Elaborate on what you mean by jump to the next line? Do you mean line-wrapping? ... View more

Simple XML, advanced XML? If it's simple you'll need to convert to advanced first of all. ... View more

I don't follow completely what you're trying to achieve - grab a count of failed logons? If so, just do stats count at the end of the search, instead of stats mean(...) . If I misunderstood your intentions, please describe them in more detail. ... View more

I imagine you could achieve this using the new foreach command that exists in Splunk 6.0 and onwards: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Foreach ... View more

Is this a full-blown Splunk instance (indexer or likewise) or a Universal Forwarder? ... View more

Not following why you need to SSH in instead of just issuing a search using directly using the REST API available on the splunkd port (8089) - firewall issues or...? ... View more

If you haven't already I highly recommend you to download the Splunk on Splunk app (https://apps.splunk.com/app/748/ ), it gives you lots of visibility into the health of your Splunk setup. ... View more

command.search.rawdata is what is spent getting the raw text of the identified events, so if this takes a long time that could imply I/O performance issues. ... View more

Uh well, first of all it would be nice to know the actual search you're running? ... View more

Yeah there is - it's in the install package. Here's what it says: ===pfSense Technology Add-on=== Author: Mika Borner Version/Date: 1.0/05/04/2013 Supported product(s): pfSense 2.0.x pfSense 2.1.x Source type(s): pfsense:filter pfsense:syslog Input requirements: The output for firewall filter logs has to be tweaked on pfSense. The standard syslog output is not really parsable. In file /etc/inc/filter.inc change line mwexec_bg("/usr/sbin/tcpdump -s 256 -v -S -l -n -e -ttt -i pflog0 | logger -t pf -p local0.info"); to mwexec_bg("sh -c \"while(true); do /usr/sbin/tcpdump -s 256 -v -l -n -e -i pflog0 | nc -u <splunkhost> <udpport> ; done\""); where <splunkhost> is your Splunk forwareder/indexer with <udpport> as the the udp input port. ===Using this Technology Add-on=== Configuration: Manual - pfSense filterlogs must have the sourcetype pfsense:filter assigned. This is best done with a separate udp input (e.g. 515/udp) .../inputs.conf [udp://515] connection_host = dns sourcetype = pfsense:filter -pfSense syslog messages must have the sourcetype pfsense:syslog assigned, e.g. .../props.conf: [source::udp:514] TRANSFORMS-pfsense_syslog_sourcetyping = pfsense_syslog_sourcetyping .../transforms.conf: [pfsense_syslog_sourcetyping] DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::pfsense:syslog REGEX = <your criteria> SOURCE_KEY = <your criteria> What it does is it creates various CIM compliant fields and tags (CIM information, see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/UnderstandandusetheCommonInformationModel ). ... View more

Fair enough - updated my answer with an approach that will grab all the hostnames first of all. ... View more

Sure. timechart is, more or less, an alias for bucket _time | chart <functions> over _time so if you want to use another field, just do `bucket yourfield | chart <functions> over yourfield` ... View more

I think you should switch to a REPORT statement first of all to make sure your extraction works. That way you won't have to reindex data every time you want to try out your extraction. After you've got that working, IF you have VERY good reasons for doing this as an index-time transform instead, switch over then. ... View more

Sorry, I obviously misunderstood what you meant. I don't have a good answer for the issue you're having, sorry. ... View more

First of all, you should NOT be using index-time field extractions (TRANSFORMS) unless you really know what you're doing and why. In this case one reason why your fields are not showing up could have been that you were looking at data that has already been indexed, so this field extraction had not been applied to them. However I see issues with your regex - btw putting it in an image was kind of a bad idea because if someone (like for instance, me) wanted to debug your regex they (I) have to manually write it again. Anyhow, on to the regex: in your first group you're matching one character A to Z, followed by one or more , characters. Underscores will not be matched at all. So, the text " I,,, " would be matched, but for instance " IVADMID, " would not. Even less so with " IV_ADM_ID, ". There are a couple of other things as well but to make a long story short, this regex works better: \((\w+),(\w+),(\w+)\)\s+VALUE\s+\((\d+),(\d+),(\d+)\) It's always a good idea to test this stuff before applying it. I often use http://regexpal.com/ or http://gskinner.com/RegExr/ . ... View more

Check splunkd.log to see what Splunk says about this input. ... View more