Hi Everyone. How to discard all the debug logs for a sourcetype and whitelist a word "AuthIDDetection" whenever this comes in events from sourcetype Please, could someone help with this --- I have sourcetype "xyz" to which I am discarding keyword "debug" from the events, we are discarding all the debug logs. I would like to discard all the debug logs for sourcetype -- xyz and whitelist a word "AuthIDDetection" whenever this comes in events from sourcetype "xyz" from the same debug logs. current props.conf -- [sourcetype-xyz] TRANSFORMS-set=xyz-setnull,setparsing transforms.conf -- [xyz-setnull] REGEX= debug|\\|Notice DEST_KEY=queue FORMAT=nullQueue Could you please help with this. FYI , Am following this documentation - http://docs.splunk.com/Documentation/Splunk/4.3.1/Deploy/Routeandfilterdatad#Discard_specific_events_and_keep_the_res ... View more

We would like to monitor a few hosts which are logging errors as events across different sources . Alert condition we would like to setup are : All error logs from sources are getting monioted for all hosts. Alert condition : When any Hosts added or removed, trigger an alert. logs are getting monitored for all hosts. Alert condition : When any Hosts added or removed, trigger an alert. I have used | metadata queries nothing seems matching my requirement. | metadata type=hosts index=* | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | inputlookup hoststomonitor.csv | append [ search index=myindexname| stats Count by host ] | table host Count | stats sum(Count) as Count by host | fillnull value=0 | eval Status=if(Count=="0","Stopped",if(Count>"0","Running","needtofill")) | sort - Status | search Status="Running" | eval Count=tostring(Count , "commas") Appreciate your help in creating alert conditions for the above. Thanks ... View more

Hi Please help me fix this would like to consider the TIME stamp extracted from the events , but i see two different time format s in events as you can see in below events . And , the search head settings has default time zone settings --- CST zone . Here is the props.conf i have written . Please help me parse the correct time stamp. [smr] pulldown_type = true NO_BINARY_CHECK=true disabled=false SHOULD_LINEMERGE=true MAX_TIMESTAMP_LOOKAHEAD=150 MAX_EVENTS=15000 TRUNCATE=100000 ... View more

Hi all, I am working on a search which triggers when the total failures by users is greater than 10 in last 30min. My result should capture the failures for each user and also the total failures count. My search | stats count by users | addtotals col=t labelfield=users The result of this search is user1 3 user2 1 user3 12 Total 16 How do I need to set up a trigger condition so that all the above values are captured and the alert should be triggered when Total>10 Thanks in advance ... View more