Unicode punctuation characters U+2000 to U+206f seem to make Splunk want to put the requirement for Simplified Chinese fonts in exported PDFs, so I want to convert these characters to ASCII equivalents. I can add the following to the search command rex field=Course mode=sed "s/(‘|’)/'/g" where the replacement chars above are U+2018 and U+2019 and they are replaced with 0x27, but I want to put something in props.conf to force it to happen always. How would I do this? ... View more

I am doing some online course completion analysis and am trying to get a report which seems to me to be quite difficult to achieve. I have data from 2 sources, one containing the learners in the system and which company they belong to and the other a list of courses completed by those learners. A simplified example of a learners record is userid,name,learner_type,company, and course completions is course,userid,name,completed There are 3 different learner types, "Direct sales", "Indirect sales", "Other" and I want to ignore Other in this report. I have 2 sourcetypes, learners completions What I want to get out is a report that shows Course Company Number of passes Total number of learners in the company Percentage complete as total learners by # passes It needs to group the report by course, so the course name is only reported once and there is a line for each of the companies with the 3 additional columns of data. I have got as far as two types of splunk command, each of which goes part way to solve the problem. The first sourcetype=completions learner_type!="other" | stats count(learner_type) as Passed by course, company | chart list(company) AS Company, list(Passed) as Passed by course That gives me the courses and within each course there are 2 columns, 1 the company and 2, the number of courses passed for that company. Cool, but not enough... The second uses transaction to group by course sourcetype=completions learner_type!="other" | transaction course | sort course | table course, company That gives me a table with course and companies, with just a single line for course. So, the first is missing the count of learners for each company, which must somehow come from the learners source_type as well as the % complete. The second is missing most stuff, but is an example of partially achieving what I wanted with the transaction command, which I had not used before. I feel like I need to do an initial count of the learners for each company and pass that onto the rest of the search pipeline, but am now stuck on how to progress... Any help much appreciated. ... View more

I have a log file of logins to a system by username. I can product a report of the logins by time host="daily" | table Username, "First Name", "Last Name", Company, Time | sort Username but I also want to add a total of logins per Username, but I can't figure out how. Other options for the report would be to show a list of login times per username, including fist/last name, company and then a total for that user. ... View more

I have a utf-16 CSV file with a 0xFFFE byte order mark and the csv field names in the first line. I have defined the charset for that input type to be utf-16le, which is fine, however, it extracts the field names incorrectly, e.g. the field name 'Company' is shown as x00C_x00o_x00m_x00p_x00a_x00n_x00y_x00 I have tried various ways to fix this, Firstly, skipping the first line using the following in props.conf PREAMBLE_REGEX = \ufffe FIELD_NAMES = id,username,firstname,lastname,company,time,ipaddress but I then get no named fields at all and the first line is an indexed record. Secondly, trying FIELD_HEADER_REGEX, also no luck Edit: I also tried the preamble_REGEX as \ufeff, I also removed the BOM but still it creates the incorrectly decoded utf16 field names. I converted the file to utf-8 and it's fine, but that's not a practical solution in the live environment. Anyone got utf-16 + csv working? ... View more