I know the answers site has a description for having one Python program call another, which includes a custom module, but this seems to be more geared for scripted inputs or alerts. http://splunk-base.splunk.com/answers/8/can-i-add-python-modules-to-the-splunk-environment. I have a custom module that works outside of Splunk in Python 2.6, but I need to use this within a lookup Python script. The script will have parameters passed within it as labeled in transforms.conf. The custom module will eventually call native C/C++ code. The module builds itself into an egg file. I can't simply drop this file into Splunk's Python 2.6 site-packages directory as even the import didn't work. How do I let Splunk know about this module so that the lookup Python script can import and use it? ... View more

I have web content (articles, stories) where each article is grouped in a category such as NEWS, STORY, etc. Website visitors are grouped by region. In each region, I want to be able to rank each category by the number of site visitors who read articles in a category. I can get a count by region and category. I can get a count by Region, VisitorID, Category. However, I want to know how many site visitors had CAT1 as their most-read category. How many had CAT1 as their second most-read category? How many had CAT2 as their most-read category? Here's an example: **Region VID Category # Visitors who ranked this 1st** NY 87 STORY 10 NY 44 STORY 9 LA 98 NEWS 4 ... View more

I would like to relate 2 different sourcetypes with a common value for a field. The fields are named differently in each sourcetype. For my example I have: sourcetype=A OR sourcetype=B|transaction field_A,field_B maxspan=1d connected=f|eval num=mvcount(sourcetype)|where num=2 This means relate all events of sourcetype A to sourcetype B using the extracted field_A and field_B from each respective sourcetype and only show grouped events that have both sourcetypes. So, if field_A=2 and field_B=2 for the allotted time period, there should be a grouping. However, if field_A=3 and field_B=2, there should be no match. If I don't use connected=f, I get no matches at all for 2 different sourcetypes, even when they exist. If I use connected=f, it groups events even if field_A and field_B have different values. The end goal is to group events where field_A==field_B for the same values. What am I doing incorrectly. Here's another more concrete example: sourcetype="trade_pricing" OR sourcetype="stockquote_entry" |transaction stock_name,stock_symbol connected=f maxspan=1d |eval num=mvcount(sourcetype)|where num=2 The results I get back from a search for a transaction grouping are: StockQuotes Stock Symbol GE 11/1/2010 4:02pm Change-0.07 Mon Nov 1 17:20:04 EDT 2010 Looking up price for BAC Mon Nov 1 17:20:04 EDT 2010 Got price for BAC as 0 Mon Nov 1 17:21:08 EDT 2010 Looking up price for BAC Mon Nov 1 17:21:08 EDT 2010 Got price for BAC as 0.5 * host=mac-mbp15.local * sourcetype=stockquote_entry * sourcetype=trade_pricing * source=/Applications/splunk/etc/apps/Trade/logs/pricing.log * source=stockquote_xml * stock_name=BAC * stock_symbol=GE Notice how stock_name and stock_symbol have different values, but the events are still grouped together. Any explanations? ... View more

The transaction search command will automatically compute the duration from the first event to the last event within each grouping. I would like to create a new multivalue field which computes the difference in time between each event within a grouping. For example if I have sourcetype=my_message |transaction req I might get this as one transaction event: Mon Jun 14 17:03:20.543 EDT 2010 req=43300 hi there Mon Jun 14 17:03:20.743 EDT 2010 req=43300 Another message Mon Jun 14 17:03:20.845 EDT 2010 req=43300 status=invalid_request Now, I know the duration field for this would be set to 0.302 in this example. However, I would like time delta's between each subsequent event. In this example, I'd like a new multivalue field set to 0.200 and 0.102. If the number of events in the group had 4 entries, I'd have 3 time differences. If the number of events in the grouping had 5 entries, I'd have 4 time differences and so on. How can this be done? ... View more