Worked perfect - thanks ... View more

[filemaker] displayName = Filemaker jdbcDriverClass = com.filemaker.jdbc.Driver defaultPort = 2399 connectionUrlFormat = jdbc:filemaker://{0}/{2} validationDisabled = true The key is to have the validationDisabled = true and the latest and greatest JDBC JAR file ... View more

Hi mcbradford, make sure the user email is in the search result. Then setup your own email script and parse SPLUNK_ARG_8 for the user email and use it in the script. hope this helps ... cheers, MuS ... View more

Just a hint how to quickly test some regular expressions without having the data in splunk using eval - the examples below show tests against the regex given by jgreenleaf index=* | head 1 | eval user="12345pa" | regex user="^.{5,6}(?<!p)a$" | table user index=* | head 1 | eval user="123456a" | regex user="^.{5,6}(?<!p)a$" | table user ... View more

I changed the syntax to: [fschange:C:\Users...\AppData\Local\Microsoft\Windows\Burn] and it is still not working. Can you use ...\? There are lots of users, so we would not be able to specify a different path for each user. ... View more

Try adding "recursive = true" to the stanza. This should be the default, but worth a shot just in case. Also, what exactly is not working? Do you only get files directly in the "burn" directory indexed? Do you get them from all users folders or just some? You may also want to try using: monitor://C:\Users...\AppData\Local\Microsoft\Windows\burn...* ... View more

It looks like you need to configure Maximum Matches in the Advanced Options of the lookup definition. ... View more

Where and how do I need to add AT&T @txt.att.net to Splunk? My provider is AT&T. I do not see any option to add this information to Splunk. Please help. ... View more

The results of example, but where is the problem? example: search sentence sourcetype="csv-6" wfap_priority > $wfap_priority$ ･････ dropdown 0 ：[wfap_priority > 0] 1 ：[wfap_priority > '1'] 2 ：[wfap_priority > "1"] ... View more

The macro powering the search in the "MB Recevied" Panel is: sourcetype_metrics_timechart You can see what is consuming all the time in your search by inspecting the job. Here is what you'll want to do: Reload the "All Sourcetypes" panel and go on a small coffee break ( not too long of a break or the job details will get cleaned up). Click on the "Jobs" link in the upper right corner Click "Inspect" on the entry for " sourcetype_metrics_timechart " It sounds like the search might not be using Report Acceleration correctly. Do you see a message indicating that sumaries are being used? It would look something like the following: DEBUG: [my.host.name] Using summaries for search, If Search summaries are being used, then you may have run into a bug in the core product with search acceleration. In that case, I would recommend opening a support case. ... View more

I am having the same issue. Permissions are global read which is fine. The workflow is not private. It will work just fine using Splunk search and reporting, however when I place a raw event table in the dashboard and attempt to activate the work flow via the Event Actions button, the workflow option is not there. ... View more

Well, sed supports the y command (character substitution), but since there is not a 1-to-1 mapping, I don't think you can apply that here. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_sed_script However, you can put all of your regexes into props.conf SEDCMD statements, or through transforms, which would make the alteration permanent (may not be compatible with any requirements of keeping data in its original format, if you have such). http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Anonymizedatausingconfigurationfiles#Through_a_regex_transform Hope this helps, Kristian ... View more

what systems ? where does 31 come from ? how will "per s" work given we're wilcarding win to get the sum ? You need to be more specific with your examples ... View more

hi are you able to get the desired results ? ... View more

index=windows sourcetype="wineventlog:application" SourceName=MsiInstaller EventCode=11707 | dedup _raw | rex field=Message "(?s)Product: (? .) --" | fields product_name [search index=windows sourcetype="wineventlog:application" SourceName=MsiInstaller EventCode=11707 | dedup _raw | rex field=Message "(?s)Product: (? . ) --" |fields product_name |format "NOT (" "" "" "" "OR" ")"] getting errors like Error in 'fields' command: Invalid argument: 'product_name=Java(TM) 6 Update 43' ... View more

OK, it looks like the correct answer is to exclude the RolloverSummary type ("NOT type=RolloverSummary"). ... View more

When I added the information above, I ended up with a field that contained basically all the information within the event???? The field name was so long, I could not read it. props.conf [WinEventLog:Application] REPORT-cextract = extractdelimitedfields transforms.conf [extractdelimitedfields] REGEX = (?m)^([^:]+): (.+?)$ FORMAT = $1::$2 ... View more

about the number of open connections : on linux : make sure that your HF have a large number of file descriptors (see ulimit) on windows , who knows. About the volume : event parsing, the HF do the event parsing, so the format and transforms will impact the performance too. ultimately the cpu load will be on the HF instead of the Indexers. the volume will impact the performance, what is your volume ? Usually a single indexing server is expected to handle an average 50GB per day ... View more

I'd do sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| fields client_mac] if you want to search for sourcetype=nac client_mac=XXX OR client_mac=YYY or sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| format "" "" "" "" "OR" ""] if you want to search sourcetype="nac" XXX OR YYY ... View more

You're looking for calculated fields. http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/definecalcfields ... View more

My example to rename to geo was just to verify that it shows. You need it to be called _geo for it to work with the googlemaps app ... View more

see http://wiki.splunk.com/Community:TroubleshootingIndexedDataVolume and be aware of the difference between pre 4.2*, 4.2 and 4.3+ 4.2 index=_internal source=*license_usage.log earliest=@d+30m| eval GB=b/1024/1024/1024 | timechart span=1d sum(GB) by pool 4.3 index=_internal source=*license_usage.log type=RolloverSummary | eval GB=b/1024/1024/1024 bucket _time span=1d | stats sum(GB) by _time pool ... View more

Too bad we can't bring it back by editing the DashboardTitleBar.html in share\splunk\search_mrsparkle\modules\nav . ... View more

I would agree with Ayn, but when I ran it, the search didn't have the quotes around "red car". I added this: | eval search = "\"" .search."\"" | before the format and it returned with the quoted "red car", which will search for "red car" and not "red AND car". ... View more