Thanks, after the edit this works great. ... View more

Hmmm, that errors out. Here's my complete search command: eventtype = "evt_all" | eval refer_domain = (coalesce(sc_Referer_, referer_domain)) | rex field=refer_domain "(?:https?|ftp|gopher|telnet|file|notes|ms-help):(?:(?://)|(?:\\\\))(?<refer>.*?)(?:[/\\]|$)" | table refer_domain, refer and the error is Error in 'rex' command: Encountered the following error while compiling the regex '(?:https?|ftp|gopher|telnet|file|notes|ms-help):(?:(?://)|(?:\\))(?<refer>.*?)(?:[/\]|$)': Regex: missing terminating ] for character class ... View more

Here's the Simple XML: <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>Yesterday - Overview</label> <row> <chart> <searchName>rpt_All_Yesterday_Bandwidth_by_Product</searchName> <title>Bandwidth by Product</title> <option name="charting.chart">line</option> </chart> </row> <row> <chart> <searchName>rpt_All_Yesterday_Hits_by_Product</searchName> <title>Hits by Product</title> </chart> </row> </dashboard> And here's the configuration from /opt/splunk/etc/apps/$MY_APP/local/savedsearches.conf [rpt_All_Yesterday_Hits_by_Product] action.email.inline = 1 alert.suppress = 0 alert.track = 0 cron_schedule = 0 1 * * * dispatch.earliest_time = -1d@d dispatch.latest_time = @d displayview = report_builder_display enableSched = 1 realtime_schedule = 0 request.ui_dispatch_view = report_builder_display search = eventtype="evt_all"| timechart count(linecount) as Hits by product vsid = *:goolxglv [rpt_All_Yesterday_Bandwidth_by_Product] action.email.inline = 1 alert.suppress = 0 alert.track = 1 cron_schedule = 0 1 * * * dispatch.earliest_time = -1d@d dispatch.latest_time = @d enableSched = 1 search = eventtype="evt_all"| eval MB=coalesce(sc_bytes,bytes)/1024/1024 | timec hart sum(MB) as TotalMB by product vsid = *:xa3buy0h disabled = 0 Let me know if you need anything else. ... View more

No one has any ideas where to start troubleshooting? Haven't heard anything back on my open support case either. ... View more

Care to give a little more details on your suggestion? How do I do this across multiple fields? I can do top 20 term0 but I don't know how to have it evaluate multiple fields. Thoughts? ... View more

That worked, thanks. Why in the world doesn't splunk have a "show advanced XML" on the edit page for the view? ... View more

I'm not setting the index with any of my transforms ... only filtering out some unwanted data. ... View more

Thanks. I've opened a case with support. I've tried specifying a specific host and source in props.conf instead of using a sourcetype and it still didn't work. ... View more

This is still not working. Here's my props.conf from /opt/splunk/etc/system/local: [host::web002.xxx] TRANSFORMS-no_lb = no_lb_traffic_transform [WinEventLog:Security] TRANSFORMS-FilterEvents = filtersecurityevents and here's the transforms.conf file from the same directory: [no_lb_traffic_transform] REGEX=(10\.100\.0\.3|10\.100\.0\.2)(.*) DEST_KEY=queue FORMAT=nullQueue [filtersecurityevents] REGEX=EventCode=(4634|4624|4769) DEST_KEY=queue FORMAT=nullQueue As you can see, I have an additional stanza in each from some filtering I'm doing on some other web logs. That filtering is working fine, it's just the windows events that aren't being filtered. I have tested my regex in the search app and it is matching all the events that I want to filter out. Any help would be greatly appreciated. ... View more

I've just run into this issue myself and have been beating my head against the wall trying to figure it out. It's odd that splunk supports using the name of a file inside a tgz with regex to specify the hostname, but it can't look inside the tarball for the blacklist. Very frustrating! ... View more

Yeah, I know how to set the host name based on a segment of the filename, but in this case the filename is the name of the tar file and the hostname is part of a filename inside the tar file. ... View more

I had created the index via SplunkWeb manager. This issues seems to have resolved itself after restarting splunk about 3 times and waiting a few hours. ... View more