The _raw field isn't displayed in the results, because it begins with an underscore. You have to rename it in order to be displayed in the result: index=asdf "search string" | rex field=_raw mode=sed "s/.*foo(.*?)bar/\1/" | rename _raw as raw | stats count by raw ... View more

You can assign one or more default indexes to a role. You can find that option in the Splunk Manager under Access controls » Roles. ... View more

If you define a monitor on a folder, it is recursive by default. So if you specify [monitor://E:\Data\pnlog] whitelist = \.log$ disabled = false followTail = 0 _TCP_ROUTING = pnlogGroup It will montor all files recursivly that match the whitelist expression. ... View more

You can create a "transaction" on the host field and by specifying a starts-with and ends-with condition, you should get the desired results: sourcetype=WinEventLog:System (EventCode=6005 OR EventCode=6006) | transaction host startswith="EventCode=6006" endswith="EventCode=6005" | eval restart_duration=tostring(duration,"duration") | table _time host restart_duration ... View more

You can add the regex-extraction to the props.conf file. Eg. $SPLUNK_HOME/etc/system/local/props.conf or in the app you want that extraction $SPLUNK_HOME/etc/apps/<app>/local/props.conf [syslog] EXTRACT-some-fields = ProxySG.+\s+(?<severity>\w+) (?<source_file>\S+) (?<line_no>\d+)$ severity, source_file and line_no are the example field names. Splunk uses PCRE named groups to define the fieldname for extractions. ... View more

That sould be navigationHeader . You can take a look at the (mako-) template that renderes the view at $SPLUNK_HOME/share/splunk/search_mrsparkle/view/dashboard.html and $SPLUNK_HOME/share/splunk/search_mrsparkle/view/search.html (search form). Available regions for a dashboard (might not be complete): appHeader navigationHeader viewHeader splSearchControls-inline mainSearchControls panel_row{n}_col{n}[_grp{n}] One option to position the content to the right of the Help | About Links is to add it before the AppBar: <module name="StaticContentSample" layoutPanel="navigationHeader"> <param name="text"><![CDATA[ <span>|</span><a href="#"> Test</a> ]]></param> </module> <module name="AppBar" layoutPanel="navigationHeader"/> and set the CSS (application.css) to float right: .navigationHeader .StaticContentSample { float: right; } Tweaking the padding/margin in the CSS might help in positioning it. An easier option as well, is to just use JS to add the link to the menu. In application.js: $('<a href="#">Test</a> <span>|</span>').prependTo(".AppBar .auxLinks"); or $('<span>|</span> <a href="#">Test</a>').appendTo(".AppBar .auxLinks"); If you only want to do this in one view, you can do this by surround this statements with something like: if($('body.splView-flashtimeline').length) { ... } ... View more

It is possible to do this in CSS, but only if you're using a CSS3 capable browser. In the application.css file, add something like: table.simpleResultsTable tr:nth-child(even) { background-color: #ddd; } table.simpleResultsTable tr:nth-child(odd) { background-color: #fff; } ... View more

You can parameterize the scripted inputs. I've used this several times. So if you configure the scripted input this way [script://./bin/runmycmd.sh cmd] the value "cmd" will be avaiable to the script in the variable $1 . ... View more

You have to either escape the XML characters ( < = &lt; > = &gt; & = &amp; ) within you search: <searchTemplate> sourcetype=test1 "https://test1.com:999/t2/t3/*/home;sid=" | rex "https://test1.com:999/t2/t3/(?&lt;statename&gt;.*)/home" | eval state=upper(statename) | lookup state_abbr state AS state OUTPUTNEW name AS name | eval State=upper(name) | stats dc(sid) AS "Logged in Users" by State </searchTemplate> or put it into CDATA: <searchTemplate><![CDATA[ sourcetype=test1 "https://test1.com:999/t2/t3/*/home;sid=" | rex "https://test1.com:999/t2/t3/(?<statename>.*)/home" | eval state=upper(statename) | lookup state_abbr state AS state OUTPUTNEW name AS name | eval State=upper(name) | stats dc(sid) AS "Logged in Users" by State ]]></searchTemplate> ... View more

An options is to extract the Account name after the ocurrence of "Account For Which Logon Failed": source="WinEventLog:Security" EventCode="4625" OR EventCode="539" OR (EventCode>="529" AND EventCo`de<="537") OR (EventCode>="547" AND EventCode<="549") hoursago="4" | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?<wanted_account>\V+)" | table wanted_account ... View more

1) Can be configured in props.conf [your_sourcetype] DATETIME_CONFIG=CURRENT You have to reference the sourcetype in your inputs.conf as well: [montior:///path/to/monitored/directory] sourcetype = your_sourcetype 2) No, there is no way to configure a schedule for file monitoring in Splunk. ... View more