This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up. The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range": eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe") In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search. ... <module name="SingleValue"> <param name="field">src_ip</param> <param name="classField">range</param> </module> ... View more

timbCFCA, The MV_ADD transforms settings is what you want here. REPEAT_MATCH is only valid @ index time. Given the following sample the following configs will be valid: summary=" Policy Rule modified" summary=" Policy Rule number 2 modified" details="Details line 1" details="Details line 2" ... details="Details line X" ## props.conf [<your_sourcetype>] REPORT-details_for_your_sourcetype = details_for_your_sourcetype REPORT-summary_for_your_sourcetype = summary_for_your_sourcetype ## transforms.conf [details_for_your_sourcetype] # Assuming quoted strings REGEX = details=\"([^"]+) FORMAT = details::$1 MV_ADD = True [summary_for_your_sourcetype] # Assuming quoted strings REGEX = summary=\"([^"]+) FORMAT = summary::$1 MV_ADD = True ... View more

Howyagoin, This is a warning message introduced in 4.2.1. It will warn when extractions exceed 1000ms. I have browsed limits.conf without finding a setting to increase this threshold; however I would recommend addressing the underlying extraction. In this case the "access-extractions" transform Regex may need to be adjusted to provide faster matching. This typically involves anchors which will invalidate the match quicker. ... View more

suhprano, The "| metadata" command will distribute to all servers in your distributed search pool. The reason you may not be getting results back could be caused by your data being in non-default indexes. Have you tried: | metadata type=sources index=* Your role should also have the get_metadata capability (get_metadata is a shipped capability of all roles). Update: Based on your comment below make sure you are using valid types. Valid types are: type=sources type=hosts type=sourcetypes ... View more

Woodreamz, Eventtype priority in eventtypes.conf is not a searchable element. priority = <integer, 1 through 10> * Value used to determine the order in which the matching eventtypes of an event are displayed. * 1 is the highest and 10 is the lowest priority. Instead, I would recommend creating a lookup which maps eventtype or other event characteristics to a priority field. Example: ## eventtypes.conf [myeventtype] search = ERROR OR WARN ## transforms.conf [eventtype_priority_lookup] filename = eventtype_priorities.csv ## eventtype_priorities.csv eventtype,priority myeventtype,super-critical ## search ERROR OR WARN | lookup eventtype_priority_lookup eventtype OUTPUT priority | search priority=super-critical The only downside to performing a lookup on eventtype is that the eventtype field is not available until after the initial search. So we perform an initial search to narrow down our events, then perform the lookup, and then perform a search on the output field of the lookup. You could not use this lookup in props.conf for instance. You could also use tags for this, however tags can be a bit cumbersome to report on as a field. ##tags.conf [eventtype=myeventtype] super-critical = enabled ## search tag=super-critical ... View more

Spaces are not allowed. I would recommend using a separator like dash or underscore. Per Splunk's CIM you may want to consider the use of two tags. The combination of these tags would eliminate the flexibility to search on these tags independent of each other. See also: Common Information Model ... View more

Vincent, You can have macros that make use of generating commands, but the error is likely correct in that certain search commands (i.e. metadata) must be the first command of a search. ## macros.conf [metadata] definition = metadata type=hosts index=* iseval = 0 ## search | `metadata` ... View more

James, I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue. See also: http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes ... View more

I would recommend using Splunk's internal metrics for this: index=_internal source=*metrics* group=per_host_thruput | rename series as host | eval MB=kb/1024 | stats sum(MB) as MB by host Then save and schedule this search to run over your desired time window. Set the alert to trigger when MB>50 and trigger a script. The script will be responsible for taking the hosts identified by the search, running iptables, and sending an email/trap. You could have the Splunk alert handle the email part as well depending on the manner by which you want to notify. ... View more