Try this, your_base_search | eval epoch_st = strptime(start_time, "%Y-%m-%dT%H:%M:%S%z") | eval epoch_et = strptime(end_time, "%Y-%m-%dT%H:%M:%S%z") | eval epoch_diff = epoch_et - epoch_st | eval dur=tostring(epoch_diff, "duration") http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions /K ... View more

Instead of writing a rather complex regex, it would probably be easier to write a different one for each pattern, e.g. props.conf EXTRACT-foo = \[audit\s(?<src_user>\S+)\sas\s(?<dst_user>\S+)\son EXTRACT-bill = \son\s(?<console>pts[^\]]+)\] EXTRACT-bob = \son\s(?<src_ip>[\d.]+):(?<src_port>\d+)-\>(?<dst_ip>[\d.]+):(?<dst_port>\d+)\] EXTRACT-jim = \]\s(?<path>/\S+)\s(?<command>.*) EXTRACT-joe = \]:\s\#===\ssession\s(?<session_status>\w+) EXTRACT-hoss = \s\on\s(?<origin>\S+)\] EXTRACT-hank = \s\S+\][^:]*:\s(?<action>.*) This means that not all fields will be present in all events, e.g. src_port etc, and that some extractions will overlap. The extraction named foo will handle the things that are common to all events, whereas bill and bob will deal with the alternate versions of pts * and ip/port pairs. jim and joe deal with the different actions (sessions and commands executed). Finally hank & hoss extracts jim/joe and bill/bob information, regardless of format for easier reporting. Consider this as examples of an approach, rather than The One Way To Do It. /K ... View more

One thing that you can do immediately is to set up a regex transform on your indexer to remove the unwanted data. The example below will re-route all data from that host to the trash can. props.conf [host::your_host] TRANSFORMS-remove_stuff = setnull transforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue NB: you can make a more selective filtering by writing a more specific regex, so that you actually get to keep those events that you like. Read more here; http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/Anonymizedatausingconfigurationfiles /k ... View more

The easiest way to try this out is to do it via rex , which extracts these field for the duration of the search. I.e. the configuration is not stored in any config file: your search for events | rex "Number\sof\records\s+:\s+(?<rec_num>\d+)\s+Total Size of records\s+:\s+(?<rec_size>\d+) | timechart span=1d avg(rec_num) avg(rec_size) /K ... View more