A couple of things: (1) I would not recommend using rex to do field extractions (unless you're just testing stuff), but rather configure automatic field extraction in props/transforms.conf (maybe you're just testing ... ) (2) you can extract field name and field value from the event (note that you cannot modify the field name as you're doing PartNumber -> SearchPartNumber though) props.conf [my_sourcetype] ... REPORT-fields = my_fields transforms.conf [my_fields] REGEX = (?m-s)^SPARAM\|\d*\|([^|]+)\|(.*) FORMAT = $1::$2 ... View more

I've modified the regex to match empty fields. As far as performance goes, I would recommend you try our "Advanced Charting" view in which we aggressively optimize field extraction. Moving extractions to index time would definitely help, however you loose the flexibility. You can look here for more info on how to configure index time extraction http://www.splunk.com/base/Documentation/latest/Data/Configureindex-timefieldextraction ... View more

The search heads compete to run scheduled searches, thus there is no deterministic way of determining which search head will run a scheduled search (if at all). The workload should start to spread evenly across the search heads as the number of scheduled searches increases. Is there any reason that you're looking to configure on which search head a scheduled search runs? ... View more

The transaction command cannot do the correlation you're looking for - however here's a way to do it: create a field that unifies all the records. In the following simplistic example I am assuming that you can somehow differentiate between local and non-local caller ids, let's say local caller ids start with 12, then the following search will generate the transactions you're looking for .... | eval cid=if(match(LocalCallID, "^12"), LocalCallID, RelatedCallID) | transaction maxspan=10s cid ... View more

Can you please provide: (a) some sample data, (b) props/transforms.conf responsible for the field extractions? ... View more

Yes it is possible, this not publicly documented however this is how the UI adds/deletes fields from the search view POST /servicesNS/<user>/<app>/search/fields/<field-name>/tags "value=ValueToTagHere&add=tag1&add=tag2&delete=tag3&delete=tag4" You can have as many add and delete tags as you wish in your POST ... View more

Can you please provide the props.conf/transforms.conf stanzas that are responsible for performing the extractions and field aliasing? ... View more

When you run the searches that doesn't use the field in the search (host="mywebserver" ORD%3dIV) what is the value of the extract ORD field? Can you have multiple ORDs defined in your events? If so, then this could be causing the problem you're seeing. By default we'll extract only the first value, however you can modify the extractor to extract all occurences of the field and create a multivalued field see MV_ADD in the documentation ... View more

are you looking for? source=a OR source=b | timechart count by host, source ... View more

@nick - nope, all crashlogs go to $SPLUNK_HOME/var/logs/ ... View more

are there any errors/warnings in $SPLUNK_HOME/var/run/splunk/dispatch/1299545325.41/search.log? ... View more

Can you please try the following stanza instead (seems like the sed syntax in your stanza is not correct) [nessus] MAX_EVENTS = 1 SEDCMD-carriage_return = s/\\n/\n/g ... View more

Try using the following stanza in props.conf: [logchecker] SHOULD_LINEMERGE = false LINE_BREAKER = (ThiStringDoesNotExistInYourData) TRUNCATE = 100000 DATETIME_CONFIG = CURRENT KV_MODE = multi The first four lines of that stanza instruct Splunk to index the entire file content (up to 100KB, increase if necessary) as a single event and assign it the current timestamp. KV_MODE tells Splunk search to apply auto multikv to the events when they are retrieved from the index and before any further search time processing ... View more

a slightly better approach would be: index="os" sourcetype="who" host=$host$ | multikv | search USERNAME=* | timechart count by USERNAME basically filter out all results that are missing the USERNAME field ... View more

First, to enable the inputs you need to go through the setup of the unix, in Manager > Apps and then click on the Setup link in the Unix app Second, to get the required data sources (from /var/log) into splunk you'll need to edit the default whitelist under Manager » Data inputs » Files & Directories » /var/log - to index everything simply set this to .* Not indexing the required data sources to populate the dashboards is a bug, and I've filed an issue SPL-33801 ... View more

A similar approach could be taken for other fields - since the fields can have the same name you would have to work with multivalued fields. Here is an example [syslog] REPORT-other-fields = otherFields # disable auto kv KV_MODE = none [otherFields] REGEX = (\S+)="([^"])+" FORMAT = $1::$2 MV_ADD = true ... View more

@njathan - I was talking about testing the regex using the rex search command - either from splunk's search UI or CLI ... View more

from the ascii table that you've provided using connected=f in the transaction should get rid of the subsearch .... | transaction port clientip maxspan=2h endswith=("EventCode=20048") startswith=(EventCode=20200) connected=f to see why we need to set connected=f, consider the same table but in reverse time order (same way as transaction's command sees the events). We need to set connected to false because there is no transitive relationship established between RAS2 and FTP1 if viewing events in reverse chronological order Event Type User Com Port Ip Stats Unique Id EventCode ----------------- ---- -------- -- ----- --------- --------- RAS3 (Disconnect) X 20201 RAS2 (Logout) X X X 20048 FTP1 (file xfer) X X RAS1 (Login) X X X 20200 ... View more

currently there is no way to override the time range over which the savedsearch is executed when ran from the CLI. Unfortunately there currently is no workaround for this issue. I have filed a bug, SPL-33374, which should be fixed in one of the next maintenance releases. ... View more