Hi I don't know what I am doing wrong. I am try to extract a multivalue field, error_num . I tested it in the search app and it worked correctly. This is what I got: props.conf: [JobEventLog] TRANSFORMS-error_num = mvfield_error_num transforms.conf: [mvfield_error_num] SOURCE_KEY = _raw REGEX = ERROR_:(?<error_num>d{5}) MV_ADD = true ... View more

Hi Today I started to work with the Django binding and I am trying to extract a field, but I encountered an error. I am not sure what is wrong. I tried to run the search inline and it worked correctly. {% searchmanager id="stats_count_by_cart_num" search="index=jobevent NOT "Racu name" | rex "For\sCartNumber\s(?<cart_num>\w{2}\d{3})" | stats count by cart_num" earliest_time="-2y@y" latest_time="now" cache=False %} ⚠ Error in 'rex' command: The regex '"For\sCartNumber\s(?<cart_num>\w{2}\d{3})"' does not extract anything. It should specify at least one named group. Format: (?...). ... View more

Hi I have multiple index. If I delete an index, would the data in it would be erase completely from Splunk? ... View more

Hi I am interested to upload two distinct files form multiple directories. I have done this previously by using Splunk-web, but now I am trying to do it by modifying props.conf and input.conf. So I have two files that have two different extension. So I believe my input.conf goes like this [monitor://C:/User/.../Data/...] index = my_index1 sourcetype = my_sourcetype1 whitelist = .tir$ initCrcLength = 4000 [monitor://C:/User/.../Data/...] index = my_index2 sourcetype = my_sourcetype2 whitelist = .JobEvent$ initCrcLength = 4000 Both sourcetype are custom. The events are very long. I am no sure if I'm starting the stanza correctly with the sourcetype. Please let me know I if this look right. [my_sourcetype1] SHOULD_LINEMERGER = true NO_BINARY_CHECK = true disabled = false pulldown_type = true category = Custom MAX_EVENTS = 100000 BREAK_ONLY_BEFORE = Massabeeldiabloporviejoquepordiablo [my_sourcetype2] SHOULD_LINEMERGER = true NO_BINARY_CHECK = true disabled = false pulldown_type = true category = Custom MAX_EVENTS = 100000 BREAK_ONLY_BEFORE = Massabeeldiabloporviejoquepordiablo ... View more

Hi I had a similar problem last month. I received a solution but now I encountered the same problem but the solution does not apply to it. Here is my previous question : http://answers.splunk.com/answers/231397/why-does-my-search-work-in-the-search-app-but-not-1.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev My problem is that the field "test_name" is not showing in the table. If I hit "Open in Search" in the dashboard panel, the whole table is showed correctly. "index=index_1 AND [search index=index_2 | fields field_1,field2] | rex "/n(?< test_name>[/w/W]{1,})/nDATASET" | rex "Blahblah (?< field_3>/d+-/d+) | rex "Blahblash(?< field_4>[/w/W]{1,200}) | table test_name,field_3,field_4" Note: All slash are really backslash (I changed them here for the purpose of showing where the backslash are) ... View more