Hi @YUNHYEONG, Yes, it should ingest all the files matching the path pattern. Can you share some examples of files that are not getting indexed? (full path and filename). Also, is the problem that you are monitoring too few files or too many files?  => Because you wrote "only some data is monitored." vs. "some of the same files in other folders are monitored"... BR Ralph ... View more

Hi @YUNHYEONG , There is one issue with the host segment, let me quote the Documentation: * On Windows machines, the drive letter and colon before the backslash count as one segment. * For example, if you set host_segment=3 and the monitor path is D:\logs\servers\host01, Splunk software sets the host as "servers" because that is the third segment. So it would need to be host_segment = 4 in your case. Other than that I don't see a problem with the settings. What does not work for you, besides the host assignment? BR Ralph ... View more

Hi @Dworsnop, Not sure if this helps you, but I had fun playing around with mvfind, mvindex and spath. Conclusion: You can not use a field value as an "index input" for spath. So, this does not work:   | eval n=1 | spath output=somefield path=yourarray{n} But, you can dump the whole array to a mvfield with spath and then get the desired value with mvindex, where you can use a field value for the index indicator. To test it, I indexed a json with a drinks array and combined it with some meals.  (The AI picked the wrong drink for my burger, so I corrected it 🙂 ) source="json_drinks" | eval meals="pasta burger pizza" | makemv meals | eval n=mvfind(meals,"burger") | eval 'meal_selection'=mvindex(meals, n) | spath output=drinks path=drinks{} | eval 'drink_selection'=mvindex(drinks, n) | eval noiwantbeer=n-1 | eval 'drink_selection_correction'=mvindex(drinks, noiwantbeer) | table 'meal_selection', 'drink_selection', 'drink_selection_correction' For completness, the drinks array I used: { "drinks": [ "beer", "coke", "water" ] } BR  Ralph ... View more

Hi @iet_ashish, You might want to try the rest command. I never used it, but if you can call the uri  that deletes the rows with the command, you could stay in the SPL world. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Rest Let us know if it works. BR Ralph ... View more

Hi @ezmo1982 , This should do it. I had to rename user, because I needed it to have another name as the one in the lookup and i had to replace the dot in location.city and location.country with a "_", because my where did not work correct when the fields had the dot (don't know why...) | makeresults | eval user="John", location.country="France", location.city="Paris" | rename user AS search_user, location.country AS location_country, location.city AS location_city | appendcols [| inputlookup locations.csv] | where NOT (location_country==country AND user==search_user AND location_city==city) | fields user, location_country, location_city You used need the lines starting with the rename command, the 2 above them where just to make up an event with a sample dataset. Hope it works with your data. BR Ralph   ... View more

Yeah, I assumed that. But can you tell by the amount of spaces how many fields are missing? Is 1 field replaced by 1 blank (or tab?) when it's missing? It can be probably done with a RegEx, but we would need to know how many spaces are in the line if 1 field is missing. It would also be interesting, if there is a set amount of fields. Like if it is maximum 5 fields as in your examples, or if it can be more. Thanks Ralph ... View more

Hi @yogeshpunia05, Do you know how much space/blanks is between the fields when there is data and when there is not? It looks like there is 1 between the values, when there are indeed values, like: value1<1 blank>value2 So, when values are missing, how many blanks are between the other values? value1<? blanks>value3 BR Ralph ... View more

Hi @dcsteve24, Sorry, maybe it's me, but I don't understand your requirement. What is the relation between myNumber, low, high and desired value? In the table you show as final output, the desired values are not within the range of the values in "myNumber". But in the command that you provided as one of your attempts, it looks like you want to check if "myNumber" is between low and high  (where low < $myNumber$ AND high > $myNumber$") Could you please explain in other words, how you would like to come from the initial csv lookup to your final output?   Thanks  Ralph ... View more

Hi @iet_ashish , Besides the input-/outputlookup I am only aware of using REST. Check this thread for a solution. You could run it as a cron maybe. In the example they use LastUpdateTime with an exact epoch timestamp. I am not sure if you can use something like -7d. If you have to give a unix timestamp, you could calculate it on the CLI and call the command in the crontable with a variable for the timestamp. BR Ralph ... View more

Hi @snghndh, You can not import Excel files directly to Splunk as it is not really a text format. You would have to convert it to csv. Your requirements are not really clear, what do you want to achieve with the data in Splunk? What do you mean by dynamically import the data? Do you just need the summary? BR Ralph  ... View more

Hi @sphiwee, Yeah, it's hard to splunk data that's not there 🙂 So you want to detect hosts that do not send data anymore but should send, right? A common way is to use a lookup table that has all the hosts in your environment and to compare the hosts that send data with the ones from the lookup. That way you see the hosts that are not sending anymore. Or you could compare for example the hosts that sent data during the last 7 days with the ones that sent data today/yesterday. Hope that gives you a direction. BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Hi @benhooper , You mean to prevent that the inputs.conf of the tar.gz overwrites the inputs.conf of the App? The problem is with the archive itself, it should not have any inputs.conf in ./local. It should deliver its inputs.conf in the ./default directory. That way it would extract the new copy, but the app would still use the one in ./local because of conf file precedence rules. Where is the app coming from? BR Ralph ... View more

Hi @iamlucky92 , I added a file with your sample line in it to my lab. The fields and values were extracted automatically, without any regex or conf file manipulation. The automatic key value field extraction worked just fine. How is this data coming in on your side?   Could you share the props.conf that deals with it? Also an example of the whole event would be helpfull.  BR Ralph ... View more

Hi @Petri-X, 2 of many options: 1.) Create a Lookup table with 2 columns: host, deployment. In your SPL you would then add this to add the deployment: | lookup host_deployment.csv host OUTPUT deployment   2.) You could use case, I guess makes only sense if the list is rather small... | eval deployment=case(host="srv1", "Fin", host="srv15", "Jpn") The case option could be even made a bit smarter, if you extract the number of the server, and then work with ranges....but in general I would work with the 1.) option . BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Nope, just the first result. "First value for the specified field name from the first search result row." https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens BR Ralph ... View more

Hi @jip31, You have to use $result.field$ to reference fields from the search results. So, $result.host$ should work for you. BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Hi @jethrop , If it can be pretty random which events are dropped, you could work with props and transforms on the HF to drop events based on the timestamp. For example drop events with the seconds 1*, 3*, 5* and keep all with 0*,2*,4* You would just have to RegEx the seconds field and then follow the setup as documented here: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest Never did that, but it should work. Also it would be possible to do with Cribl, but adding this to the environment is maybe too much just for this use case. BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Hi @oompaloompa , join is pretty hungry, you could better use stats, e.g.: | line.message="request received" OR line.message="request completed" | stats dc(line.message) as message_count by request.id | where message_count=1 Hope it gives you an idea. BR Ralph -- Karma and/or Solution tagging appreciated. ... View more

Hi @benhooper, Hmm, ok. Is it stored in ./local within structure of the tar.gz of the app? That would be against the law 🙂 Or do you mean, the inputs.conf is still there in the filesystem, but you don't see it in the gui? BR Ralph ... View more

Hi @benhooper , My guess is, that the definitions / .conf files were stored in the ./default directory of the app and not ./local, so they were overwritten when the app was updated. BR  Ralph ... View more