If you do a subsearch on sourcetype B and grab all users you find there, you can then use this filter when you search in sourcetype A. sourcetype=A [search sourcetype=B | dedup user | fields user] | ... ... View more

All searches in Splunk are run as their own processes. When you issue a search, Splunk will create a new process responsible for handling that. If you kill that process, the search will not complete or return any results, and Splunk will return an error message saying the process was canceled (iirc). From this it follows naturally that these processes are not the kind of processes that are expected to be running constantly, so there is nothing that needs to be explicitly "started" if it is "stopped". ... View more

This script will help you in determining what status Splunk has for your monitor inputs: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ ... View more

You could make the clientip available by doing ... | eventstats first(clientip) as clientip by PNUM | ... ...or, if you take the stats route that I wrote as your second option, you could do ... | stats first(clientip) as clientip, list(login) as login, list(file) as file, list(size) as size by ID ... View more

I don't follow entirely if you want to report on the whole session or on individual files. Trying to combine those two can be a bit tricky. You haven't posted a search or field names you're using or stuff like that so it's hard to write something that you can take and just paste and go, but let's say you have the session ID extracted in the field "ID", the username in the login as "login", files as "file" and size as "size". You also mentioned IP but I don't see that anywhere in the log sample. One more thing I don't understand is what's special about these "trigger" files - it's just another file, no? 🙂 If you're fine with reporting individually on each item uploaded by a user, you could just do ... | table ID login file size If you want to group all this in a session for some reason, you could do something like ... | stats list(login) as login, list(file) as file, list(size) as size by ID From your requirements it doesn't seem like you need to use transaction at all. ... View more

Correct. 🙂 ... View more

Almost want to say 'sorry' because that's a nice script after all 🙂 ... View more

What about simply prepending each line in a code block with 4 spaces? That's how code is entered and it hasn't failed me so far... ... View more

Are you indexing these events on a local Splunk instance or are you forwarding these from your machine to a separate indexer? ... View more

Note that you will not be able to search on this field by default since it doesn't correspond to a unique token in Splunk's index. If that's not a problem, all is fine. 😃 ... View more

Neither eventstats nor eval filter events in any way so I suspect you're doing some other error. What does your search look like now? ... View more

You can calculate a total distinct count and then divide your Users value by this to get a percentage. search... | fields + user, country| eventstats dc(user) as totalcount | stats dc(user) AS Users by country | eval countrypercent=Users/totalcount*100 | sort - Users ... View more

Well, dedup? 🙂 ... | dedup field1 field2 ... View more

I think the problem lies not in this section of the XML but rather in the search you're using. Could you please paste the search part as well, please. ... View more

Not sure what you mean by where they're "located"? They're passed on as arguments to shell scripts you run as alert actions. It's not configurable, this is the arguments you always will get. ... View more

Nope, filtering cannot be done on a Universal Forwarder. Your options are to either use heavy forwarders instead (these can perform filtering) or...well, to accept that filtering must otherwise be done on the indexer. ... View more

No that looks about right, depending on how your filter looks more exactly and what sources you expect to be filtered out. ... View more

...if the form is made in advanced XML, that is. If it's not, you can convert simple XML to advanced XML. ... View more

The search command does not support filtering using regexes. You'll either have to filter using wildcards and/or explicit individual terms, or use the separate regex operator as your second command, like this: source=a* | regex source="a[1-3]*" The drawback to this approach is that Splunk will read all events matching source=a* first before sending them to the regex command that then performs the filtering, which means more events will be read from disk than what is strictly necessary. ... View more

...well what's the regex you're using? ... View more

I'm guessing you meant TERM()? ... View more