A subsearch is used this way: sourcetype="security" [ search sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip ] The subsearch should return a result like this | ip | | --------- | | 10.1.1.1 | | 10.1.1.2 | | 10.1.1.3 | Which will expanded to the following condition: ( ( ip="10.1.1.1") OR (ip="10.1.1.2") OR (ip="10.1.1.3") ) You can inspect the conditions generated by the subsearch by executing: sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip | format ... View more

How about this? [combined] REGEX=(?m)ComputerName=(HerComputer|HisLaptop) DEST_KEY=_MetaData:Index FORMAT=new ... View more

How about having 2 different DNS Host records with the same name? On the internal DNS pointing to the internal intermediate forwarder in the private IP range, the other one published to the Interned pointing to external forwarder with the public IP. ... View more

http://splunk-base.splunk.com/answers/1453/how-do-i-add-metadata-to-events-coming-from-a-splunk-forwarder How about using this approach? ... View more

If I understood your problem correctly, this search should give you the list of IP addresses occurring in both searches: sourcetype="tippingpoint" "kerberos: authentication error" | dedup src_ip | fields src_ip | eval ip=src_ip | eval type=1 | append [ search sourcetype="wineventlog:security" | dedup Source_Network_Address | fields Source_Network_Address | eval ip=Source_Network_Address | eval type=2 ] | stats dc(type) as dctype by ip | where dctype>1 | table ip ... View more

You can't specify a column or row span, but you can influence the layout with custom CSS. To do so create a file called application.css in $SPLUNK_HOME/etc/apps/<your app>/appserver/static and put in those custom styles you want. It's easily possible to target CSS rules for specific views and elements/modules wihin those views. Every view has a unique class in it's body tag you can reference and every module has it's own unique class as well. And you can refernce the layout row/column element by their CSS class. Example: .splView-mydemoview .panel_row2_col .layoutCell { width: 25%; } .splView-mydemoview .panel_row2_col .firstCell { width: 50% !important; } You can explore and play with those styles using tools like Firebug. ... View more

The problem is that the module does not append the | geonormalize command automatically in the new version. The postprocess for the "Geo Results" table does append it, though. Since the new module now expects a combined latitude/longitude value in the _geo field (the old one expected the _lat and _lng field) you have to either append the geonormalize to your search: dest_ip=* status=Up | dedup dest_ip | lookup geoip_internal dest_ip | geoip dest_ip | geonormalize or even better, modify your lookup to emit the combined _geo value: dest_ip,_geo 192.168.1.0/24,"38.8951,-77.0363" (note the quotes around the lat/lon value) Additinally, you can specify a "geo_info" column in your lookup with a label that will appear in the "location" column of the "Geo results" table: dest_ip,geo_info,_geo 192.168.1.0/24,"Washington DC","38.8951,-77.0363" ... View more

field1="*" will filter and return all events where field1 is present. ... View more

Sure, it's possible. But you have to use the advanced XML version of your view. You can convert your form to advanced XML by appending ?showsource=1 to the URL when you're viewing it in the browser. You'll see the advanced XML sourcecode in the textbox on the very bottom of the resulting page. Copy this code over to your view file and simply replace the SimpleResultsTable module with a GoogleMaps module. ... View more

You have to either escape the HTML content in the param node <param name="text">&lt;b&gt;Title&lt;/b&gt;</param> or put it into a CDATA node: <param name="text"><![CDATA[ <b>Title</b> ]]></param> ... View more