urtho, This is an interesting topic, and the following Splunk Blog maybe able to assist you on you choices... http://blogs.splunk.com/2011/11/04/splunk-and-multitenancy/ Hope this helps answer your question. If it does answer your question, please mark the answer as accepted to assist the community. Regards, MHibbin ... View more

How did you create you field extraction? If you used the IFX (Interactive Field eXtractor), you can do this in... "Manager">>"Fields">>"Field Extractions">> Choose field for modifying/deleting. If you did this in props.conf (you can also remove those created in IFX) this way too... you can find the props.conf files containing the extractions and modify/hash/remove the extraction and restart the Splunk services. The props.conf file will be in one of the following locations... $SPLUNK_HOME/etc/system/default/props.conf $SPLUNK_HOME/etc/system/local/props.conf $SPLUNK_HOME/etc/system/apps/<appName>/props.conf $SPLUNK_HOME/etc/system/apps/<appName>/props.conf Regards, Matt ... View more

Hi, On in the Splunk log files, you should look at "license_audit.log" , which can be found in "$SPLUNK_HOME/var/log/splunk/" . Here you will see information regarding licenses violations. So you could search on index=_internal licensemanager If you have access to the internal index, the fields should be extracted for you. Regards, Matt ... View more

Right I know it is not at index time, but this is the what I think realistically you are best off doing... using a csv file as a lookup. So your first step should be to extract the product family members... you could do something like... source="<your_source_type>" | rex field=N_vuln "(?P<N_group>\w+[^\d\:\-\s])" | where isnotnull(N_group) | stats count by N_group This will show you a list of the N_group members.... N_group count Adobe 2 Firefox 1 MS 1 Microsoft 1 Then you should have a manually (or it can be scripted if you like) created and maintained csv (this example I use family.csv and put it in $SPLUNK_HOME/etc/apps/search/lookups) which has the family and members, something like... group,family MS,Microsoft Microsoft,Microsoft Adobe,Adobe Firefox,Firefox Then modify the command to include the lookup... such as... source="/var/tmp/test1.log" | rex field=N_vuln "(?P<N_group>\w+[^\d\:\-])" | where isnotnull(N_group) | stats count by N_group | lookup family.csv group as N_group OUTPUT family as N_family And then you should have the N_family field you desire. Regards, P.S Please note, that you don't need to keep the "stats" command as this is just for demo to show your values are working. P.P.S... I think this is better, as it is not a static format, such as IP addresses. So you are not committing any changes which could end being faulty to the index, which could require cleaning the index. You could probably save this as saved search to call on, so you don't have to have the whole string. ... View more