Hi johnchamp, you could have the formula split up in the lookup like: name,value1,value2,value3 first,counter,100,2 and use it in the search: index=main sourcetype="generatedLogs" earliest=-2m | fields name, counter | inputlookup append=t test.csv | eval result=value1*value2/value3 Hope this helps ... cheers, MuS ... View more

Hi krishnacasso, Welcome to Splunk 🙂 if you already have a field called status which represents the status code, you can run a search like this: your base search to get the apache logs earliest=-11min@min | bin _time span=1min | stats count(eval(status=="500")) by time | where count>=10 This will count status="500" per minute and if the count is bigger or equal 10 show the result. You can safe this as an alert http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Aboutalerts If the status field is not yet available run the above search with some regex to get the field : your base search to get the apache logs earliest=-11min@min | rex ""\s(?<status>\d+)\s\d" | bin _time span=1min | stats count(eval(status=="500")) by time | where count>=10 Hope this helps to get you started ... cheers, MuS PS: This is un-tested, because I don't have a Splunk handy right now 😉 ... View more

There shouldn't be any problem since the UF is only reading logs. As well the UF will pick up reading any logs file from the last know position in the logs. cheers, MuS ... View more

Just a reminder: index=_internal has a default retention time of 30 days - so you will not be able to find anything for days 31-60. ... View more

Yeah, that's a lot of work and all hard coded - but well done 😉 I've updated my search in the dashboard a bit to return the field names as eavgc* , emaxc* or eminc* now. cheers, MuS ... View more

Hi nikkkc, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.8/AdvancedDev/SearchScripts#Build_your_search_command_in_Python to learn more about this topic. The important part is to import splunk.Intersplunk in your Python script, so the script can receive the results of the Splunk search and process them. Here is an example of a script I use: myresults,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() # getting search results form Splunk for r in myresults: # loop the results for k, v in r.items(): # get key value pairs for each result if k == "server": # get key section_name = v # set value This will check the results passed by Splunk for a field called server and if found it uses its value. At the end of the script it will return the output back to Splunk using this line: splunk.Intersplunk.outputResults(results) # print the result into Splunk UI Hope this helps ... cheers, MuS ... View more

Only duplicates will be taken form the higher precedence .conf file ... View more

Hi dbcase, This is a tricky one, but I was able to get it working in a dashboard at least (Strange it's not working in Search though....) Take a look at this dash board: <form> <label>rex based on drop down</label> <fieldset submitButton="false"> <input type="dropdown" token="token"> <label>Select chan:</label> <search> <query>index=* source="Untitled.txt" host="indexer" sourcetype="mytest" | dedup chan | table chan</query> <earliest>0</earliest> <latest></latest> </search> <fieldForLabel>chan</fieldForLabel> <fieldForValue>chan</fieldForValue> </input> </fieldset> <row> <panel> <table> <search> <query>source="Untitled.txt" host="indexer" sourcetype="mytest" | fields chan e* | table * | rex max_match=0 "(?&lt;myField&gt;\w+c"$token$"):\s+(?&lt;myValue&gt;[^\s]+)" | fields - _raw | where chan=$token$ | table chan my* | eval zipped = mvzip(myField, myValue, "###") | mvexpand zipped | eval mv1 = replace(zipped, "###.*$", "") | eval mv2 = replace(zipped, "^.*###", "" ) | fields - zipped | eval {mv1}=mv2 | fields chan e* | stats max(*) AS *</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> This will get all chan values into a drop down and gets back the evagc* , emaxc* and eminc* values based on the value of chan . If you have more questions let me know and we can look at this offline 😉 Hope this helps ... cheers, MuS PS: here are my test events based on your provided examples: cpeId: 9c97261be426 messageType: zigBeeData payload: { [-] apsDecryptionFailures: 0 apsFrameCounterFailures: 0 apsRxBcast: 0 apsRxUcast: 355 apsTxBcast: 0 apsTxUcastFailures: 0 apsTxUcastRetries: 0 apsTxUcastSuccesses: 279 bufferAllocationFailures: 0 chan: 13 eavgc11: -56 eavgc12: -45 eavgc13: -42 eavgc14: -52 eavgc15: -66 eavgc16: -40 emaxc11: -56 emaxc12: -45 emaxc13: -42 emaxc14: -49 emaxc15: -31 emaxc16: -39 emaxc17: -33 eminc11: -56 eminc12: -45 eminc13: -42 eminc14: -52 eminc15: -72 eminc16: -41 cpeId: 9c97261be426 messageType: zigBeeData payload: { [-] apsDecryptionFailures: 0 apsFrameCounterFailures: 0 apsRxBcast: 0 apsRxUcast: 355 apsTxBcast: 0 apsTxUcastFailures: 0 apsTxUcastRetries: 0 apsTxUcastSuccesses: 279 bufferAllocationFailures: 0 chan: 14 eavgc11: -56 eavgc12: -45 eavgc13: -42 eavgc14: -52 eavgc15: -66 eavgc16: -40 emaxc11: -56 emaxc12: -45 emaxc13: -42 emaxc14: -49 emaxc15: -31 emaxc16: -39 emaxc17: -33 eminc11: -56 eminc12: -45 eminc13: -42 eminc14: -52 eminc15: -72 eminc16: -41 cpeId: 9c97261be426 messageType: zigBeeData payload: { [-] apsDecryptionFailures: 0 apsFrameCounterFailures: 0 apsRxBcast: 0 apsRxUcast: 355 apsTxBcast: 0 apsTxUcastFailures: 0 apsTxUcastRetries: 0 apsTxUcastSuccesses: 279 bufferAllocationFailures: 0 chan: 15 eavgc11: -56 eavgc12: -45 eavgc13: -42 eavgc14: -52 eavgc15: -66 eavgc16: -40 emaxc11: -56 emaxc12: -45 emaxc13: -42 emaxc14: -49 emaxc15: -31 emaxc16: -39 emaxc17: -33 eminc11: -56 eminc12: -45 eminc13: -42 eminc14: -52 eminc15: -72 eminc16: -41 ... View more

This is of interest to you http://docs.splunk.com/Documentation/Splunk/6.3.3/Admin/Wheretofindtheconfigurationfiles#How_app_directory_names_affect_precedence for your example ... View more

Hi, I updated the original answer and fixed all typos in it. So, feel free to accept it if this answers your question - thanks. ... View more

Yesterday I ran into this on a Splunk 6.3.0 instance....looks like this feature is still available 🙂 ... View more

Is your props.conf applied to [syslog] ? ... View more

try something like this is $SPLUNK_HOME/etc/apps/YourAppName/local/props.conf [bluecoat] TRANSFORMS-001_rewrite_bluecoat_sourcetype = bluecoat_get_hostname,bluecoat_rewrite_sourcetype and in $SPLUNK_HOME/etc/apps/YourAppName/local/transforms.conf set the regex to match the second IP: [bluecoat_get_hostname] REGEX = "\s((?:\d+\.){3}\d+)\s DEST_KEY = MetaData:Host FORMAT = host::$1 [bluecoat_rewrite_sourcetype] SOURCE_KEY = MetaData::Host REGEX = 192\.168\.3\.217 DEST_KEY = MetaData::Sourcetype FORMAT = sourcetype::bluecoat:proxysg:access:syslog This is un-tested, but it should work as long as you have it on either a Heavy Weight Forwarder or an Indexer and don't forget to restart Splunk after the changes. ... View more

No it will not, because the regex matches "\s (a double quote followed by a whitespace) in front of the digits and this only happens before the second IP not before the first IP. Take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/Knowledge/ExtractfieldsinteractivelywithIFX to learn about field extraction ... View more

What do you mean with but I can't apply it to extract that data I want to a field ? If you run this: | stats count | eval foo="column row 1 dc(ID) 273 dc(SBC) 2 dc(TGID) 273 dc(TGN) 504 dc(beginTime) 2 dc(c1907466966) 54 dc(c1907466967) 59 dc(c1907466968) 55 dc(c1907466969) 31 dc(c1907466970) 50 dc(c1907466971) 55 dc(c1907466972) 7 dc(c1907466973) 47 dc(c1907466974) 57" | rex max_match=0 field=foo "dc\Dc(?<name1>\d+)\D" | table name1 It will create a multi value field called name1 . cheers, MuS ... View more

Hi nhanzlik, this will blacklist any log file in the directory /d01/admin/servers/server1/logs which contains a dot and some ending like foo.log or this.is.a.foo.log.baz from that point in time where you configured the blacklist and have restarted Splunk. Any events indexed pre change will still be in the index and will still count on that day against the license usage. Hope this helps ... cheers, MuS ... View more

Quote: If I set the regex= 192\.168\.3\.217 , then any message that comes from any device with the string "192.168.3.217" will be matched as bluecoat:proxysg:access:syslog. Is that right? No, any events from the host=192.168.3.217 will get the sourcetype bluecoat:proxysg:access:syslog This is because the regex only checks on the SOURCE_KEY = MetaData::Host . But key here is to get the host extraction working in this case first. Based on your provided examples this should work as host regex "\s((?:\d+\.){3}\d+)\s ... View more

update done ... View more

Ahh, sorry my bad ! I'll update the answer .... ... View more

Hi fredkeiser, Your regex is missing the double escaped backslashes and you can test it with Splunk's internal regex functions: splunk cmd pcregextest test_str="C:\Program Files (x86)\LIC\Current\test\filename.log" mregex=".+\\(.+)\\[^\\]*" returns: Original Pattern: '.+\(.+)\[^\]*' Expanded Pattern: '.+\(.+)\[^\]*' ERROR: Regex: unmatched parentheses But if you double escape the backslashes it works: splunk cmd pcregextest test_str="C:\Program Files (x86)\LIC\Current\test\filename.log" mregex=".+\\\(.+)\\\[^\\\]+" returns: Original Pattern: '.+\\(.+)\\[^\\]+' Expanded Pattern: '.+\\(.+)\\[^\\]+' Regex compiled successfully. Capture group count = 1. Named capturing groups = 0. SUCCESS - match against: 'C:\Program Files (x86)\LIC\Current\test\filename.log' #### Capturing group data ##### Group | Name | Value -------------------------------------- 1 | | test Hope this helps ... cheers, MuS ... View more