To strip the whole HTTP header, the following regex should work: SEDCMD-stripheader = s/^(?ms)POST.+?(\r?\n){2}//g And you have to restart splunkd, since that settings is affecting indexing behavior. ... View more

You can use the eval command to selectively create a field depending on its value: ... | eval car=if(match(product,"(?i)^(mercedes|ferrari|porsche)$"),null()) | eval fruit=if(match(product,"(?i)^(apple|banana)$"),null()) | stats values(car) values(fruit) You can use the split-by clause in the stats command, to create an aggregated value for each year: ... | eval year=strftime(_time,"%Y") | stats mean(somefield) by year Edit, to answer the question in the comment: yes, you can do something like this ... | eval type=case(match(product,"(?i)^(mercedes|ferrari|porsche)$"),"car",match(product,"(?i)^(apple|banana)$"),"fruit") | eval year=strftime(_time,"%Y") | chart mean(somefield) over type by year ... View more

You have to copy the mmap library file (eg. mmap.so) from a native python installation to $SPLUNK_HOME/lib/python* . Although I added this option it probably doesn't provide a huge performance benefit. The lookup mechanism in Splunk already optimizes a lot. ... View more

The example in the app description already shows how to integrate it with the geoip command (which uses the maxmind database). <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true"> <param name="search">sourcetype=access_combined clientip=* | geoip clientip</param> <param name="earliest">-24h@h</param> <module name="VectorMap"> <param name="mapType">world</param> <param name="field">clientip_country_code</param> <param name="backgroundColor">#333333</param> </module> </module> ... View more

All communication with google servers happens from the client browser in the google maps app. So your Splunk server doesn't require internet access. The geoip command uses a local file-based Maxmind database. This seems to be a different problem. Are you using the latest version? ... View more

These props.conf settings should help: [mysourcetype] SHOULD_LINEMERGE = false LINE_BREAKER = ((?:\r?\n){2,}) ... View more

You can add arbitrary links to your navigation: <a href="/alerts/myapp">Alerts</a> will link to the Alerts page. ... View more

This is a pretty good starting point: http://dev.splunk.com/view/logging-with-splunk/SP-CAAADP5 What I can add from my experience is that printing the following things in every event is really valuable: The severity of the event (ie. DEBUG/INFO/WARN/ERROR) A thread identifier (Some sequential or random string that identifies the current thread) The source of the log event (ie. class, function or filename) ... View more

A clean approach is to create a CSV lookup file and join it with your given query: Lookup file in $SPLUNK_HOME/etc/apps/search/lookups/loadbalancers.csv: ip 10.10.10.10 11.11.11.11 12.12.12.12 Then you should be able to create an alert using the following query: | inputlookup loadbalancers.csv | join type=outer ip [ search sourcetype="access_log" (ip="10.10.10.10" OR ip="11.11.11.11" OR ip="12.12.12.12") | stats count by ip ] | where NOT count>0 (using the condition "number of events" greater than 0) ... View more

I recently uploaded an extension that allows you to integrate SQL database content (from PostgreSQL among others) easily with Splunk. See here for more details: http://splunk-base.splunk.com/apps/50803/dbx-sql-database-extension (it's commercial, though) ... View more