About richgalloway

richgalloway · ‎01-29-2014

If your problem is solved, please accept the answer.

richgalloway · ‎01-29-2014

Assuming your table is in an SQL database, you should be able to use the Splunk DB Connect app to extract data from the table. Set the input interval to '1d' and you'll have your daily copy.

richgalloway · ‎01-28-2014

Does your CSV have more data fields than it has header fields?

richgalloway · ‎01-28-2014

I agree that TIME_FORMAT cannot accept a regex string. Here's something I thought of, but haven't yet tried. Use a transform to parse the event data then an eval to build a datetime string. props.conf: [test] REPORT-logdata = parseLogData EVAL-datetime = date." ".time ... transforms.conf: [parseLogData] REGEX = "(?<date>.*?)\s(?<foo>.*?)\s(?<time>.*?)\s"

richgalloway · ‎01-27-2014

Try adding CHECK_FOR_HEADER = true to your props.conf stanza.

richgalloway · ‎01-24-2014

'... | stats sum(bytesOut) as totalBytesOut by user | table user totalBytesout'

richgalloway · ‎01-24-2014

Then you'll want to create a transforms.conf stanza with a ' REGEX = [.]*\.(?<host>[^\.]+?)\.(?<date>[^\.]*?)\.(?<time>[^\.]*?) ' statement.

richgalloway · ‎01-24-2014

Assuming the host name is between the first two dots, this may work for you. 'rex "[.]*\.(?<host>[^.]+?)\.[.]*"'

richgalloway · ‎01-22-2014

Four-digit years are represented by '%Y' .

richgalloway · ‎01-22-2014

How is _time being set currently? How are you reading the DB?

richgalloway · ‎01-22-2014

I vote for option #1. It's simpler than trying to come up with a grand unified search for all of the different formats. Remember, someone is going to have to maintain this search so keep it simple.

richgalloway · ‎01-20-2014

eval time=strptime(<time string>,"%Y%m%d.%H%M")

richgalloway · ‎01-17-2014

If I understand correctly, you want each column of the chart to have start and end dates. Isn't the end date of a column implied by the start date of the next column? Having the extra dates would only make the X-axis label harder to read.

richgalloway · ‎01-16-2014

Have you tried replacing the eval with 'table FILE durationms' to make sure you have results?

richgalloway · ‎01-16-2014

All the more reason to use separate regexes, but I think this will help you. (?i)file.*?\[(?<filename>[\S]*?)\].*\slength[^0-9]*(?<length>[0-9]+) . BTW, I like to use http://www.regextester.com/index.html for testing regex strings.

richgalloway · ‎01-16-2014

My HTML is a little rusty, but it looks like you are mixing header and data cell columns in the same row(s). I would use two for col in cols: loops - one to build the table header ( <th>col</th> ) and the second to loop through the results ( <td>escval</td>... ). Row tags ( <tr></tr> ) should go outside each loop.

richgalloway · ‎01-15-2014

I agree with Ayn, but perhaps something like the following will be useful. '... | rex ".*?\[(?<filename>[\S]*?)\].*\slength[^0-9]*(?<length>[0-9]+)" | ...'

richgalloway · ‎01-10-2014

I'm confused. If the transaction contains Event A and ends with Event B then won't Event B always follow Event A? Do you mean no intervening events?

richgalloway · ‎01-10-2014

Have you tried ' ... | sort -evnt_ts | ... '?

richgalloway · ‎01-09-2014

One could use stats latest(_time) to create a generic search for the most recent data set.

richgalloway · ‎01-09-2014

One cannot change, modify, alter, edit, overwrite, or update data once it is in Splunk. You should run DB Connect in dump mode and modify your searches to extract the most recent data.

richgalloway · ‎01-06-2014

Try '| rex mode=sed "s/x1/ /g"'.

richgalloway · ‎01-03-2014

Perhaps I don't understand the question, but indexing is what makes it possible to get the raw data back. Splunk can't find your data without the index.

richgalloway · ‎01-02-2014

Please provide an example of your data.

richgalloway · ‎12-30-2013

Have you tried replacing 'where expiryDate=date' with 'table expiryDate,date' to see why they don't match?

Posts	15694
Solutions	2837
Karma Given	1577
Karma Received	6065
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	12 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Taking a table backup on day today basis

Re: Taking a table backup on day today basis

Re: Help with fields named EXTRA_FIELD_XX

Re: Timestamp extraction from event data ??

Re: Missing interesting fields in the Search & Rep...

Re: Combine values for a field by user over 24 hou...

Re: host_Regex help

Re: host_Regex help

Re: props.conf date and time formatting

Re: Time Stamp in Db

Re: Doubt in framing search

Re: extract a string into readable datetime format

Re: trying to get a monthly report

Re: Losing duration in milliseconds when I add fil...

Re: Common regex

Re: Modify e-mail alert output

Re: Common regex

Re: search for a sequence of events in a transacti...

Re: Transaction using timestamp

Re: DBX DB Connect Issue - Duplication, Non-Histor...

Re: DBX DB Connect Issue - Duplication, Non-Histor...

Re: How can I do a find/replace on the results fou...

Re: Is it possible to skip the default indexing in...

Re: Splunk indexing using everyother fieldname

Re: Conversion from string to date