I am attempting to extract 2 fields, that are structured the same in an event, however represent 2 actions. one represents a query, the other a response for DNS data. Here is a sample event: QUESTION SECTION: Offset = 0x000c, RR count = 0 Name ".www.couponcabin.com.distil.us." QTYPE A . QCLASS 1 ANSWER SECTION: Offset = 0x002f, RR count = 0 Name ".www.couponcabin.com.DISTIL[C027].us." TYPE CNAME . CLASS 1 TTL 34 DLEN 9 DATA .scotch[C020].distil.us. Offset = 0x005f, RR count = 1 Name ".scotch[C043].DISTIL[C027].us." TYPE CNAME . CLASS 1 TTL 21 DLEN 5 DATA .us[C056].scotch[C020].distil.us. Offset = 0x0077, RR count = 2 Name ".us[C05F].scotch[C043].DISTIL[C027].us." TYPE CNAME . CLASS 1 TTL 51 DLEN 27 DATA .shard1.premium.newjersey[C020].distil.us. Offset = 0x00a1, RR count = 3 Name ".shard1.premium.newjersey[C043].DISTIL[C027].us." TYPE A . CLASS 1 TTL 86 DLEN 4 DATA 10.10.10.10 AUTHORITY SECTION: empty ADDITIONAL SECTION: Offset = 0x00ca, RR count = 0 Notice that there is a 'QUESTION SECTION' and an 'ANSWER SECTION', both of which have the value 'Name ...' I am attempting to extract the QUESTION SECTION Name value as the field 'query', and the ANSWER SECTION Name values as the field 'answer'. I know how to make an mv field, I just need the extractions themselves. Here is what I currently have EXTRACT-qa = Name\s+(?<query>\"[^\"]+\") I use the MV_ADD transform to make this field a multivalue field, however this extracts ALL of the matches, not separating the 'query' field from the 'answers' fields. Thank you for any help you can provide! ... View more

I am ingesting data from a syslog server, and some of those file paths are pretty long. It appears that Splunk is truncating these file paths before it writes the 'source' field. Is there a setting to disable this? This is what I'm seeing with my search: index=syslog | stats count by source Results: /data/syslog/2016/05/17/...Device/messages 5 /data/syslog/2016/05/17/...dor/messages 8 /data/syslog/2016/05/17/...er/messages 2 /data/syslog/2016/05/17/...ice/messages 5 /data/syslog/2016/05/17/...or/messages 6 /data/syslog/2016/05/17/...orized/messages 7 /data/syslog/2016/05/17/...r/messages 4 /data/syslog/2016/05/17/...rized/messages 3 I'm trying to remove the '...' extensions, and show the whole file path. Would I use a * in the place of the '...' in inputs.conf? ... View more

So I have some domain information that i'm attempting to format appropriately with EVAL functions either replace, or rtrim, and I seem to be having some difficulty. I'm attempting to shave off the periods before and after the value. Here is the type of values that I'm getting: query=".www.google.com." and this is my eval statement so far: | eval aaa=replace(query, "\".([^\.]+).\", "\1"") It doesn't seem to be taking, so I was wondering if I'm typoing something somewhere? I simply assume my syntax is wrong. 😃 Thank you! ... View more

I am attempting to format my DNS data to a standard format. I'm thinking I can use REGEX / SED for the this formatting. This is my current field value: (19)espnfivethirtyeight(5)files(9)wordpress(3)com(0) This is the value that I would like to see: espnfivethirtyeight.files.wordpress.com I've used eval to replace the pattern eval myField=replace(src_domain,"\(\d+\)",".") and that replaces the values to the following, and the first and last '.' are adjusting my search results .espnfivethirtyeight.files.wordpress.com. Is there anything I can use in order to make the desired adjustment? Thank you so much!! ... View more

I am trying to write a cron expression to trigger a report two time a week. once on Tuesday at midnight once on Thursday at midnight. Attempting to write standard cron, I came up with this 0 0 0 0 ? * TUE,THU though it Splunk says 'invalid cron'. I was wondering if anyone knew of a way to make this schedule so that Splunk can save it as a scheduled alert, or maybe correct me where I went wrong? Thank you guys!! ... View more

I have created a python script in order to ssh to a remote machine and run a script on that machine to unlock user accounts. I am only getting an return code 255 . I have eliminated all 'splunk code' from the script, and the python script by itself works just fine when ran, and unlocks the account on the remote machine. I am wondering what I am doing wrong. I have also copied the appropriate .ssh key to the remote machines in order to remove authentication when ssh to the remote machine. This is my script: ''' import sys import splunk.Intersplunk import subprocess import logging import os # System logging logger = logging.getLogger('testssh') hdlr = logging.FileHandler('/tmp/testssh.txt') formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s') hdlr.setFormatter(formatter) logger.addHandler(hdlr) logger.setLevel(logging.INFO) try: keywords,options = splunk.Intersplunk.getKeywordsAndOptions() # Get all the options passed # Check for passed parameters if not options.has_key('host'): splunk.Intersplunk.generateErrorResults("no host specified") exit(0) if not options.has_key('user'): splunk.Intersplunk.generateErrorResults("no user specified") exit(0) if not options.has_key('command'): splunk.Intersplunk.generateErrorResults("no command specified") exit(0) command = options.get('command', None) host = options.get('host', None) user = options.get('user', None) results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() for r in results: try: # Call the script passing all the necessary arguments p = subprocess.Popen(["ssh -i /idn/home/tmarlett/.ssh/id_rsa -q -t -t tmarlett@r[host] r[command]"],stdin=subprocess.PIPE, stdout=subprocess.PIPE,stderr=subprocess.STDOUT) # Get the output from script and push it to new output column out,err = p.communicate() #logger.info(out.decode("utf-8")) r["output"]= out.decode("utf-8") r["error"]=err r["return_code"]=p.returncode; except ValueError, e: results = splunk.Intersplunk.generateErrorResults(str(e)) except OSError, e: results = splunk.Intersplunk.generateErrorResults(str(e)) #Output results back to Splunk splunk.Intersplunk.outputResults(results) except Exception, e: results = splunk.Intersplunk.generateErrorResults(str(e)) And this is the output it shows me when running the script: Does anyone have any insight as to why this would be happening? ... View more