It also possible that your lines are being truncated due to length. ... View more

This is only available in with the heavy forwarders. ... View more

I believe if your permission are set to admin only within the ../metadata/default.meta where the following is set [] access = read : [ admin ], write : [ ] Only admins will see the app in the drop down. ... View more

try this one ... | rex field=_raw "Code=\s+(?<code>[^\s,]+)" | table code ... View more

How does this data come into splunk (script, etc)? ... View more

what are the two source/sourcetypes. I am guessing one is scripted input. ... View more

I struggled with with elastic search and other tools. If this was a dashboard panel you could you Splunk webframe work with some js and get the information from the instance or from the search job and insert the time into the search query. The idea would be to tag all your search with id with naming convention and have your JS script look for all ids contain <yoursearch>-elastic. Then loop through each splunk search instance, get the current search string, insert the time for your commands and finally run your search. Then you could generically apply this JS to any dashboard panel interchangeable. var elastricSearches = $("[id^='_elastic']"); var searchInstance; var searchQuery; for (var i=0; i >= elastricSearches.length; i++) { searchInstance = splunkjs.mvc.Components.getInstance(elastricSearches[i].attr('id')); searchQuery = searchInstance.settings.get('search'); /* insert code to parse out query and replace strings for time. */ // now run search. searchInstance.set('search', searchQuery); } Just a thought. ... View more

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down. // yourDropDown is the id of them drop down menu var tokens = mvc.Components.getInstance("default"); var yourDropDown = mvc.Components.getInstance("yourDropDown") var drillDownSearch = mvc.Components.getInstance("drilldownSearch") // Using an event handler to listen for changes to the drop down. yourDropDown.on('change', function() { tokens.set("vsadid", appName); drillDownSearch.startSearch() }) take a peak at the following documentation. WebFrame Work Reference Tokens ... View more

The api does not provide facilities to clean the eventdata as Splunk daemon needs to be stopped. You are better off using remote ssh command or powershell command to run the shell commands. You can use the "|delete" command to mark the data as unsearchable via the api by create a search job, but that does not remove the data. ... View more

It sounds like you want appendcol or append command. http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Appendcols ... View more

You may want to build a streaming command using the SDK. ... View more

It possible using a transform and props conf. You will have to come up with a regex that will capture the event when a match occurs you will overwrite the meta field for sourcetype. This can be done on a heavy forwarder or indexer. ... View more

I struggled with the same thing last month. Here is how it works. /static/app/<your_app>/font/BTFont_Rg.tff You can find all static items for an app under this path. /static/app/<your_app> For an image tag it would like like this <img src="/static/app/simple_xml_examples/images/sum_search1.png"></img> ... View more

I've done this with using Splunk Web Framework and Javascript. It can be a pain since you also have to manage all the splunk instance of your splunk panel/charts. Each instance is identified by its id if you plan on refreshing data. Here is a simple example for ideas. require([ "splunkjs/mvc", "splunkjs/mvc/utils", "splunkjs/mvc/tokenutils", "underscore", "jquery", "splunkjs/mvc/simplexml", "splunkjs/mvc/headerview", "splunkjs/mvc/footerview", "splunkjs/mvc/simplexml/dashboardview", "splunkjs/mvc/simplexml/dashboard/panelref", "splunkjs/mvc/simplexml/element/chart", "splunkjs/mvc/simplexml/element/event", "splunkjs/mvc/simplexml/element/html", "splunkjs/mvc/simplexml/element/list", "splunkjs/mvc/simplexml/element/map", "splunkjs/mvc/simplexml/element/single", "splunkjs/mvc/simplexml/element/table", "splunkjs/mvc/simpleform/formutils", "splunkjs/mvc/simplexml/eventhandler", "splunkjs/mvc/simpleform/input/dropdown", "splunkjs/mvc/simpleform/input/radiogroup", "splunkjs/mvc/simpleform/input/multiselect", "splunkjs/mvc/simpleform/input/checkboxgroup", "splunkjs/mvc/simpleform/input/text", "splunkjs/mvc/simpleform/input/timerange", "splunkjs/mvc/simpleform/input/submit", "splunkjs/mvc/searchbarview", "splunkjs/mvc/tableview", "splunkjs/mvc/radiogroupview", "splunkjs/mvc/multidropdownview", "splunkjs/mvc/searchmanager", "splunkjs/mvc/savedsearchmanager", "splunkjs/mvc/postprocessmanager", "splunkjs/mvc/simplexml/urltokenmodel" // Add comma-separated libraries and modules manually here, for example: // ..."splunkjs/mvc/simplexml/urltokenmodel", // "splunkjs/mvc/checkboxview" ], function( mvc, utils, TokenUtils, _, $, DashboardController, HeaderView, FooterView, Dashboard, PanelRef, ChartElement, EventElement, HtmlElement, ListElement, MapElement, SingleElement, TableElement, FormUtils, EventHandler, DropdownInput, RadioGroupInput, MultiSelectInput, CheckboxGroupInput, TextInput, TimeRangeInput, SubmitButton, SearchBarView, TableView, RadioGroupView, MultiDropdownView, SearchManager) { (function() { // var instanceList = []; // Splunk search managers new SearchManager({ id: "search1", latest_time: "now", earliest_time: "-1h@h", autostart: "true", search: "| metadata type=hosts | dedup host | table host" }); var manager = splunkjs.mvc.Components.getInstance("search1"); // gets data manager.on('search:done', function() { var results = manager.data('results'); results.on('data', function() { var rows = results.data().rows for (var i in rows) { /* create your charts */ } }); }); } ... View more

I would look into modular inputs. ... View more

I've reviewed the source and it uses a simple urllib2 connect https://www.virustotal.com/en/search/ and does not handle proxies.. You would have to contact KIM DONG WOO to implement a proxy feature. ... View more

@splunkman341, Your regex is invalid. ( and ) are part of the regex syntax used for group you have to escape them. I recommend that you visit http://www.regular-expressions.info. If you would like service checkout my update regex statement. ... View more

This can be accomplish through Windows file or directory audit. Once enabled event for change, delete, open, etc will start appearing in the windows security event log. This is control on a file or directory basis. Here is a Splunk blog article on this. http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/ ... View more

As another option I would checkout this post on how to add egg file or source files while still using Splunk python rather than system. http://answers.splunk.com/answers/220196/import-non-native-python-libraries-into-splunk.html#answer-222585 ... View more

@splunkman341, If you simply looking for a regex that will extract document action the following will work. ...| rex field=_raw "EmployeeDocumentServicesImpl\.(?<document_action>[^\(]+)" | stats count by document_action Updated to include service as extracted group. ...| rex field=_raw "rs\.services\.(?<service>[^\.]+)\.(?<document_action>[^\(]+)" | stats count by document_action Both work on all samples provided and match in under 25 steps. ... View more

If his application is not line breaking the event, essentially printing multiple line into a single line they would merge. If this is the case you could use BREAK_ONLY_BEFORE in the props.conf. ... View more

Try the multisearch command. ... View more