You can't at the index time, but at search time as FORMAT take multi name-value pairs. Refer : http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Transformsconf FORMAT = * NOTE: This option is valid for both index-time and search-time field extraction. However, FORMAT behaves differently depending on whether the extraction is performed at index time or search time. * This attribute specifies the format of the event, including any field names or values you want to add. * FORMAT for index-time extractions: * Use $n (for example $1, $2, etc) to specify the output of each REGEX match. * If REGEX does not have n groups, the matching fails. * The special identifier $0 represents what was in the DEST_KEY before the REGEX was performed. * At index time only, you can use FORMAT to create concatenated fields: * FORMAT = ipaddress::$1.$2.$3.$4 * When you create concatenated fields with FORMAT, "$" is the only special character. It is treated as a prefix for regex-capturing groups only if it is followed by a number and only if the number applies to an existing capturing group. So if REGEX has only one capturing group and its value is "bar", then: * "FORMAT = foo$1" yields "foobar" * "FORMAT = foo$bar" yields "foo$bar" * "FORMAT = foo$1234" yields "foo$1234" * "FORMAT = foo$1\$2" yields "foobar\$2" * At index-time, FORMAT defaults to ::$1 * FORMAT for search-time extractions: * The format of this field as used during search time extractions is as follows: * FORMAT = :: ( :: )* * where: * field-name = [ |$ ] * field-value = [ |$ ] * Search-time extraction examples: * 1. FORMAT = first::$1 second::$2 third::other-value * 2. FORMAT = $1::$2 * If the key-name of a FORMAT setting is varying, for example $1 in the example 2 just above, then the regex will continue to match against the source key to extract as many matches as are present in the text. * NOTE: You cannot create concatenated fields with FORMAT at search time. That functionality is only available at index time. * At search-time, FORMAT defaults to an empty string ... View more

Your 2nd line is the right one to find any events containing string PIN_ERR_STORAGE . Is your question is why there was no alert for the 2nd matching event? ... View more

Did you remove the double quotes in the REGEX = "INFO" line in props.conf?? ... View more

Did you restart your Heavy forwarder after putting these changes? ... View more

REGEX = "INFO" is exactly match "INFO" with quotes. So, if your event doesn't have quotes around INFO, then use REGEX = INFO Also, you have user another transforms to forwarder the remaining event. Please the configurations I have explained in the answer. let me know it works. ... View more

I don't think there is way to know the forwarder details without _internal index. But, The work around solution can be 1. As admin user ,schedule a search query on _internal to write forwarder status details to new index (like summary index) and configure the new index accessible for all customers. 2. So the customer can use the new index to know the forwarder details. let me know if this addresses your queries . ... View more

If you are using Splunk version 6.2, "Deployment Monitor" App (comes default with installation/upgrade to 6.2) given forwarder information. If you are using pre-6.2 release in your perf environment, then install 6.2 version on your test environment, goto "Deployment Monitor" app and get the search queries populating the forwarder information in the dashboard. Also there is app called "Data Onboarding" https://apps.splunk.com/app/1769/#/overview , install and see if you can find any useful information for you. From the dashboard you can get the search query and then you can customize and use it accordingly. E.g: below query from "Data Onboarding" app dashboard give information about all forwarders index="_internal" source="metrics.lo" group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | eval connectionType=case(fwdType=="uf","universal forwarder", fwdType=="lwf", "lightweight forwarder",fwdType=="full", "heavy forwarder", connectionType=="cooked" or connectionType=="cookedSSL","Splunk forwarder", connectionType=="raw" or connectionType=="rawSSL","syslog")| eval build=if(isnull(build),"n/a",build) | eval version=if(isnull(version),"pre 4.2",version) | eval guid=if(isnull(guid),sourceHost,guid) | eval os=if(isnull(os),"n/a",os)| eval arch=if(isnull(arch),"n/a",arch) | fields connectionType sourceIp sourceHost sourcePort destPort kb tcp_eps tcp_Kprocessed tcp_KBps splunk_server build version os arch guid ... View more

Did you get the solution using pivot? We can't specify time range in pivot command.. ... View more

My few sentences on question-2 as question-1 is answered. You can use tstats command for better performance. For using tstats command, you need one of the below 1. create namespace with tscollect command 2. Created datamodel and accelerated (From 6.0 onwards and same as tscollect) 3. Use the existing job id (search artifacts) When you use tscollect or data model acceleration, there will be scheduled job to update the new tsidx file continuously in the background (+1 to your concurrent searches) and the new tsidx file adds to your disk space. ... View more

If you have chosen index a file once , then you dont see the entry in inputs.conf as splunk doesn't need to monitor the files for further. You dont get in btool output aswell. This is the expected behavior. But in the question you mentioned you have created index and added file at search head. Providing right question will fetch the answer quickly and right one. Can you please restart splunk instances where you had created Index & added input file and let me know if u still getting the messages? If this is still not working, then you need to clearly explain your topology and steps you have followed for configuration. Then easily we can help to fix your issue. ... View more

You mentioned you have added the index and input splunk web on search head..right? So I'm assuming your search head and Indexer is same instance. While adding, did you choose "Upload and index a file" or "Continuously index data from a file or directory this Splunk instance can access" or "Index a file once from this Splunk server" option?? ... View more

Try .. http://answers.splunk.com/answers/188557/620-to-61x-license-master-issues.html http://answers.splunk.com/answers/187208/my-62-license-slave-is-not-working-my-614-license.html ... View more

After upgrade did you replace/edit any configuration files manually? If yes, please describe. Also what are the commands you executed after upgrade? ... View more

The same instances configured as Deployer, Cluster Master and Deployment Server - is it right? Is the key (password) used for search head cluster is also same as key set in cluster master or different? ... View more

Is this worked or still facing issue? ... View more

Sorry, the URL you mentioned is blocked in office. Can you please try this https://regex101.com/r/cJ5vW2/9 on saved regex and let me know? Generally it should work whether you saved the rex or used in search query and should be same. ... View more

Check if this helps https://regex101.com/r/cJ5vW2/7 ALso, I removed all the new line characters and still my regex works fine.. please see here https://regex101.com/r/cJ5vW2/8 please let me know if you are still facing any issues ... View more

I think that is becos your event in splunk doesn't have the new line character . Can you please put the extracted values after regex are saved for the above 4 parameters with for an event? Did you use the single regex for all fields or individual regex? ... View more

Based on your new updated log, here are the extractions.. If you are sure that event is having the 4 fields you mentioned, then you can use the single regex mentioned in the below URL https://regex101.com/r/cJ5vW2/1 P.S : If any one of above 4 mentioned fields is missing, then this regex may not extract for those events. If you are not sure if these fields are existing in every event mandatorily, then better I would suggest to use individual extraction for each fields.. Extraction for X-Gmail-Labels : https://regex101.com/r/cJ5vW2/2 Extraction for Delivered-To : https://regex101.com/r/cJ5vW2/3 Extraction for Subject : https://regex101.com/r/cJ5vW2/4 Extraction for From : https://regex101.com/r/cJ5vW2/5 If you want extract name and email id from From field seperately : https://regex101.com/r/cJ5vW2/6 These individual extraction works fine event if one of 4 fields missing in any of events. ... View more

Yes, I knew it. It depends on whether strict or loose pattern matching required. That why I said, based on 19 digit pattern as per the question. ... View more

Since you want to break the events "From <19digits>@", here is props.conf for the same. I have used \d{19} to match the exact 19 digits as you mentioned. props.conf [< your sourcetype OR source or host >] BREAK_ONLY_BEFORE=From\s+\d{19}@ NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true please let me know if the above props.conf worked for you.. regex query tried to match the correct pattern is https://regex101.com/r/kD3tZ1/1 ... View more

Extracted both values comes after "Received:" and "X-Received:" in the same field. Here is the regex saved. https://regex101.com/r/lI4kZ4/1 please let me know if you need any changes, I shall modify the regex accordingly. Also, please answer my questions posted as commented to your question. ... View more

Can you please put one complete event log how it looks? Do intended to extract the value after "Received:" and "X-Received" in to the same field name or different field name? What is your event line break format? ... View more