Try changing it to appendcols [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query] or append [ search sourcetype=type1 field1=$arg1$ | rename field2 as query | fields query | eval newField=query] ... View more

Your eval should be in the macro, so you'd just call it and pass it field3. i.e.: sourcetype=type2|`newMacro(field3)`|table newField,field3 Let me know if you need help with the macro itself. ... View more

A few things to check: Is Splunk running? If not, do $SPLUNK_HOME/splunk/bin/splunk start Have you tried using htps:// ? Could there be a firewall issue? (iptables locally, or a firewall blocking connections on the network) ... View more

Understandable, but you can't schedule a search in Splunk to run more frequently than once every 60 seconds, and best practices suggest that you wouldn't want to. See: http://docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Definescheduledalerts#Best_practices_for_scheduled_alerts With that aside, you could probably write a custom script that runs a search over the API however frequently you want. If you really want real-time searches, you can run them, but keep in mind that each real-time search consumes 1 CPU core. ... View more

Can you post your dashboard code please? ... View more

This is what I needed. Thanks! ... View more

Can you post the query for your saved search please? ... View more

Thank you. Is there a way to set this through splunkweb though? Or even through the API? I unfortunately do not have SSH access to the server at this time, but I do have admin via splunkweb. ... View more

Take a look at Splunk Utilization Monitor (SUM) on splunkbase: https://splunkbase.splunk.com/app/2678/ It has a dashboard that can help you isolate what is consuming your license. ... View more

Please click "Accept Answer" if this worked for you ... View more

Write two EXTRACT statements directly into props.conf (using different names). For your second log format, use either the date, or the time field with a more specific regex capture pattern (like 04-17-2015 would be captured using \d{2}-\d{2}-\d{4}. If the entire pattern doesn't match the EXTRACT statement, it won't match, so using two statements with specific capture patterns will help your data extract correctly. ... View more

Try restarting your splunk forwarder to see if it picks up server.log. If that doesn't help, grep for server.log in $SPUNK_HOME/var/log/splunk/splunkd.log and see if there are any errors. ... View more

First create a CSV file, with all the current, and new names you want: Animal,NewAnimal Cat,Gato Dog,Perro Next, add your CSV file to Splunk, by going to Settings -> Lookups -> Lookup table files -> Add new Choose your lookup file and give it a destination file name (it can be the same as the existing file name). Click Save. Then, add a lookup definition by going to Settings -> Lookups -> Lookup definitions -> Add new Give the lookup a name. Again, it can be the same as your file name, or you could simply call it "animals". Leave it on "File-based" and then select your CSV file from the drop-down menu. Click Save. Now, you can use your lookup file in your search. Assuming you called the lookup definition "animals", you could do: index="Foo" | lookup animals Animal OUTPUT NewAnimal| chart count by Timestamp, NewAnimal ... View more

Could you post your inputs.conf please? ... View more

Sorry, I'm not following. Perhaps you could explain another way? Also, please note that it is discourteous to down vote answers of people that are trying to help you. ... View more

Encase your URL as character data: <![CDATA[http://www.myurl.com]]> If that doesn't help, please post a code sample from your dashboard. ... View more

Assuming there aren't any periods in the error you want, you could do: rex "Message=(?<Yourfieldname>[^\.]+)" If there are periods, you could do: rex "Message=(?<Yourfieldnamehere>[^\s\-\s]+)\s\-\s" Or rex "Message=(?<Yourfieldnamehere>.+)\s\-\s" You can also try out your own expressions at: http://www.regexr.com/ ... View more

Also is EventType a field you created or an actual "event type" knowledge object? (http://docs.splunk.com/Splexicon:Eventtype) ... View more

Cool question. I can answer if you can fill in a couple blanks for me: What app are you using? (search?) Are the eventtypes shared or private? If shared, are they shared in app or globally? ... View more

What are you trying to accomplish by accessing splunkweb via curl? ... View more