITid=substr(SPLITLOTID,2,8) | where match(SPLITid,".") | eval tmp="match" | table tmp SPLITid ] |search eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, SPLITid)) | table filteredVal Another option might be to use append and eventstats index=b | append [ search index=a | eval SPLITid=substr(SPLITLOTID,2,8) | where match(SPLITid,".") | table SPLITid ] | eventtats values(SPLITid) as SPLITid |search eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, SPLITid)) | table filteredVal Not sure if those are terribly efficient, but I think they get the job done. ... View more

I don't know how it works or exactly in what order, but INDEXED_EXTRACTIONS is an input-time setting. I don't know if that means the fields are created at input or just that the headers are gathered? Not sure. But I wonder if you can add another stanza to transforms where source key is the remarks field, regex matches birdstrike, dest key is the type field and format is just birdstrike? Maybe then both the raw data and indexed fields would be updated appropriately? Also, as I'm sure you know, you could replace the raw data like you're doing and use a REPORT stanza to extract the fields at search time, instead of using indexed extractions to do at index time ... View more

But for those results without the filters, are there older events that would match filter? I mean, you are filtering, so maybe there isn't older data that actually matches your filter. If there is older data that matches your filter, maybe there is typo in your filter like woodcock suggested. We don't have your data so we can't do that troubleshooting, but you should be able to make your way through the results to figure out what's happening. Also, if you haven't yet, inspect the job to see what Splunk actually searching after the subsearch is resolved. Maybe there will be something noticeable/obviously wrong if you look at it there. ... View more

Have you tried inspecting the job to see the search Splunk actually ends up running after the subsearch is resolved? Is there anything specific about the results in the past 2 days that might also explain why those are the only returned, as opposed to search just randomly returning results only that old? On a side note, are you sure you don't want AND instead of OR here? (host!=XXXX OR host!=XXXX) It's hard to tell with the obfuscated data, but OR'ing together negatives doesn't seem to accomplish much. For example, if I have a host named server1, then (host!=server1 OR host!=server2) is still going to resolve to true because the second condition is true. ... View more

I think it depends on the format of your data and how consistent that format is. But I was able to do something like this with a couple sedcmd entries in props.conf. Here is my test data blah,meh,fruitcake,huh,good gift meh,huh,fruit cake,blah,good gift meh,huh,drone,blah,good gift blah,huh,socks,me,bad gift blah,meh,fruitcake,huh,ok gift And here are the sedcmd entries I'm using in props SEDCMD-test1 = s/^([^,]+,){2}(fruitcake|fruit cake),([^,]+,){1}/&replace me,/g SEDCMD-test2 = s/replace me,[^,]+/bad gift/g So I'm using sed twice. The first time, I grab everything up to my gift_type field if it includes fruitcake and replace that with the exact same string (the ampersand) but add another field called "replace me". If fruitcake isn't there, then nothing gets replaced. The second sedcmd finds replace me and then gift_type and replaces that all with just "bad gift". If the "replace me" string isn't there, nothing gets replaced. With this simple data set it seems to work. Where expected, the gift type was set to "bad gift". The other fields were left alone. I'm not sure if this will affect anything else that you do at parse time. And I'm not sure if this will work for your data set in general. And there may be a better way to do it. But maybe this will at least point you in the right direction. ... View more