Greetings, I've noticed that one of my input files was not reading into splunk entirely. (ver 4.2 96430) After doing some troubleshooting, it appears that the file is read short, and I can reproduce this based on the contents of the file. For instance, I have inputting this data: Host=SERVERNAME Source=Broadcom BCM5709S NetXtreme II GigE [NDIS VBD Client] BytesReceivedPerSec="3362" BytesSentPerSec="0" BytesTotalPerSec="3362" Description="" Frequency_Object="" Frequency_PerfTime="" Frequency_Sys100NS="" OutputQueueLength="0" CurrentBandwidth="1000000000" PacketsOutboundDiscarded="0" PacketsOutboundErrors="0" PacketsPerSec="24" PacketsReceivedDiscarded="0" PacketsReceivedErrors="0" PacketsReceivedNonUnicastPerSec="13" PacketsReceivedPerSec="24" PacketsReceivedUnicastPerSec="10" PacketsReceivedUnknown="0" PacketsSentNonUnicastPerSec="0" PacketsSentPerSec="0" PacketsSentUnicastPerSec="0" Timestamp_Object="" Timestamp_PerfTime="" Timestamp_Sys100NS="" Splunk only shows the data up until the line that reads: CurrentBandwidth="1000000000" The reading is aborted at the line. If I move the line up, or down, it follows the line. If I change the data in the line, even removing a single 0, then splunk reads the data correctly in its entirety. I'm pretty sure this is a defect, but I don't know how to open a bug report. Hopefully this is sufficient. Other data that might be relevant is that I am putting this into a directory that is a sinkhole, s it's batch inputted. Let me know what other information may be useful to supply. ... View more

I've written an application that outputs data that I would like to index. Of course, I have a series of requirements. First, I'd like to extract the host and the sourcetype from the file. I am reading http://www.splunk.com/base/Documentation/4.1.8/Admin/Advancedsourcetypeoverrides on how to achieve this, but haven't succeeded. props.conf [source::Z:\ServerInput] TRANSFORMS-changesrchost=SrvMonsource,SrvMonHost transforms.conf [SrvMonSource] DEST_KEY = MetaData:Sourcetype REGEX = Source: (.+) FORMAT = sourcetype::$1 [SrvMonHost] REGEX = Host: (.+) FORMAT = host::$1 DEST_KEY = MetaData:Host Secondly, I'd like to extract the field names from the fields in the file. The file format looks like this: Host: L-JGAUTHIER Source: OSInfo BootDevice: \Device\HarddiskVolume2 BuildNumber: 7600 BuildType: Multiprocessor Free Caption: Microsoft Windows 7 Enterprise CodeSet: 1252 CountryCode: 1 CreationClassName: Win32_OperatingSystem CSCreationClassName: Win32_ComputerSystem CSDVersion: CSName: L-JGAUTHIER And lastly, I want to delete the file once it's indexed. I can probably use the spool directory for this, but I'm not sure yet if that will work since I am not sure if I can make that a source or not in my application (in props.conf). Thanks for any pointers. ... View more

I am using a search macro in an eval and it returns all zeros. But, when I expand it, it functions as expected. Is that normal? ie: `get_all_email` | stats count(eval(`receive_event`)) as Sent by recipientlist This returns all zeros. `get_all_email` | stats count(eval(((event_id="DELIVER" AND source_id="STOREDRIVER") OR (event_id=1023)))) as Sent by recipientlist This works perfectly. ... View more

All, I am correlating two non-related data types. Email to ERP Customers. I am going to accomplish this by referencing the recipient email address in the ERP customer information. What I did was load all the ERP customer information into splunk, and then attempted to join them: get_outbound_email | join recipientlist [search sourcetype="SalesGroups" |eval recipientlist=lower(recipientlist)] This actually worked pretty good. Then I ran into a a snag. I want relevant email (current) but the "SalesGroup" information is going to be loaded weekly. So, when I correlate events in the last 4 hours, or even 24 hours, the results are blank because splunk is trying to query the "SalesGroup" source for that time frame too. I don't think a CSV lookup will suffice in this case, because it's 400k records. However, if it will I can attemp that route. If I could ignore time on the subsearch, that would be ideal. Thanks for the ideas! ... View more

I am running a search like so: sourcetype="stuff here" | timechart span=1h sum(bytes) as Total by limit=10 username useother=f Is it possible to change the span based on a timepicker? For instance, if timepicker is 15 minutes, then my span should be like 3 minutes. If it's 30 days, then I want the span to be 1d, etc. Maybe I need to use a different method? ... View more