So say I have an index that's got data in it back 120 Days, and I want to delete events older than 90 days, keeping the indexes trimmed to 90 days going forward. Would the below process accomplish this? Set indexes.conf: [indexname] frozenTimePeriodInSecs = 7776000 restart splunk I'm assuming that if I restart splunk, it will automatically go through and start deleting stuff older than 90 days on its own. Is this correct? ... View more

Trying to strip the header info out of the event below, leaving only the JSON. I've tried "|extract reload=true" but neither that nor restarting Splunk seems to be working. Must be something with my syntax. This example is trying to remove the first 2 lines (for sake of simplicity in getting it to work) props.conf: [akamai_post_json] SEDCMD-httpheader = s/(?mg)^POST.*$\n|^User-Agent.*$\n|//g The event: POST / HTTP/1.1 User-Agent: curl/7.26.0 Host: localhost Accept: */* Content-Length: 2552 Expect: 100-continue Content-Type: multipart/form-data; boundary=----------------------------0b1c32056fc5 ------------------------------0b1c32056fc5 Content-Disposition: form-data; name="fileupload"; filename="default_connector_schema_1.0.json" Content-Type: application/octet-stream { "apiType" : "String", "apiFormat" : "String", "apiVersion" : 0, "ID" : "String", "startTime" : "String", "eventType" : "String", "cpCode" : 0, "message" : { "protocol" : "0", "protoVersion" : 0, "clientIP" : "String", "reqPort" : 0, "reqHost" : "String", "reqMethod" : "String", "reqPath" : "String", "reqQuery" : "String", "reqContType" : "String", "reqContLen" : 0, "sslProtocol" : "String", "sslVersion" : 0, "respStatus" : 0, "respRedirURL" : "String", "respContType" : "String", "respContLen" : 0, "respBytesServed" : 0, "userAgent" : "String", "originHostname" : "String" }, "httpHeaders" : { "reqHeader" : { "accEnc" : "String", "accLang" : "String", "auth" : "String", "cacheCtl" : "String", "connection" : "String", "contMD5" : "String", "cookie" : "String", "DNT" : "String", "ifMatch" : "String", "ifMod" : "String", "ifNoMatch" : "String", "pragma" : "String", "range" : "String", "referer" : "String", "TE" : "String", "upgrade" : "String", "via" : "String", "xFrwdFor" : "String", "xReqWith" : "String" }, "respHeader" : { "cacheCtl" : "String", "connection" : "String", "contEnc" : "String", "contLang" : "String", "contLen" : "String", "contMD5" : "String", "contDisp" : "String", "contRange" : "String", "date" : "String", "eTag" : "String", "expires" : "String", "lastMod" : "String", "p3p" : "String", "pragma" : "String", "server" : "String", "setCookie" : "String", "trailer" : "String", "transEnc" : "String", "vary" : "String", "warning" : "String", "wwwAuth" : "String" } }, "performance" : { "reqHeadSize" : 0, "reqBodySize" : 0, "respHeadSize" : 0, "respBodySize" : "String", "downloadTime" : "String", "originName" : "String", "originIP" : "String", "originInitIP" : "String", "originRetry" : 0, "lastMileRTT" : 0, "lastMileBW" : 0, "netOriginRTT" : 0, "cacheStatus" : "String", "lastByte" : true, "cliCountry" : "String", "edgeIP" : "String", "reqID" : "String" } } ------------------------------0b1c32056fc5-- ... View more

Trying to strip the header out of an incoming http post and only index the json for parsing with spath. Having an issue with the regex I believe. props.conf: [akamai_post_json] TRANSFORMS-t1=nullqueue_httpheader transforms.conf: [nullqueue_httpheader] REGEX=^(?:POST|User-Agent|Accept|Content-Length|Expect|Content-Type|Content-Disposition)gm DEST_KEY=queue FORMAT=nullQueue Here's a sample event: POST / HTTP/1.1 User-Agent: curl/7.26.0 Host: localhost Accept: */* Content-Length: 2552 Expect: 100-continue Content-Type: multipart/form-data; boundary=----------------------------0b1c32056fc5 ------------------------------0b1c32056fc5 Content-Disposition: form-data; name="fileupload"; filename="default_connector_schema_1.0.json" Content-Type: application/octet-stream { "apiType" : "String", "apiFormat" : "String", "apiVersion" : 0, "ID" : "String", "startTime" : "String", "eventType" : "String", "cpCode" : 0, "message" : { "protocol" : "0", "protoVersion" : 0, "clientIP" : "String", "reqPort" : 0, "reqHost" : "String", "reqMethod" : "String", "reqPath" : "String", "reqQuery" : "String", "reqContType" : "String", "reqContLen" : 0, "sslProtocol" : "String", "sslVersion" : 0, "respStatus" : 0, "respRedirURL" : "String", "respContType" : "String", "respContLen" : 0, "respBytesServed" : 0, "userAgent" : "String", "originHostname" : "String" }, "httpHeaders" : { "reqHeader" : { "accEnc" : "String", "accLang" : "String", "auth" : "String", "cacheCtl" : "String", "connection" : "String", "contMD5" : "String", "cookie" : "String", "DNT" : "String", "ifMatch" : "String", "ifMod" : "String", "ifNoMatch" : "String", "pragma" : "String", "range" : "String", "referer" : "String", "TE" : "String", "upgrade" : "String", "via" : "String", "xFrwdFor" : "String", "xReqWith" : "String" }, "respHeader" : { "cacheCtl" : "String", "connection" : "String", "contEnc" : "String", "contLang" : "String", "contLen" : "String", "contMD5" : "String", "contDisp" : "String", "contRange" : "String", "date" : "String", "eTag" : "String", "expires" : "String", "lastMod" : "String", "p3p" : "String", "pragma" : "String", "server" : "String", "setCookie" : "String", "trailer" : "String", "transEnc" : "String", "vary" : "String", "warning" : "String", "wwwAuth" : "String" } }, "performance" : { "reqHeadSize" : 0, "reqBodySize" : 0, "respHeadSize" : 0, "respBodySize" : "String", "downloadTime" : "String", "originName" : "String", "originIP" : "String", "originInitIP" : "String", "originRetry" : 0, "lastMileRTT" : 0, "lastMileBW" : 0, "netOriginRTT" : 0, "cacheStatus" : "String", "lastByte" : true, "cliCountry" : "String", "edgeIP" : "String", "reqID" : "String" } } ------------------------------0b1c32056fc5-- ... View more

I setup a scripted input pointing to a .bat file which runs a curl request. But instead of only ingesting the output of the command that's run, splunk gets everything from the shell, including the current directory. How do I only get the output of the command, ignoring the actual command? C:\WINDOWS\system32>C:\curl\curl.exe http://search.twitter.com/search.json?q=blah ----output of command is here---- ... View more

This regex is actually a lot longer, and obviously the events are too, but here's what appears to be happening. I want data out of paranthesis in the format below, EXCEPT for when the word in front of the paren is "trans" like below. So I'm using ^ to specify what I don't want to match. It appears to work fine in the regex builder, but when I search for object=* I'm getting the objects after trans as well. I wrote in additional regex to try to filter anything with just numbers, but that shows the same behavior. Is it something with ^ ? mq-qm(QMNGRBKUP_01) trans(30251343) [^trans][\w'-]+((?P [^0-9][\w'-]+) ... View more

I need to extract fields from a set of results with inconsistent formatting. I think this would be easy for a regex pro. Here are two events: Jul 17 15:44:01 hostname 192.168.0.1 [st2-b3-inter-d005][system][error] trans(119657588)[192.168.0.2]: Unable to open URL Jul 17 15:44:01 hostname 192.168.0.1 [network][error] trans(2064751791): Host connection could not be established I need multiple extractions for the data within the first set of brackets (separated by the dash) in event 1. You'll see that event 2 doesn't contain this type of data at all. Basically I need a regex that says "Match everything between the first [ and first - but not if there are more than 3 characters before the -" I'm basically a regex noob! Thanks! ... View more