Hello, I have installed Splunk MINT on my Splunk server and the dashboards do not load correctly in Chrome. Here is a SS: In IE it works fine: Is this a known issue? How can I resolve? Splunk version is 6.6.4. Thank you and best regards, Andrew ... View more

Hello, Splunk is acting strangely and it's something I've never encountered before. I will try to simplify my explanation as best as possible. At extraction time I have two automatic lookups. The first lookup produces a new field called group and this field is used to extract, in conjunction with a field extraction, a field from the second lookup named process . Permissions are set correctly for all objects and associated to the host. When searching the index without any filters all fields appear correctly. If I try to filter a specific value for the field process obtained from the second lookup, it does not work as expected. For example, I have a field value Journal Posting . I know that 109 entries contain this field value. Here is where it gets strange: If I run index=index_name process="Journal Posting" splunk returns 15 results. If I run index=index_name process="Journal*" splunk returns 16 results. If I run index=index_name process="Jo*" splunk returns 56 results. If I run index=index_name process="J*" splunk returns 109 results. If I run index=index_name process="*Journal Posting*" splunk returns 109 results. I have no idea why it does this. Is it a memory issue? Are there any configuration checks that I should make? Any help would be greatly appreciated. Best regards, Andrew ... View more

Hello all, The question is self explanatory I think. I've seen similar questions that are resolved with an eval, but in my case I'm trying to make everything automatic. Since the sequence of search-time operations dictates that lookups are after calculated fields, there is no way to automatically run the eval to either validate with an if statement or coalesce. This is why I'm hoping there is a way during an automatic lookup to leave an existing value if there is no match instead of replacing with null. Is this possible? Thank you and best regards, Andrew ... View more

Hello, I'm currently performing analysis on a free text field and the first step is to remove stop words. This is my approach: makemv to convert the free text field into a list of words mvexpand to create an event for each word search with a lookup containing stop words to remove events I don't need SPL snippet: ... | makemv text_field | mvexpand text_field | search NOT [ | inputlookup stopwords.csv | rename StopWord as text_field ] ... When I am using this approach on large sets of data I reach my performance limits very quickly. What I'd like to know is: is there a different approach that I can take to remove the stop words that is less performance heavy than my current approach? Thank you and best regards, Andrew ... View more

Hello, I am trying to customize the colour scheme for a dashboard using css. What I'd like to know is where I can find a list of the properties available to me that I can set in my stylesheet. Does this list exist anywhere (not necessarily an exhaustive list, but a starting point)? For starters I'd like to set a colour palette that gets applied by default to the charts and graphs. Is this possible? Thank you and best regards, Andrew ... View more

Hello, I'm currently creating a new sourcetype that has a TRANSFORMS-null setting with value discardit . Within my transforms.conf file I have created the appropriate stanza: [discardit] REGEX=(^|[\r\n])(.+,.+,.+,.+,"",.+) DEST_KEY = queue FORMAT = nullQueue The regex that I've written is currently not working and I would like some help in formulating it. The events are coming from csv files with the following header: "Server","Job","Status","Start","End","Run Machine","Command" My objective is to not index the events that have no value for End , so events that look like this: "Server1","Job1","Running","2018-02-01 00:00:00","","Machine 1","Command 1" The regex that I've written basically counts 4 commas and then checks to see whether the two characters after the fourth comma are "" (meaning that the value for Run is blank). What am I missing? Best regards, Andrew ... View more