To add a static kv pair to all events in an index I would recommend using a lookup table to map index->MonFunc. The trick is to use a global (no stanza) property unless you can scope to a particular source/sourcetype/host. I didn't find the name of your index, so be sure to change "index_name" to reflect the name of the index you want to assign the kv pair to: ## MonFunc.csv index,MonFunc index_name,sysmsgs ## transforms.conf [MonFunc_lookup] filename = MonFunc.csv ## props.conf LOOKUP-MonFunc_for_index_name = MonFunc_lookup index OUTPUT MonFunc ... View more

cyndiback, I don't have a specific fix at this time, but this is a known issue logged as (SOLN-1032). Please submit your own case to [email protected] for tracking. Moderator edit: UPDATE: this issue later became SPL-41361, and should be fixed in the next maintenance release of the app. In the meantime, the glorious Vainstein has provided a patch for ifconfig.sh (sorry about the lines wrapping): # diff interfaces.sh interfaces-mod.sh 41,42c41,42 < SPEED=`dmesg | awk '/[Ll]ink( is | )[Uu]p/ && /'$iface'/ {for (i=1; i<=NF; ++i) {if (match($i, /([0-9]+)([Mm]bps)/, array)) {print array[1] "Mb/s"} else { if (match($i,/[Mm]bps/)) {print $(i-1) "Mb/s"} } } }' | sed '$!d'` < DUPLEX=`dmesg | awk '/[Ll]ink( is | )[Uu]p/ && /'$iface'/ {for (i=1; i<=NF; ++i) {if (match($i, /([\-\_a-zA-Z0-9]+)([Dd]uplex)/, array)) {print array[1]} else { if (match($i, /[Dd]uplex/)) {print $(i-1)} } } }' | sed 's/[-_]//g; $!d'` --- > SPEED=`dmesg | awk '/[Ll]ink( is | )[Uu]p/ && /'$iface'/ {for (i=1; i<=NF; ++i) {if (match($i, "([0-9]+)([Mm]bps)")) {print $i} else { if (match($i, "[Mm]bps")) {print $(i-1) "Mb/s"} } } }' | sed '$!d'` > DUPLEX=`dmesg | awk '/[Ll]ink( is | )[Uu]p/ && /'$iface'/ {for (i=1; i<=NF; ++i) {if (match($i, "([\-\_a-zA-Z0-9]+)([Dd]uplex)")) {print $i} else { if (match($i, "[Dd]uplex")) {print $(i-1) } } } }' | sed 's/[-_]//g; $!d'` ... View more

vaijpc, I believe the following search would get you what you need. The breakdown: Perform an initial query based on your time set as earliest_time and an appropriate + offset. The stats command will get the value closest to earliest_time going forward in time. Join a secondary query based on your time set as latest_time and an appropriate - offset. The stats command will get the value closest to latest_time going back in time. Compare the time difference between fields returned from each query and take <field> to be the value based on the smaller offset from the desired time. <your_search> earliest_time=-12h latest_time=-11h | stats first(field) as field1,first(_time) as time1 | eval timeDiff1=time1-(now()-43200) | join[search <your_search> earliest_time=-13h latest_time=-12h | stats last(field) as field,last(_time) as time2 | eval timeDiff2=(now()-43200)-time2] | eval field=if(timeDiff1<=timeDiff2,field1,field2) ... View more

Add "dc(field) as dc_field" to stats to maintain a unique count Use the following eval: | eval field=if(dc_field>19,mvappend(mvindex(field,0,19),"..."),field) The above eval looks for dc_field values greater than 20 uses mvindex to get the first 20 (Note: The index should begin at 0....0-19) and then append "..." or "TRUNCATED" or whatever. If dc_field<=19 then field=field. ... View more

echalex, Unfortunately, If you have indexed data based on non-optimal or incorrect line breaking, there is not much that can be done via search to reliably reconstruct your data. You may be able to use the "transaction" command to create a single event as long as each event matches the criteria you are using to build the transaction. For instance if you wanted to create a single event from multiple events from the same source, same time, and had some type of additional identifier like java_id: | transaction _time,source,java_id ... View more

Klee, I am assuming you are referring to the key=value pairings directly underneath the _raw value of each event row. I have had luck using the following syntax (I do not have any upstream FieldPicker or HiddenFieldPicker modules; which should work as well): <module name="EventsViewer"> <param name="fields">* signature src src_nt_domain src_user dest dest_nt_domain user</param> <param name="reportFieldLink">report_builder_format_report</param> </module> ... View more

With respect to deployment client-server, the client is responsible for contacting the server. The port for this is configurable based on splunkd of your deployment server but would default to 8089. See also: http://www.splunk.com/base/Documentation/latest/Deploy/Aboutdeploymentserver With respect to License slaves I believe they work similar to deployment clients (contacting License master via splunkd 8089 by default). See also: http://www.splunk.com/base/Documentation/latest/Admin/Configurealicenseslave ... View more