If you want to have them all in the same field name, Yes. Otherwise you would have to use different field names and therefore different regex's for each 5.1.2 or 5.4.7 like number. So for example for matches into one field name you can use this: MID\s\d+\sto\s\d+\s-\s\d\.\d\.\d\s-\s(?<field>[^\r\n]+) ... View more

sure, see my updated answer 😉 ... View more

Please provide some useful raw events and your expected result, otherwise there is no way for anyone to help you get the result you want 😉 ... View more

Just in case, here is the link to the app https://splunkbase.splunk.com/app/1645/ ... View more

Hi onkarkore1, you can try something like this: your base search here [ | inputlookup yourLookupTableHere | return columnName ] This will get all entries from the lookup and create a long search like this: your base search here ( columnName=val1 OR columnName=val2 OR columnName=val3 .... ) Hope this helps to get you started ... cheers, MuS ... View more

@mkarikatti, btw in version 2 which is the most recent, the saved search is already disabled 😉 ... View more

@mkarikatti Thanks for the feedback on the saved search, I will disable it by default. But regarding the second comment: I will not add something like this into the notes. The intention / reason for this app is to reload changed configs on the fly so you can test and validate them (actually I should add this line to the notes of the app 😉 ). That said, I don't see a reason to put this app on any production instance. ... View more

Maybe check the Splunk forwarder version you mentioned, the most recent one is 6.6.1 😉 ... View more

Why do you say there is no line breaking? The default line breaking is still happening. Can you please add the raw event for one or two bad examples? There must be something triggering the line break or truncate .... ... View more

can you post the props.conf settings for the used sourcetype and some sample events of good and bad events? ... View more

One thing I can think of is that the files come in slowly and Splunk breaks too early, therefore you get garbage lines. Have a look at the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf of inputs.conf for the options time_before_close = <integer> * Modification time delta required before the file monitor can close a file on EOF. * Tells the system not to close files that have been updated in past <integer> seconds. * Defaults to 3. multiline_event_extra_waittime = [true|false] * By default, the file monitor sends an event delimiter when: * It reaches EOF of a file it monitors and * Ihe last character it reads is a newline. * In some cases, it takes time for all lines of a multiple-line event to arrive. * Set to true to delay sending an event delimiter until the time that the file monitor closes the file, as defined by the 'time_before_close' setting, to allow all event lines to arrive. * Defaults to false. ... View more

Splunk search time order of operations strikes again - sorry for that 😕 But you could try using a eval based macro http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Definesearchmacros#Eval_expressions_in_macro_definitions for this ... View more

No, if the free trail license has expired alerting will stop because its not available - see the docs for more details http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree?r=searchtip#What_is_included_with_Splunk_Free.3F ... View more

Yes, that's the downside of the second option. Therefore the automatic lookup and the calculated field as in option one is preferred. Or use the mvappend() as you figured out, for the calculated field. Still post processing this new field will be tricky.... cheers, MuS ... View more

Ask your sysadmin or network admin for help. This is not something that can be configured in Splunk. But a good starting point is this here https://www.port25.com/how-to-check-an-smtp-connection-with-a-manual-telnet-session-2/ cheers, MuS ... View more

Hi wuming79, this sounds like trouble/problems outside of Splunk. Check there is no firewall blocking SMTP from your Splunk server, check that the mail server you are using (Windows defaults as well to localhost and has most likely not any email sending facility by default) is allowing you to relay emails. All your friendly network and email admin to check this for you. Hope this helps ... cheers, MuS ... View more

How come? transforms.conf can be created/modified in the UI under settings - fields - field transformation Read this https://answers.splunk.com/answers/149597/im-struggling-with-how-i-should-be-doing-inputs-and-also-props-transforms-etc-stuff-within-splunk-cloud.html which explains how the options of props and transforms maps to the UI. cheers, MuS ... View more

Okay just run this | rest /servicesNS/-/-/saved/searches And work your way from there to get the result you want. ... View more

because this | rest /services/saved/searches action.email.to=("page.XYZ@xyz.com" OR "ABC@xyz.com") will not work. Also use a different rest endpoint to get all saved searches. The search should be more like : | rest /servicesNS/-/-/saved/searches | search action.email.to="page.XYZ@xyz.com" OR action.email.to="ABC@xyz.com" title=*| rename title AS "Title", action.email.to AS "Email" , dispatch.earliest_time AS "frequency", alert.severity AS "SEV" | eval Severity=case(SEV == "5", "Critical-5", SEV == "4", "High-4",SEV == "3", "Warning-3",SEV == "2", "Low-2",SEV == "1", "Info-1") | table Title, frequency, Severity, Email ... View more

Hi tandem_spence, Maybe I'm too pedantic here, but to answer your question Is it possible for a universal forwarder to inject additional data into existing log stream? Yes, this is possible. There is the _meta option in inputs.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf which enables you to add any additional key / value pairs to the event you want. For example: _meta = field1::foo field2::bar will add this field1 = foo and field2 = bar to all events. I know you added a lot of information in your post and most likely your verbosity level will be dynamic and therefore this approach will not solve your use case. But as I said, it's more my pedantry / OCD here answering your original question 😉 anyway, Hope this helps ... cheers, MuS ... View more

Hi ewise1, take a look at this answer https://answers.splunk.com/answers/214487/can-i-extract-a-field-with-a-regexed-dynamic-field.html to learn how it can be done. Your regex would be something like this: ^(\w+\s\w+|^\w+)[\s:\[\d\]]+'(.+)' hope this helps ... cheers, MuS ... View more

Did you follow the app instruction? It says: As the dashboards are driven mainly by eventtypes, you may need to make a copy of \default\eventtypes.conf to \local\eventtypes.conf and add 'index=<your events="">' to the begining of each eventtype search query. ... View more

Hi rangineniarunkumar, On the indexer you can set the acceptFrom = <network_acl> option in inputs.conf to a set of networks or addresses to accept connections from, see the docs for more details http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf A second option is to filter your events http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest and only keep events from your known host for example. Hope this helps ... cheers, MuS ... View more