Hi pavanae, follow the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/Installation/Upgradeto6.3onUNIX it also covers what you should backup. BTW, you should always store a backup outside of the system/server the backup was made .... but this is not Splunk related, this is common sense 😉 Also, it depends on the upgrading approach you choose if you require sudo or not: if you use the tar ball to upgrade, this is done as Splunk user. If you choose the rpm or dkg package, this is normally done by using sudo Hope this helps ... cheers, MuS ... View more

No need to create a new question! I'll email you to get this working 😉 ... View more

can you post the lit search from the job inspector? the regex is not wrong; there must be some other problem..... ... View more

the regex matches on regex101 without problem, but in Splunk you must put this regex inside of a starting " and a end " but have you tried it without the field name? So the regex is done on the _raw base search here | rex "\"lines\":\[\"(?<Street>[^\"]+)\",\"(?<Town>[^\"]+)\",\"(?<Country>[^\"]+)\"" | table Street Town Country ... View more

You're missing the last " so use it in the search this way: base search here | rex field="detail.input-ida-request" "\"lines\":\[\"(?<Street>[^\"]+)\",\"(?<Town>[^\"]+)\",\"(?<Country>[^\"]+)\"" | more splunk fu ... View more

Hi ckillg, if you're looking at inputs.conf http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf there is the batch mode which will delete a file after it has been indexed by Splunk....but it has no confirmation method. Hope this helps ... cheers, MuS ... View more

Oh sorry my bad 🙂 mess up metadata and metasearch so see my updated answer 😉 ... View more

Hi hkl2332, much faster to use metasearch as it search only in the metadata of the specified indexes: | metasearch index=* sourcetype=* | stats count by index, sourcetype | fields - count See the docs http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Metasearch for more details. cheers, MuS ... View more

I'm still not 100% clear what you expect as result.... Have you tried head ? transaction Data Payload | head limit=100 | stats sum(eventcount) AS SumCountDuring4Minutes This will limit the result to 100 events... ... View more

Instead of just replying like this: I like to provide useful answers and explain what happens 😉 Just keep trying out regex101.com which explains the regex very well and also try the pcregextest command of Splunk http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/CommandlinetoolsforusewithSupport#pcregextest which will use Splunk's internal regex and shows what Splunk will match. cheers, MuS ... View more

You should provide a sample of your events; best to include good and bad examples 😉 ... View more

Hi JensT, have a look at this answer http://answers.splunk.com/answers/311712/how-to-produce-a-human-readable-date-from-earliest.html#answer-312203 which shows, how this could be done. cheers, MuS ... View more

and another spam wave hit; but no one noticed because Mjölnir was on duty 😉 ... View more

HeHe, so my answer would fit better because it shows both ways 😉 Never mind ... blop - ein Flens in Ehren 🙂 Ja, die gibt es hier auch 😉 ... View more

dammit - 48 secs faster 🙂 ... View more

Hi IRHM73, based on the provided examples this will match: \"firstName\":\{\"value\":\"(?<idaFName>[^\"]*) This is the pure regex so to use it in Splunk use it this way: base search here | rex "\"firstName\":\{\"value\":\"(?<idaFName>[^\"]*)" | do more foo here But...this looks like JSON? Have you tried spath http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Spath or KV_MODE=JSON in props.conf Hope this helps ... cheers, MuS ... View more

Hi bamthauer, Yes, it is running on Splunk 6.3 cheers, MuS ... View more

next one: index=infosec sourcetype=sep_usb_logs file_size>0 NOT vapi_name="File Delete" | timechart dc(parameter) by user_name usenull=f useother=f and read about the timechart command here http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Timechart ... View more