I tried your two suggestions and edited /opt/splunk/etc/apps/ossec/lookups/lookup_ossec_servers.csv, but I still got the same "table is invalid" error. I reinstalled the app and that worked for me. Thanks for the reply...looking forward to using the app! ... View more

Perfect solution. Thanks! ... View more

For FORMAT , it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use host here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use .* to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname. Try: #transforms.conf [role] SOURCE_KEY=host REGEX=(App|Web|Doc) FORMAT=role::$1 #props.conf: [sourceone] TRANSFORMS-role=role ... View more

Just going to start a new thread as this one seems to have died. : P ... View more

Its not a BUG! Just figured it out! It's because the agent count never had been past 000. Once you had an agent, it works great! ... View more

That answer explained and it fixed my problem. thank you ... View more

Ah, perfect. Thanks! ... View more

Here is something simple and similar to the above answer, but is all cli. Replace localhost with your host ip/hostname Replace testdude with your username which you must know the password for. Then run it. read -s -p "Enter Password: " mypassword;t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ;mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ;curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10";mypassword="";mytoken="";t="" Here it is broken down. read -s -p "Enter Password: " mypassword; allows you to enter password with entering it on command line and stores it in a variable, which is cleaned up at end. t= curl -k https://localhost:8089/services/auth/login --data-urlencode username=testdude --data-urlencode password=$mypassword ; stores tokenized output in variable, which is cleaned up at end. mytoken= echo $t|grep -Po '<.*?>\K.*?(?=<.*?>)'|sed '/^\s$/d' ; uses above variable/output and strips it down to just token and stores it in variable curl -k -H "Authorization: Splunk $mytoken" https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal |head 10"; uses token to run search mypassword="";mytoken="";t="" cleaned up of variables used. P.S. Please shoot holes/refine it. I think it will make it more useful for everyone. ... View more

The file at: $SPLUNK_HOME/etc/apps/yourapp/appserver/static/yourfile.html should be accessible via: http://splunk/static/app/yourapp/yourfile.html http://splunk/en-US/static/@12345.67:0/app/yourapp/yourfile.html As best practice, try to use relative paths if you can, since Splunk will generate dynamic URLs that look more like the second version above. The first version works under 4.2.1, but not sure about older versions. Or, if you want to do something within a view/dashboard, you may also want to look at the ServerSideInclude module in the Advanced XML. ... View more

If you're using TIME_PREFIX , it's just a regex, so you should be able to build in an "or" condition, e.g.: TIME_PREFIX=(prefix1)|(prefix2) and make sure that MAX_TIMESTAMP_LOOKAHEAD is set high enough to get through the longer longer messages. Alternately, if the netscreen events are coming in via syslog, you could have the syslog server write them to two separate files (based on pattern match, syslog facility, or whatever works), and then create two distinct sourcetypes within Splunk. ... View more

Hi southeringtonp Fantastic, it works... Thank you very much. ... View more

Late response, but updating answer in case anyone hits this...... If you don't mind passing your SVG via SPL and using a custom visualisation app then Scalable Vector Graphics - Custom Visualization might be another option for you (instead of updating content type for svg) ... View more

the support solution go well In SplunkWeb Click on the "Apps" pulldown and select "Manage Apps..." You should find an App named Legacy Enable it - yours is probably disabled You should have a props.conf file in SPLUNK_HOME/etc/apps/legacy/default/ You should find a stanza that looks like this... [windows_snare_syslog] pulldown_type = true Make sure pulldown_type is set to true ... View more

I assume that you are talking about the app found here: https://splunkbase.splunk.com/app/314/ . According to the developer, the app is deprecated because the capability to email PDF reports is now baked into Splunk. I am running Splunk v6.2.3 on a Windows Search Head and I can select "PDF" as an email option for scheduled searches and alerts. So I guess the answer is "now"! ... View more

Awesome, worked like a charm! ... View more

Or, when you just need basic wildcard matches, you can skip the regex processing altogether and use "log*" instead of the regex "log.*" ... View more

Ah, good catch! I looked for the previous answer but missed it somehow. ... View more

Did this resolve your issue in the long term, and/or did you ever get any additional information? ... View more

Hi, I just untarred 1.1.84 directly on top of my /opt/splunk/etc/apps/ossec directory (which was 1.1.82) and indeed my dashboard counts look reasonable now. Thanks! ... View more

The rpm and deb installers put the files in /opt/splunk. Ideally you'd move your existing installation aside, do a clean install via package, and then copy all of your local configuration (etc/system/local, etc/apps, etc/users, licenses, deployment manager files) into the new installation before starting Splunk. That way the package manager thinks it's a clean install rather than dealing with pre-existing/customized files. ... View more

My experience with volumes is that if you specify a volume path, and you have indexes that lie under the same path (but don't use the volume:<name> tag, Splunk will complain on startup. I believe that the complaint is words to the effect of "this index is under a volume, but not part of it, volume retention rules won't work." As a best practice, I've always been in the habit of re-defining the homePath and coldPath of each index. ... View more

Splunk doesn't seem to like that custom search command when populating the search. The populating search has been changed in version 1.1.85 of the Splunk for OSSEC app. ... View more

Thanks. That's what I suspected. ... View more

Yes. See Enterprise vs Free License for the differences between the two types of license. ... View more

Assuming single-line events, eval can do it: | eval line_length=len(_raw) ... View more