I would classify any JSON or KeyValue data could be done - Before Indexing - After Indexing I prefer before indexing, as JSON is KV and when you display the data you get in "Interesting field section" automatically. Inorder to do that, just put in props.conf something like below # props.conf [SPECIAL_EVENT] NO_BINARY_CHECK = 1 TIME_PREFIX = "timestamp" # or identify the tag within your JSON data pulldown_type = 1 KV_MODE = JSON BREAK_ONLY_BEFORE = (^{) ... View more

could you please update your "inputs.conf" and "props.conf" in your question, so we can see how individual events are parsed? ... View more

I've simulated a sample scenario by indexing few random IPs and putting some of the sample as "root_dns_srvrs.csv" and it works correctly. index=myindex | table ips |head 10| rename ips as dest_ip | join type=left [ |inputlookup root_dns_srvrs.csv| fields dest_ip| dedup dest_ip | eval DummyColumn="Table2"]| search NOT DummyColumn=* This gave me IP's that are present in "left -hand" list , but NOT present in the dns.csv ... View more

I think you are trying to put Splunk Enterprise Security or PCI app. They are heavy apps and is causing crashing. Try removing whole of "Splunk ES or PCI app" and restart SPlunk ... View more

You can write python script, but I wouldn't tie it to Splunk Index process. You need to tie it to the Process/script which puts the file in there. ... View more

hmm... not sure I understand when you "only pulling root srvs from lookup". Could you please put few sample events and sample csv file. ... View more

are you ok, if the savedSearch Runs every week but with the data-set of last 2 weeks? You just need to ignore the week's which you don't want. It will become very simple in Cron ... View more

how did you start splunk? Please put the command here . Also which OS you using? Which User/group if Unix? ... View more

I haven't used Splunk Light myself, but the key difference is about "Clustering" , "Data Models" and "User Roles/Access". If your don't have apps that affects above, try downloading "Splunk Light" and copy all stuffs under $SPLUNK_HOME/etc/apps and it should work fine. ... View more

could you please try... <your Search> | join type=left dest_ip [ | inputlookup your_lookup.csv | fields dest_ip | dedup dest_ip | eval DummyColumn="Table2"| fields dest_ip, DummyColumn] | search NOT DummyColumn=* Try doing a "LEFT" join with left column being "your_search" , have atleast two columns from "your_lookup.csv" and on final output compare whichever is NOT null. (The logic is, lookup left -hand data and anything which is not matched on right-hand side will output null values) OR another option is: | search NOT [|inputlookup dns.csv| table destIp | rename destIp as dest_ip] Just filterint out any specific data ... View more

The sample in above app shows scatter plotted against time where time is "date_hour". You could change the X axis interval to "1" to have it on hourly basis. Also note, Splunk Scatter chart can have 1000 data points max. index = _internal | stats count, mode(status) by method, status, date_hour | where (status) >= 200 and (status) < 300 The same goes for bubble chart as well is also shown with "date_hour" as X axis. index = _internal sourcetype=splunkd_access | stats count sum(bytes) as "Total Bytes" by status, date_hour | table status date_hour count "Total Bytes" There are some complicated examples to use _time, but it is much easier to use date_hour ... View more

I guess you got a "comma" after the "search" param, thus the function not ending properly ... View more

Which chart are you trying? Is it for Bar Chart? if then, you need to apply on "axisX" . Try hardcoding the @max value to test if it works. <option name="charting.axisX.maximumNumber">2000</option> <option name="charting.axisTitleX.text">axisTitleX TestName</option> ... View more

good question. I was also looking for the same, but couldn't find a D3.js based simple xml demo yet. ( I was looking for a organisational hierarchy kind of chart) Another idea I thought is to use force graph or Sankey Chart (lots of examples) are there and overlapping the nodes with images/boxes. Its bit crude, but that's a suggestion ... View more

hmm.. can't really put the regex here as this forum somehow escapes "\" characters so attaching an image below ... View more

thanks for Curl as AWS doesn't have wget by default ... View more

lookup is very efficient in Splunk, but dumping the data would be inefficient. My suggestion would be then to use "dbconnect" as it can efficiently read data or delta of data ... View more

have a look at answer: http://answers.splunk.com/answers/2672/defining-timestamp-on-data-from-csv-file.html ... View more

You can do in multiple ways.. Use dbconnect and get the sample as a lookup data. | dbquery "SELECT myfield1,myfield2,myfield3 FROM mytable" Run a script/SQL which can dump the data into csv file from DB. Then join the lookups before feeding it into the "indexed" data. The key to join is your primary_key "order_id" | inputlookup lookup1.csv | join order_id [ |inputlookup lookup2.csv] | join order_id [ | inputlookup look3.csv] ... View more

superb concise answer. ... View more

Please download "Module System Tutorial" App . It has got TreeMap implementation. JSON-formatted results are returned and rendered as a treemap using the custom TreeMap module. You can play around with a clone and get your things done. ... View more

in that case please paste few rows of sample key-value pairs.. <your Search> | table * | fields - _raw ... View more