About richgalloway

richgalloway · ‎05-21-2014

Yes, this string should work in a REGEX statement in your transforms.conf file or in a rex search statement.

richgalloway · ‎05-20-2014

This should get you started. [\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

richgalloway · ‎05-20-2014

Documentation for TCP input is at http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports. I test mine using telnet.

richgalloway · ‎05-20-2014

Maybe this? ... | transaction mvlist=t userId maxpause=900s | dedup name dt | table name, dt

richgalloway · ‎05-20-2014

You can feed any text into Splunk, not just logs. You can set up a Splunk TCP input to receive your data, but you'll still have to teach Splunk how to break it up into fields. That said, this answer may better address your question.

richgalloway · ‎05-19-2014

This will show the free disk space on the selected server. You'll need to subtract that from the known disk size (perhaps from a lookup table) to get the space used. source=WMI:FreeDiskSpace host=foo

richgalloway · ‎05-19-2014

richgalloway · ‎05-16-2014

I've used Option 2 with success.

richgalloway · ‎05-16-2014

Here's one way to do it at search time: ... | rex field=FieldA "(?<FieldB>[^\.]*)\.(?<FieldC>[^\.]*)\.(?<FieldD>[\S]*)"

richgalloway · ‎05-15-2014

Depending on the size of your log entries, you may also want to add MAX_TIMESTAMP_LOOKAHEAD to your props.conf file.

richgalloway · ‎05-14-2014

The return command defaults to returning a single value. Try replacing it with a field command.

richgalloway · ‎05-14-2014

Try this: sourcetype="data.newIndex.stats" | eval ipubDate=strptime(pubDate, "%Y-%m-%d %H:%M:%S") | eval iscrapeDate=strptime(scrapeDate, "%Y-%m-%d %H:%M:%S") | eval lagtime=round(iscrapeDate-ipubDate,0) | chart max(lagtime)

richgalloway · ‎05-14-2014

What you want is a summary index. Run your daily saved search of the last 24 hours and save the 4 values to a summary index. Then you can search the SI for your trend. See http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Usesummaryindexing.

richgalloway · ‎05-13-2014

How is it not working? Filtering too much or too little? Please provide some sample log events.

richgalloway · ‎05-13-2014

MV_ADD = true will create a multivalue field rather than ignore duplicate field names.

richgalloway · ‎05-13-2014

What fields do you want to extract? What should happen with duplicated fields, extract first, extract last, or extract all? Are you sure you need a regex at all? Perhaps adding MV_ADD=true to your props.conf is enough.

richgalloway · ‎05-13-2014

What is it you want regex to do?

richgalloway · ‎05-12-2014

Your current regex will match events that contain either or tags, but necessarily both. Try the following. REGEX=<LogEventTypeCode>PI_EVENT</LogEventTypeCode>[\s\S]*<BusinessDomainId\>(BusinessDomainId1|BusinessDomainId2|BusinessDomainId3)\</BusinessDomainId\> FORMAT=$1-sec

richgalloway · ‎05-07-2014

The changes needed depend on how you're indexing the data now. Adding 'MV_ADD=true' to your props.conf file may be enough. Providing your current relevant props.conf (and transforms.conf) stanzas will help us help you better.

richgalloway · ‎05-07-2014

Run the following search to see what exactly Splunk has indexed from that log line. eventType="adam.test" | table * That should give you a better idea about how to build your query.

richgalloway · ‎05-05-2014

Perhaps something like this will do the job: search index=os_windows source="WinEventLog:Security" EventCode=4771 NOT user="*$" Failure_Code="0x18" | rex mode=sed field=src_ip "s/::ffff://" | rename src_ip as dest_ip | join dest_ip [search index=network_dhcp] | stats count(user) as Attempts dc(src_ip) as IPs values(dest_ip) as "IP Addresses" by user | where Attempts > 2 | table user Attempts IPs "IP Addresses" nt_host | sort -Attempts

richgalloway · ‎05-02-2014

richgalloway · ‎05-02-2014

Have you tried something like this? source=foo type_name=AUDIT_PATH | join callid [search type_name=AUDIT_SYSCALL] | join session [search type_name=AUDIT_USER_START]

richgalloway · ‎05-02-2014

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

richgalloway · ‎05-02-2014

You showed your query previously. Now we need to see sample events.

Posts	16775
Solutions	2989
Karma Given	2024
Karma Received	6720
Member Since	‎07-24-2012

Online Status	Online
Date Last Visited	yesterday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Regex for two similar statements to put in tra...

Re: Regex for two similar statements to put in tra...

Re: Possible to stream data into Splunk (like Grap...

Re: Removing duplicate events following eachother ...

Re: Possible to stream data into Splunk (like Grap...

Re: application space usage

Re: Problem with getting all non matching events w...

Re: Better way to write OR statements against fiel...

Re: How split up a string into multiple fields

Re: epoch time stamps not being indexed

Re: Subsearch only returns 1 value

Re: create lagtime panel with average time between...

Re: trend data from saved search

Re: Filter several strings in transforms.conf

Re: Regex with multiple fields duplicated. Yet da...

Re: Regex with multiple fields duplicated. Yet da...

Re: Regex with multiple fields duplicated. Yet da...

Re: Help with REGEX in transforms.conf

Re: mkvalue - strange problem

Re: mkvalue - strange problem

Re: Subsearch Question

Re: create lagtime panel with average time between...

Re: Correlate three events with differing properti...

Re: Dashboard: Replacing default text for empty re...

Re: How to output matching fields

Join the Conversation