About richgalloway

richgalloway · ‎12-20-2013

Regex may be your only answer. Try something like this: (?<Field1>[^,]*?),\s(?<Field2>[^,]*?),\s(?<Field3>.*),\s(?<Field4>[^,]*) That should allow for commas only in Field3.

richgalloway · ‎12-20-2013

If you have control over how the CSV files are created, change them to put quotation marks around the fields with embedded commas. It may be easier to quote all fields. Once you do that, modify your Splunk transforms to strip the commas during indexing.

richgalloway · ‎12-19-2013

Use a REGEX to parse the data. Put this in your transforms.conf file instead of DELIMS: [<transformName>] REGEX = \"(?<EventTime>.*?)\",\s\"(?<Level>.*?)\",\s\"(?<Field3>.*?)\",\s\"(?<Field4>.*?)\",\s\"(?<Field5>.*?)\"

richgalloway · ‎12-16-2013

Is there some other common field you could use in your search?

richgalloway · ‎12-13-2013

Your strptime() format doesn't match the Date field. Try "%Y/%m/%d %H:%M:%S.%3Q" . Also the where clause should read 'where DatetimeEpoch <= epoch30minsago' to select events at least 30 minutes behind the current time.

richgalloway · ‎12-13-2013

The now() function returns an integer so there's no need to strptime() it. Using 'where expiryDate>current' should do the trick.

richgalloway · ‎12-11-2013

Why use bash? Splunk can monitor files and schedule scripts natively.

richgalloway · ‎12-03-2013

According to the DBX manual (http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Otherdeploymentconsiderations), "Splunk will not cache the results between invocations of the lookup."

richgalloway · ‎12-03-2013

If you click on the DB Query button in the DB Connect app you can enter a query and see what would be indexed. To get the datetime format you want, use CONVERT(datetime, column, 120) .

richgalloway · ‎12-03-2013

You'll probably get good results with KV. Experiment in a separate index until you get the results you want.

richgalloway · ‎11-20-2013

That works for me. | eval TSStart="2013-10-14T18:35:03.487" | eval MyTime=strptime(TSStart,"%Y-%m-%dT%T") | eval MyTime2=strptime(TSStart,"%Y-%m-%dT%H:%M:%S.%3N") | table TSStart, MyTime, MyTime2 TSStart MyTime MyTime2 2013-10-14T18:35:03.487 1381790103.000000 1381790103.487000

richgalloway · ‎11-20-2013

"by host" is not valid for the head command. Just 'head 10' should do the job.

richgalloway · ‎11-20-2013

stats dc(Name)

richgalloway · ‎11-19-2013

You won't be able to have Splunk process the log without indexing it. You should be able to make the transformation happen on input by adding a similar REGEX statement to your transforms.conf file.

richgalloway · ‎11-19-2013

Something like this should do the job. ... | rex "(?<field1>.*?)\s(?<field2>.*?)\.(?<field3>.*?)\s::(?<mon>.*?)/(?<day>.*?)/(?<year>.*?)\s(?<time>.*?)\s::\s(?<BS>.*?)\s::(?<msg>.*)" | eval trade=case(BS="B","Buy",BS="S","Sell") | eval output3=if(field3="####",field2,field1) | eval targetLog=trade." | ".year."/".mon."/".day." ".time." | ".msg | ...

richgalloway · ‎11-15-2013

Change 'fields query' to 'fields query referringGroup attackType' . The last two fields should match whatever is in the header of bad_actors.csv.

richgalloway · ‎11-13-2013

This paragraph from the Search Reference manual (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers) seems most appropriate: You can also specify offsets from the snap-to-time or "chain" together the time modifiers for more specific relative time definitions. For example, @d-2h snaps to the beginning of today (12AM) and subtract 2 hours from that time. Based on that, you should be able to do something like this: ' ... earliest=@d-870m latest=@d-390m | ... '

richgalloway · ‎11-13-2013

Splunk for BigFix version 6 was released yesterday and fixes my problem.

richgalloway · ‎11-11-2013

You can use wildcards in the source specifier, but (AFAIK) not regex. So ' source="a*.gz" | ... ' should work. There's also ' | where like(source,"a%.gz") | ... ', but that's still not regex and is probably less efficient. Finally, you can try ' | regex source="a[0-9]+.gz" | stats ... ', but that's probably still less efficient that the first option.

richgalloway · ‎11-11-2013

Is there an update to the Splunk for BigFix app on the way for Splunk 6? I tried installing version 20110203.0, but the setup script fails with " In handler 'localapps': Regex: PCRE does not support \L, \I, \N(name), \U or \u ".

richgalloway · ‎11-07-2013

Would you please provide sample log entries?

richgalloway · ‎11-06-2013

I don't see where you currently use your two lookup tables. The lookup statements should precede the table statement. lookup ... | table STAR PNUM PNOD Account SNOD SAccount SFIL DFIL

richgalloway · ‎11-06-2013

It seems that PNODs and SNODs are just nodes so why not have a single lookup file with "Node" and "Account" fields? Then do your lookups using '... | lookup nodes.csv Node AS PNOD OUTPUT Account | lookup nodes.csv Node AS SNOD OUTPUT Account AS SAccount | ...' .

richgalloway · ‎10-31-2013

What is your question? BTW, you can use underscores by escaping them with '\' or by entering the variables as code.

richgalloway · ‎10-31-2013

We've done that using a REGEX statement in our transforms.conf. [csv-transform] REGEX = (?<fieldA>.*?) | (?<fieldB>.*?) | (?<fieldC>.*?) | (?<fieldD>.*?) | \"(?<description>.*?)\" | (?<fieldF>.*?) You must also reference this transform in your props.conf. Ours looks like this. [csv-breaktest] BREAK_ONLY_BEFORE = (regex unique to our first field) CHECK_FOR_HEADER = false KV_MODE = multi MAX_TIMESTAMP_LOOKAHEAD = 50 NO_BINARY_CHECK = true SHOULD_LINEMERGE = true REPORT-csv = csv-transform

Posts	16766
Solutions	2986
Karma Given	2017
Karma Received	6715
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	Saturday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: CSV comma handling with additional commas

Re: CSV comma handling with additional commas

Re: Quoted escape characters when searching a fiel...

Re: Query with Thousands of "OR"s

Re: Compare dates in splunk

Re: Conversion from string to date

Re: how to start a Splunk search from a bash scrip...

Re: DB Connect and Lookup Caching

Re: What sourcetype should be used input MySQL dat...

Re: What sourcetype should be used input MySQL dat...

Re: Formatting String to Time returns nothing

Re: First x results by host.

Re: Count values(field) from search result

Re: Log transformation

Re: Log transformation

Re: Lookup table matches and associated fields

Re: Can I set the earliest and latests statements ...

Re: BigFix for Splunk 6

Re: Regular expression in source

BigFix for Splunk 6

Re: LOGIN SUCCESS vs LOGIN FAILURE

Re: Lookup table with two primary keys

Re: Lookup table with two primary keys

Re: Can do search time lookup but automatic lookup...

Re: Importing a CSV and line breaking within a fie...

Join the Conversation