yes! use a combination of a lookup file and a subsearch. Put all your IP addresses into CSV file, called "ipAdd.csv" for example with the following contents: match,ip 1,61.247.204.36 1,61.247.204.38 1,61.247.204.37 1,61.247.204.39 1,61.247.204.35 .... Create a transforms.conf file with the following stanza: [ipAdd] filename = ipAdd.csv Check that Splunk likes this configuration/format by putting the following into a search box (note that the " | " should be the first character): | inputlookup ipAdd Assuming this returns the contents of the file, you can construct your search as follows: source="dbmon-tail://netmanias/splunk_ads_click" NOT [|inputlookup ipAdd | rename ip AS query | fields query] Ref: http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Aboutsubsearches http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources http://docs.splunk.com/Documentation/Splunk/4.3.4/User/HowSubsearchesWork Hope this helps, ... View more

To be sure I would change your stanzas to use WinEventLog instead of winEventLog . I would then look at the following documentation, as you may need to include the full path the event log: http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/MonitorWindowsdata#Event_log_monitor_configuration_values I also assume you search starts with: index=wineventlog Hope this helps. ... View more

Hi there, I'm going to assume your calculated field is using stats or eval ? - For a better answer, tailored to your issue, it is always best to show the search being used (even if some values are omitted for security reasons). After you have your "calculated" fields, you may want to rename the fields to a simple format, e.g. .. | rename count(somefield) AS countSomeField OR .. | rename "Some Crazily Formatted_Field(!&$(" AS someField I have had some issues with fields not looking up properly, but worked once I changed the name being used. As I said to help us help you, please paste in your search and the header row of the CSV file please. You can also check that Splunk has accepted your lookup configuration by running the following search (replacing the tag as to your needs): | inputlookup <yourLookupName> NOTE: The " | " (pipe) should be the first character typed as this is a special search command. UPDATE: Based on your example... So to clarify, your CSV has the following header: pages,modulename And you wish to link the pages field from your lookup to the extracted module field from your search (as you detailed it as Linkingfield) ? If so try the following: host="hostname" | rex field=msg "(GET:w+://[^)]+/(?<module>[^)]+.(xap|aspx))" | lookup <yourLookupFile> page AS module OUTPUT modulename | table _time host module modulename You should check out the documentation also... http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsfromexternaldatasources Hope this helps, ... View more

Not sure your second example is an aspx file, but I'm not web developer. However the following regex will capture those that end in " .aspx "... "GET:\w+://(?P<url>[^\)]+\.aspx)" You can try out regular expressions on the following site... handy tool: http://gskinner.com/RegExr/ Hope this helps. ... View more

I think the regular expression you are looking for is: \w+\:\/\/[^\s]+ EDIT: Probably get away with using the following, however I have a habit of escaping the characters: \w+://[^\s]+ You can test this using the rex command, like: <yourBaseSearch> | rex field=_raw "(?P<url>\w+\:\/\/[^\s]+)" | table _time url _raw (Don't really need the table part, just makes it easier to match it up). Once you have your regular expression correct, you can just paste that into the IFX (Interactive Field eXtractor). Additionally, for testing regular expressions, the following site is very helpful: http://gskinner.com/RegExr/ Hope this helps. ... View more