You'll probably need to 'rex' out the field you require index=web *RESTAPI* | rex field=_raw "service:(?<rest_service>.*)" | stats avg(Duration) by rest_service ... View more

Do a search for the events that contain RESTAPI and feed those results into the stats command index=web *RESTAPI* | stats avg(Duration) by host This assumes that the Duration field is being extracted, which it should, unless you have disabled kv extraction ... View more

In your props.conf, you should be able to use KV_MODE = xml to extract xml data You could use the spath command in search to extract fields at search time http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/spath ... View more

curl -k -u admin:changeme --request DELETE https://localhost:8089/servicesNS/nobody/search/storage/passwords/realm:username: For example, the user 'simon' in realm 'work' would be curl -k -u admin:changeme --request DELETE https://localhost:8089/servicesNS/nobody/search/storage/passwords/work:simon: ... View more

Splunk has an auto load-balancing capability, http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Configureforwarderswithoutputs.conf But without knowing all the details of your environment and requirements, this may be the recommended approach. ... View more

The way Splunk handles Cold and Frozen buckets is outlined here, http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/HowSplunkstoresindexes For cold buckets, you only have the option of providing a filesystem location, which is where the data will roll to once it reaches a certain age. For frozen, you could use the Splunk script, shuttl, which is built for the exact task you are after. Alternatively, you could mount S3 as a filesystem location (e.g., http://tecadmin.net/mount-s3-bucket-centosrhel-ubuntu-using-s3fs/). I would imagine performance would not be great, and I don't think it would be a supported solution. Recommend that you use shuttl, what is your aversion to doing so? ... View more

Have you properly added the lookup to Splunk, uploading the file, and then creating the lookup? As per http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Addfieldsfromexternaldatasources Your lookup usually shouldn't reference the actual CSV file, but the lookup that you've created. If you're still stuck, try breaking the statement up into smaller searches and confirm that you are getting the results at each stage (i.e., run just the dbquery and ensure you get the name field being produced - this will remove the dbconnect as a source of your problem) ... View more

Event Log is shutdown is 1100 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=1100 There doesn't appear to be a corresponding event for it starting up again (I suppose you would just get events to indicate it has restarted) ... View more

Event Code 4608 is for Windows starting up https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4608 Event Code 4609 is Windows is shutting down https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4608 ... View more

In props.conf (assuming the current sourcetype is udp:514) [udp:514] TRANSFORMS-set_sourcetype_ipam = ipam_sourcetype_dns, ipam_sourcetype_dhcp In transforms.conf [ipam_sourcetype_dns] REGEX = <regex for dns event> DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::ipam:dns [ipam_sourcetype_dhcp] REGEX = <regex for dhcp> DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::ipam:dhcp You will need to develop your own regexes for the two event types, and put that in the transforms.conf file, and then all future events will be sourcetype'd appropriately. ... View more

<base search> | eval total=bytes_in + bytes_out | stats sum(total) as total by category | sort - total | head 5 | eval total=total/1048576 We sort the data based on the total (the - makes it decreasing, so largest first) The head 5 gives only the first 5 results ... View more

yes, you should replace it with stats sum(total_mb) by category I would recommend that you sum the bytes first, before converting to MB. This avoids any data loss by rounding your data to MB. Your final query would be <base search> | eval total=bytes_in + bytes_out | stats sum(total) as total by category | eval total=total/1048576 ... View more

I would be hesitant at trying to replace the deployer functionality. The Search Heads are meant to be kept in close synchronization, so that field extractions, lookups, etc... are kept the same and the same results are returned regardless of search head. ... View more

Maybe you could share examples from each of your log files, which would help in developing a query to group your data ... View more

(?<date_time>\d{4}/\d{2}/\d{2}\s\d{2}:\d{2}:\d{2}\.\d{3})\s+[Logger]\s+(?<transaction_id>[^;]+)\s+INFO:\s+(?<info>[^;]+)\s+PC\s+Response:\s+RequestId:\s+(?<request_id>[^;]+)\s+User-Id:\s+(?<user_id>[^;]+)\s+RequestType:\s+Open Your date_time has (slash). which matches only a dot, while your event has /. You also have a space before User-Id, while the \s+ means that there must be a second white space character there. I think you got all the other s+ correct. I'm not sure why you are matching everything except sem-colons ([^;]) but it should still work. ... View more

In your query, you have eval volume=recv_bytes/1024/1024 | stats sum(volume) as volume by src_ip Remove that, and just have | stats sum(recv_bytes) as volume by src_ip Doing the recv_bytes/1024/1024 is converting your byte count to MB and skewing your results. Leave the formatting of the values to later. So you should have source="F:\\Splunk_Log Files\\*" | stats sum(recv_bytes) as volume by src_ip | sort - sum(volume) | head 10 | eval b=volume | eval kb=b/1024 | eval mb=kb/1024 | eval gb=mb/1024 | eval tb=gb/1024 | eval volume=case(tb>=1,tb."TB",gb>=1,gb."GB",mb>=1,mb."MB",kb>=1,kb."KB",1=1,b."b") | fields - b, kb, mb, gb, tb ... View more

In your query, you have eval volume=recv_bytes/1024/1024 | stats sum(volume) as volume by src_ip Remove that, and just have | stats sum(recv_bytes) as volume by src_ip Doing the recv_bytes/1024/1024 is converting your byte count to MB and skewing your results. Leave the formatting of the values to later. So you should have source="F:\\Splunk_Log Files\\*" | stats sum(recv_bytes) as volume by src_ip | sort - sum(volume) | head 10 | eval b=volume | eval kb=b/1024 | eval mb=kb/1024 | eval gb=mb/1024 | eval tb=gb/1024 | eval volume=case(tb>=1,tb."TB",gb>=1,gb."GB",mb>=1,mb."MB",kb>=1,kb."KB",1=1,b."b") | fields - b, kb, mb, gb, tb ... View more

rex "Address Line 1=(?<address>[^,]*)" Needed a space between Line and 1. I've tested this and it works for me. You probably need several rex (or you could combine them all into a single rex) to get all the lines. | rex "Address Line 1=(?<address1>[^,]*)" | rex "Address Line 2=(?<address2>[^,]*)" | rex "Address Line 3=(?<address3>[^,]*)" | rex "Address Line 4=(?<address4>[^,]*)" | rex "PostCode=(?<address_postcode>[^,]*)" ... View more

source="F:\\Splunk_Log Files\\*"| eval volume=recv_bytes/1024/1024 | stats sum(volume) as volume by src_ip | sort - sum(volume) | head 10 | eval b=volume | eval kb=b/1024 | eval mb=kb/1024 | eval gb=mb/1024 | eval tb=gb/1024 | eval volume=case(tb>=1,tb."TB",gb>=1,gb."GB",mb>=1,mb."MB",kb>=1,kb."KB",1=1,b."b") | fields - b, kb, mb, gb, tb That will remove the individual fields ... View more