Do you mean that you're still seeing new events from this server despite that you have inactivated these events and also uninstalled the forwarder there? That seems...highly unlikely unless you did something seriously wrong... ... View more

So say you're issuing a search at 14:00 on the 28th of April. earliest=-2d will go back exactly two days and start at 14:00 on the 26th of April. earliest=-2d@d will go back to two days ago and then "snap" to 00:00 of that day - it means "give me events from the 26th and onwards". This becomes very useful in a range of situations, for instance if you want to look at the previous month you do earliest=-mon@mon latest=@mon in order to snap to the start of the last and the current month, respectively. ... View more

Note that the date_* are only available for events where the timestamp processor has been invoked, which is not the case with for instance WinEventLog:* events. ... View more

Please read docs and apply a suitable one. This is no place where we solve all your problems for you, rather we help you solve problems. ... View more

You can either use the timerange picker in the web GUI, or you can use time modifiers directly in your search, like this: ... earliest=-1d http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/SearchTimeModifiers ... View more

Just want to point out that you don't need to reingest the log, or restart Splunk. Field extractions happen (mostly) at search-time, regardless of if they happen in props.conf/transforms.conf or inline in your search. ... View more

Googling for "splunk cli" will give you among others these helpful sections from the docs. http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/AbouttheCLI http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/CLIadmincommands ... View more

You don't need to use a browser at all, and you don't need an Internet connection at all. ... View more

Any particular reason why you're using TRANSFORMS for this and not SEDCMD? Also I'm assuming "pref.conf" is a typo? ...and finally where are you implementing this, on an indexer? ... View more

You're using the wrong operator for performing string concatenations. It should be ".", not "+". So, your eval statement should read eval hostTicket=if(isnull(hostTICKET),host_message." ".TICKET,host_message ... View more

First of all you need to be able to define what a subnet is... ... View more

Look into using the spath command. ... View more

Nope, it cannot. You could use external scheduling mechanisms like cron to have the forwarder stop or start at certain times, but the forwarder itself has no functionality like this. ... View more

You can't do CIDR defined search on freetext. You can however do it if you have the IP addresses you want to match against in extracted fields. In other words, 10.0.0.0/24 won't work, but src_ip=10.0.0.0/24 will. ... View more

If you want to filter on index time just like you would with timestamp, use the _index_earliest and _index_latest terms. ... View more

No, you can't do it like that. splunktcp is a proprietary protocol used ONLY for forwarding traffic between Splunk instances. Syslog on the other hand is a "raw" and completely different protocol. When you try to send syslog to a port expecting splunktcp traffic, it will just discard the data as it doesn't find it valid. If you're able to listen on port 514 I'd keep that, and use a raw tcp input there instead. ... View more

No that's correct. If you want to limit your timeframe that is a lot trickier. Frankly doing things like "I want to find client X if it first did this then within yy time did this" is not something Splunk is very good at - there are some ways of doing similar things but nothing really good built in. That said, I'm editing my answer with a suggestion on how you could achieve what you want. ... View more

As often otherwise, using a subsearch is a great way to create correlating searches like this. First run your subsearch that finds all clients that have downloaded .xap files, then matches this against clients that have attempted to download .jar files too. (An assumption in my search below is that the source IP exists in the field "s_ip" - if it doesn't, just change the field name to the correct one) http_method="GET" cs_uri_path="*.jar" [search http_method="GET" http_content_type="application/x-silverlight-app" cs_uri_path="*.xap" | regex cs_uri_path="/\d{3,4}\.xap$" | fields s_ip] I also took the liberty to add cs_uri_path="*.jar" . This should improve performance for your search because Splunk can narrow down the events it needs to read off disk before passing those on to the regex command. EDIT: So, in order to weigh in a time factor here, I imagine you could do something like this: http_method="GET" cs_uri_path="*.jar" [search http_method="GET" http_content_type="application/x-silverlight-app" cs_uri_path="*.xap" | regex cs_uri_path="/\d{3,4}\.xap$" | eval query="_time<"._time+5 | fields query s_ip] This adds a _time constraint so you're only looking for .jar downloads 5 seconds after the .xap download. I haven't tried this out so I can't guarantee it'll work but it should 🙂 ... View more

Where did you configure this, on the indexer? ... View more

But I guess events won't have BOTH x and b. Rather you'll have events with x and y in one index, and other events with a, b and c in another. So "where x=b" will never match. ... View more

I guess you could do this using lookups? Define a lookup in your app that holds the servers you're interested in, then use this lookup in your searches like this: <yourbasesearch> [|inputlookup mylookup | fields host] After the subsearch has run, this will expand to something like this: <yourbasesearch> ((host="server1") OR (host="server2") OR (host="server3")) ... View more

@SplunkCSIT, I agree - I feel this was not that time though. I'm more than happy to help you, but that's very hard without getting details on your case. Splunk is a complex product and depending on how exactly you've configured it it can behave very differently, so it's crucial that you provide us with details. ... View more