I think that's the result he didn't want to produce 😉 ... View more

append this to the end of your search: ... | mvexpand memberId ... View more

This seems to be a bug. ... View more

You could try to use a LINE_BREAKER instead of line merging: [<your sourcetype>] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\[LOG\| MAX_TIMESTAMP_LOOKAHEAD = 50 or [<your sourcetype>] SHOULD_LINEMERGE = false LINE_BREAKER = \[END\](\s+) MAX_TIMESTAMP_LOOKAHEAD = 50 ... View more

Here are a few links that might be helpful: http://www.regular-expressions.info/ http://docs.python.org/library/re.html http://gskinner.com/RegExr/ ... View more

Please accept the answers if it solved your problem ... View more

Modified the answer ... View more

Just a minor improvement, but you can disable (or delete) the sample app. ... View more

You just have to create those files (props.conf and transforms.conf) in $SPLUNK_HOME/etc/system/local. Follow this guide: http://www.splunk.com/base/Documentation/4.1.6/Admin/Routeandfilterdata ... View more

The problem is that .* matches greedy and so the matched part ends at the last occurrence of " </Elements> ". You can make it work by adding the non-greedy quantifier: .*? So this regex should work as expected: rex "(?ms)\<Elements\>(?<abc>.*?)\</Elements\>" In order to extract all matching parts of the event, you have to add the max_match parameter to the rex command. This instruct Splunk to make the resulting field multi-valued. rex "(?ms)\<Elements\>(?<abc>.*?)\</Elements\>" max_match=999 ... View more

What kind of LDAP server are you using? It would also be helpful to show your LDAP configuartion. ... View more

Freut mich, dass ich helfen konnte 😉 Sieht man sich im Jänner in San Francisco? Liebe Grüße aus Wien. ... View more

You can do this with something like this: <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true"> <param name="search">index=summary report=top_client_ips | top clientip</param> <module name="HiddenChartFormatter"> <param name="charting.chart">pie</param> <module name="FlashChart"> <param name="height">250px</param> <param name="enableResize">false</param> <module name="HiddenSearch"> <param name="search">sourcetype=access_combined clientip=$clientip$</param> <param name="earliest">-30d@d</param> <module name="ConvertToIntention"> <param name="settingToConvert">click.value</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="clientip"> <param name="value">$target$</param> </param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> The inner HiddenSearch is the search that is getting populated with the argument from the clicked area. ... View more

Obviously it doesn't look at the last 256 bytes. Have you added your new index (sbrras) to the default indexes of one of your roles? If not, you won't see it on the summary page. ... View more

You can add the width and height options to charts: <chart> ... <option name="width">50px</option> <option name="height">50px</option> ... </chart> Although you won't be able add more than 4 (IIRC) elements in a row. ... View more

You can either use multiple regular expressions (multiple rex command calls or multiple EXTRACT-* options in props.conf) or a single regex with the (?m) multiline flag (maybe as well the (?s) DOTALL flag). Someting like this might work: ... | rex "(?ms)No exceptions for CLOSE, loaded in (?<close_pe_rt>[\d\.]+).+FX_CLOSE, loaded in (?<fx_close_pe_rt>[\d\.]+).+XLA_ENV, loaded in (?<xla_env_pe_rt>[\d\.]+).+INTRADAY, loaded in (?<intraday_pe_rt>[\d\.]+).+CPTY_CREDIT, loaded in (?<cpty_credit_pe_rt>[\d\.]+)" ... View more

First you have to extract those values you're interested in. This can be done either through xpath or the rex command. Using a search like this, would bring the results in tabular form that can be exported: sourcetype=<your sourcetype> | rex "(?m)\<Name[^\>]*>(?<Name>[^\<]+)\</Name\>.*\<DateOfBirth[^\>]*>(?<DateOfBirth>[^\<]+)\</DateOfBirth\>.*\<PhoneNo[^\>]*>(?<PhoneNo>[^\<]+)\</PhoneNo\>" | table Name DateOfBirth PhoneNo ... View more