This is the nature of the stats command. As you've seen, after a stats command, the only remaining fields are the ones you explicitly define within the stats command. There are way to get this to do what you want. Try something like: Option 1: sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, by src, dest_ip | ... This works, but if dest_ip is sometimes missing in the main events, then the events will be dropped by the stats command. So another option would be this: Option 2: sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, values(dest_ip) as dest_ip by src | ... This time, if dest_ip has multiple values, then they will be displayed as a multi-valued field. So you have to pick what works best for you. There are more options, but this should get you going. Good luck! ... View more

You could do something like this: Assuming splunk is extracting the field "firstOccurrence" with the value "2012/06/27 14:55:12", then you can add something like this to your search: ... | eval first=strptime(firstOccurrence, "%Y/%m/%d %H:%M:%S") | where relative_time(now(), "-30d")>first However, if this should be the timestamp of your events, then you should get that corrected. Having events indexed without a proper timestamp will create all kinds of issues long-term. ... View more

You have to somehow pass triggerActions=1 when the search job get's created. Otherwise, as you've seen, the search will run as normal, but without causing any of the triggered actions (like running a script, emailing, or summary indexing) to occur. Normally, this is what you want. For example, you wouldn't want to accidentally click "run" on a summary index generating search that would end up doubling up your summary index data. In the case, of sending an email though, that would be nice to be able to do. I don't know a way to do this from within the user interface, but I've done it from some python code before, here's a stripped down version that works on my system. Obviously, you'll need to update it to match your parameters. You can change "now" to any epoch time, to re-test at a specific time after tweaking the alert's logic. import splunk.auth import splunk.saved import time sessionKey = splunk.auth.getSessionKey("admin", "changeme") now = time.time() job = splunk.saved.dispatchSavedSearch("Savesearch name", sessionKey=sessionKey, namespace="App", owner="admin", triggerActions=1, now=now) The REST API docs also show an example using curl: curl -k -u admin:pass \ https://localhost:8089/servicesNS/admin/search/saved/searches/MySavedSearch/dispatch \ -d trigger_actions=1 ... View more

You can't easily call splunk web from the commandline and expect anything readable. The actual searching process is all kicked off via AJAX voodo. Nothing easily parseable like straight HTML tables.... However, splunk offers some nice features via it's REST API. Check out Intro to REST API Tutorial for a quick way to get started. For your question specifically, see "Searching" section. The example shown there uses "curl" but you should be able to translate that to work with "wget" if "curl" isn't available. curl -k -u admin:changeme -d 'search="search error | head 10"' -d "output_mode=csv" https://localhost:8089/servicesNS/admin/search/search/jobs/export Change "output_mode" to "raw", "xml", or "json" depending on your needs. ... View more

It really shouldn't matter what line Enterprise is followed by if you write a regex properly. Try: [\r\n]\s*Enterprise:\s*(?P<enterprise>[^\r\n]*)(?:[\r\n]|$) I just tested the regex with a regex tool, not splunk; so if for whatever reason the above doesn't work, try this this one instead. This option enabled the regex "multiline" mode. (?m)^\s*Enterprise:\s*(?P<enterprise>.*)$ ... View more