No problem. Please mark my answer as accepted. ... View more

Sure, you can use blacklists in inputs.conf. Have a look at the docs: http://docs.splunk.com/Documentation/Splunk/6.0/admin/inputsconf So for instance [monitor:///some/directory] blacklist = \.filepart$ ... View more

Also, your modified transforms should go into a transforms.conf in the app's local directory instead of default ! ... View more

Also if this is the same problem you're experiencing you're going to want to change the field extractions as well, because they're delimiter based and will be thrown off if the number/order of fields in the extraction definitions do not match what's in your log data. Specifically the first field that is called "future_use1" had to be removed in the setup I encountered this problem in. ... View more

I was debugging something very similar to this at a customer just the other day. Turns out the sourcetype renaming transforms rely on there being 3 CSV fields before the log type field (THREAT, TRAFFIC, ...) whereas the customer's logs only had 2 (received_time and serial_number). You might want to check if this is the case in your setup as well. If so, the fix is to remove one of the groups in the transform in transforms.conf, so for instance the traffic log transform would change from this: [pan_traffic] DEST_KEY = MetaData:Sourcetype REGEX = ([^,]+,[^,]+,[^,]+,TRAFFIC,) FORMAT = sourcetype::pan_traffic to this: [pan_traffic] DEST_KEY = MetaData:Sourcetype REGEX = ([^,]+,[^,]+,TRAFFIC,) FORMAT = sourcetype::pan_traffic ... View more

Read Drainy's answer. ... View more

No. Splunk uses its own proprietary storage/db. ... View more

It seems to me you should take the Splunk search tutorial (http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial ). The searches you're running now are looking for the literal string "regex". You could do index="ABC" | regex _raw="INFO" which is probably what you were after, but that would have horrible performance, because it would tell Splunk to grab ALL events in the index ABC from disk before passing them on to the regex command. It would be MUCH better to do index="ABC" INFO because that would make Splunk grab only the events that actually contain the word "INFO" from disk. Always try to put as many terms in your base search as possible - it enables Splunk to limit the events that need to be read from disk, which leads to better performance. ... View more

With WILDCARD you need to actually put in wildcards in your lookup in order for Splunk to do a wildcard match. So if you want to match the value "foobar" from your results, the value "foo" in the lookup will not match but " foo* " will. ... View more

Splunk doesn't treat zip files as directories (because they aren't), so doing ... in your monitor statement won't make Splunk open your zip files and recurse into them. Easiest would be to just index the whole zip. ... View more

What kind of code changes are you doing restarts for? If it's just for reloading views etc you just need to reload the application like @somesoni2 says. You do this by either accessing the app's base URL, or by clicking on the app text/image in the upper left corner in the web interface. Other stuff can often be reloaded by hitting the /debug/refresh endpoint in splunkweb, i.e. http://yourserver:8000/debug/refresh ... View more

OK, as long as you're not confusing the field "Type" in Splunk having the value "Information" with that the raw event actually has the exact string "Type=Information" in it. Maybe a good idea to paste a sample event here to make sure this is not the case. ... View more

Do your events have these exact strings in them, i.e. "Type=Information"? Usually Windows logs rather have something like "Type: Information" instead. ... View more

Please read the section in the docs dedicated to this: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/SQLtoSplunk ... View more

Run a VM on top of DOS? What virtualization software runs on DOS? o_O ... View more

You should post more specifics about your data and what you want to do with it. Right now I'm confused about what you mean by variables in your data, source etc. Please elaborate. ... View more

... | eval myval="\"".myval."\"" ... View more

... | eval myval=if(match(variable2,"123"),variable1,"") ... View more