I have XML files that have been indexed. Some of the fields in the XML contain HTML formatted text. When I display these fields using the Sideview Utils HTML module I want to render the HTML, so that headers, list items, text formatting, break tags, hyperlinks, etc. are properly displayed. Can this be done? I have tried in the search to replace < with &1t; etc. but Splunk throws an invalid tag error. A portion of the XML looks like this. <DESC><![CDATA[ <p>1. This is a combined synopsis/solicitation for commercial items prepared in accordance with FAR XYZ, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued.</p> <p>2. Solicitation number is 123-456-7890 and is being issued as a Request for Quotes (RFQ).</p> <p>3. The solicitation document and incorporated provisions and clauses are those in effect through Circular <b>ANGR-15</b>, effective 30 Sep 2013</p> <p>4. The associated code is 415XRZ. This procurement is not asmall business set aside.</p> <p>5. Military Command (MC), Yourtown, USA intends to award a sole source firm fixed price purchase order to Some Comapny for the following services provided by an authorized technical representative:</p> <p>The requested period of performance for the below service is 29 - 31 February 2019. Location: Some Place</p> <p><b>ABSTRACT</b><br />This item describes technical representative services to inspect and certify stuff</p> ]]> </DESC> ... View more

I have a table that has three columns. Normally the columns will have different numbers of entries, for example Col1 may have 25 entries while Col2 may have 8 and Col3 may have 75. I want to display the counts of the number of filled rows for each column. The best I can get is the total count of rows in the table itself. The way the data is aggregated I can't put counts into the search itself. I played with Post Processing but maybe I don't know enough about it to make it work. I don't know if this is even possible but if anyone has ideas I'd be happy to hear them. This is the obfuscated search sourcetype="iis" earliest=-45d c_ip="192.168.0.1" /PubType1/ .pdf cs_uri_stem!=".pdf_" | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | eval PubType1=Publication | stats count(PubType1) by PubType1 | appendcols [search earliest=-45d sourcetype="iis" c_ip="192.168.0.1" /PubType2/ .pdf cs_uri_stem!=".pdf_" | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | eval PubType2=Publication] | appendcols [search earliest=-45d sourcetype="iis" c_ip="192.168.0.1" /PubType2b/ .pdf cs_uri_stem!=".pdf_" | makemv delim="/" cs_uri_stem | eval Publication=mvindex(cs_uri_stem,3) | eval PubType2B=Publication] | stats first(PubType1) as PubType1, first(PubType2) as PubType2, first(PubType2B) as PubType2B, count(Publication) by Publication | table PubType1, PubType2, PubType2B ... View more

I have a table with three columns. Each column lists a specific type of product by name. I want to click on any cell in the table and pass the content of that cell to a second search which will display information about when customers downloaded that product. I have no problem passing one specific column, such as $row.fields.COLUMN-NAME$ but that limits me to one column. I thought that if I strung all three columns together in my search that only the one I clicked on would be passed but instead all three are passed. I've tried the various options found in drilldown1_tables view in Sideview Utils but they don't work. It will probably be a 'doh moment when I figure it out but as of now I'm stumped. ... View more

In the past our iis logs were space delimited with the user agent field using the plus sign as an internal delimiter, such as KRFU+(VER+5.0/5.0.2.v20130730-3038;+Win7+6.1;+52.4/2215/-1;Server+Atlanta;00222003D1C5;3238LB934) But with the change in the log file format the user agent field now looks like this "KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 18.6/62/-1;Server Atlanta Metro;005056AA6ED5;sta001)" "KRFU (VER 5.0/5.0.2.v20130920-3090; WinServer 2008 R2 6.1; 15.8/0/-1;New York All-Purpose Server;005056A4000B;ws120)" One server is named "Server Atlanta Metro" which contains 3 spaces. The other server is named "New York All-Purpose Server" which contains 4 spaces. Sometimes the server will have only one name with no spaces. This causes problems with space delimited fields. So how do I tell Splunk to consume everything between the quotes as one field? ... View more

I have customer systems that log data to IIS on file transfers. IIS has a timeout of 20 minutes. When it times out it immediately restarts but throws in a new set of headers. Also the date/time stamp on the log changes and Splunk assumes that it is a new file. How can I avoid the duplication of data when Splunk attempts to re-index the log or how do I get Splunk to only consume the new data? And how do I ignore the headers scattered throughout the log file? ... View more

I have a view that passes arguments to a second view. Among the arguments is a link for drilldown to a third view. But not all results on the first view will result in an argument to pass. To determine this a search must be run on the selected parameter before the redirector is activated. Running a search should be no problem but I do not want to display the results. Instead, if there is a result I want that to become an argument in the redirector. Otherwise I want to pass an empty argument. I'm using Sideview Utils to pass the arguments. Is there a way to do this? ... View more

This search works perfectly in our production environment but not in the new Dev environment. However it does return results when run manually in either environment. Here is both the XML portion and the search. <module name="TimeRangePicker" layoutPanel="panel_row1_col1"> <param name="searchWhenChanged">False</param> <module name="SubmitButton" layoutPanel="panel_row1_col1"> <param name="allowSoftSubmit">True</param> <param name="label">Search</param> <module name="Search" > <param name="search"> [|inputlookup DataCustomer.csv | fields username] | search sourcetype="SourceData" Message="*\Data1a\*" | lookup DataCustomer.csv username output Customer | stats sum(filesize) as Data1 by Customer | eval Data1=floor(Data1/1024/1024) | append [search sourcetype="SourceData" Message="*\Data2\*" | lookup DataCustomer.csv username output Customer | stats sum(filesize) as Data2 by Customer | eval Data2=floor(Data2/1024/1024)] | append [search sourcetype="SourceData" Message="*\Data3\*" | lookup DataCustomer.csv username output Customer | stats sum(filesize) as Data3 by Customer | eval Data3=floor(Data3/1024/1024)] | append [ search sourcetype="SourceData" Message="*\Data4\*" | lookup DataCustomer.csv username output Customer | stats sum(filesize) as Data4 by Customer | eval Data4=floor(Data4/1024/1024)] | append [search sourcetype="SourceData" Message="*\Data5\*" | lookup DataCustomer.csv username output Customer | stats sum(filesize) as Data5 by Customer | eval Data5=floor(Data5/1024/1024) ] | lookup Customerall.csv Customer output CsvName | stats first(CsvName) as CsvName, first(Data5) as Data5, first(Data2) as Data2, first(Data3) as Data3, first(Data4) as Data4, first(Data1) as Data1 by Customer | fillnull value="0" Data5, Data2, Data3, Data4, Data1 | table CsvName, Customer, Data5, Data2, Data3, Data4, Data1 | sort Customer | addtotals fieldname="Total (MB)" | addcoltotals </param> <module name="JobStatus" layoutPanel="panel_row1_col1_grp1"> <param name="hideOnJobDone">true</param> <module name="Export" layoutPanel="panel_row1_col1_grp1"> <param name="exportType">results</param> </module> <module name="Paginator" layoutPanel="panel_row1_col1_grp1" group="All Customer Data Received"> <param name="count">20</param> <param name="entityName">results</param> <param name="groupLabel">All Customer Data Received</param> <module name="Table" layoutPanel="panel_row1_col1_grp1"> <param name="hiddenFields">CsvName</param> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> ... View more

I have a number of views with Sideview tabs that work well. In these instances the view shows the same four sets of information, one for each tab. Those are very straight forward and easy to configure. Now I have a situation where I have four main tabs. Each main tab has four sub tabs. Something like this: Select Tab 1 [ Tab 1 ] [ Tab 2 ] [ Tab 3] [ Tab 4] [ Tab 1A] [ Tab 1B ] [ Tab 1C ] [ Tab 1D ] Select Tab 2 [ Tab 1 ] [ Tab 2 ] [ Tab 3] [ Tab 4] [ Tab 2A] [ Tab 2B ] [ Tab 2C ] [ Tab 2D ] Select Tab 3 [ Tab 1 ] [ Tab 2 ] [ Tab 3] [ Tab 4] [ Tab 3A] [ Tab 3B ] [ Tab 3C ] [ Tab 3D ] Select Tab 4 [ Tab 1 ] [ Tab 2 ] [ Tab 3] [ Tab 4] [ Tab 4A] [ Tab 4B ] [ Tab 4C ] [ Tab 4D ] I'm not sure how they should be nested. ... View more

I have two lookup tables.The first is a list of all New York Customers and looks like the first listing below. The second is a list of all their clients. I want to input from the NYCustomers list to get the corresponding list of clients from the AllClients.csv file for the associated customer and list the client's mac address and login name and other fields from the clientiis log. What is wrong with the search? NYCustomers.csv "CustName","custid" "NYCStop1","NYC-001" "NYCStop2","NYC-002" "NYCStop3","NYC-003" "NYCStop4","NYC-004" AllClients.csv "Customer","mac_addr","cs_client" ""NYCStop1"",001BD31AFEFF,"StJames_Test" ""NYCStop1"",005056A40019,EACLIENT ""NYCStop1"",00237DB6299E,jsmith ""NYCStop1"",2C768AE1D54E,araby02 ""NYCStop1"",0006AA00B609,"Miltopetest-PC" | inputlookup NYCustomers.csv | fields CustName | rename CustName as Customer | lookup AllClients.csv Customer OUTPUT mac_addr | search sourcetype="clientiis" earliest=-7d@d | table mac_addr, cs_client ... View more

On my portal I have Solaris web logs from which I must extract file names that were downloaded by the end user. These files come from many different sources, individuals and companies. Sometimes the filenames have spaces in them and sometimes they do not. They are intermixed in the logs. These filenames have spaces in them: /krbox/resources/SW CH 32 0 2012-11-16.pdf /krbox/system/platform/krbox304b/Attachment 4 111026M123B.pdf /krbox/system/platform/krbox304b/Attachment 1 111026M121C-704.pdf /krbox/system/platform/krbox304b/Attachment 6 Functional Test Logs.zip While these do not: /krbox/reference/publications/XARP/cnf/tb11-5895-1893-13.pdf /krbox/system/platform/krbox304b/Attachment_7_D0206-001_KRBOX-304B_RS1Testing.pdf /krbox/system/platform/krbox304b/Attachment_1_111026M121C-704.pdf This is how they might look in the actual log: /krbox/reference/publications/XARP/cnf/tb11-5895-1893-13.pdf /krbox/resources/SW CH 32 0 2012-11-16.pdf /krbox/system/platform/krbox304b/Attachment_7_D0206-001_KRBOX-304B_RS1Testing.pdf /krbox/system/platform/krbox304b/Attachment 1 111026M121C-704.pdf /krbox/system/platform/krbox304b/Attachment 6 Functional Test Logs.zip /krbox/system/platform/krbox304b/Attachment_1_111026M121C-704.pdf /krbox/system/platform/krbox304b/Attachment 4 111026M123B.pdf I normally use the slash “/” as the delimiter in multi value fields to extract the filename. How can I extract the filenames regardless of the spaces? ... View more