If I get you right you'd like to dismiss events being generated the last five minutes before midnight every day. Would something like this do? .... earliest=-7d@d NOT (day_hour=23 AND day_minute>=55) ... View more

You should use a supported browser at first: Chrome and FF 3.6 are not supported right now. I had great problems with Chrome too, so I now use FF or IE8. ... View more

I think you then have to dig into the Custom Charting functionalities following the instructions provided here in the Developer manual. You should have to modify the X axis' label major/minor units. Please post an example if you are able to accomplish the task as this is a topic with rare examples... ... View more

I'd recommend csv or even something taking advantage of splunk's default key-value extraction, like 2011/01/27 21:34:32.432 host severity=ERROR userId=ted transaction=w4534rp234 message="..... ... ..." that way with 0 config you'd have all the fields you explicitly listed in the log. Json and XML are complex formats and dealing with them is not as straighforward as good old csv or similar ... View more

I see...then why not use a saved and scheduled search, which fires your python script when it finds new events? The script would receive a csv of the new results and save you a headache 😉 ... View more

Could you post your complete search string? ... View more

We are all very lucky that Splunk's manual is really well done 😄 ... View more

Try appending this to your search string: | sort -_time +host Which will sort in descending time order, then ascending host order ... View more

As per the original question, try to set SHOULD_LINEMERGE=false and don't specify any LINE_BREAKER, BREAK_ONLY_BEFORE, ... option. This way splunk will break events at every new line. For the messy formats: those are basically not CSV then... If you always have the two numbers as first characters of each event, like: 18776,18776,"Apple Mac OS X A.... then try setting: [osvdb_vulnerabilities] SHOULD_LINEMERGE=false LINE_BREAKER= ([\r\n]+)\d+,\d+, you might also want to play around with TIME_PREFIX and TIME_FORMAT to ensure Splunk will mark the events with the correct timestamp. ... View more

Ops, sorry, I've mispelled the property name: it is INDEXED_VALUE that you are interested in setting to false. I am modifying my answer accordingly.... Sorry for that. ... View more

Lookbehinds are not particularly performant. Why not define your regex such as: "\|(?<service_name>\w+\([^\)]+\))" thus terminating the extraction at the closing parenthesis? If else, you need a simple choice between one or more single characters, you can use a char class: [\n:] matches either a new line or a column. ... View more

Nice I was able to help. Actually those commands have different use cases. "fields" actually restricts the field extractions automatically performed by Splunk (..| fields + A B C will discard all the fields which are not A, B or C). You can use it to boost performance as there's no need to compute stats for the fields which you dismisse. "table" instead is used to show the selected fields in a tabular manner (in the "results table" panel), while the others are still hanging in the field picker (so no performance increase there). ... View more

Are you using Splunk's deployment server to manage forwarder configurations? That should be the best way to solve the issue. Otherwise, you could use props/transforms stanzas to override the sourcetype assignment at runtime. You could run a regex on the "source" field and assign a predefined sourcetype if the event matches the regex. You can find lots of details here: http://www.splunk.com/base/Documentation/latest/Admin/Advancedsourcetypeoverrides ... View more

cmeo, are you willing to index all the fields? Otherwise, you should put in props.comf [winsec_csv] REPORT-winsec = extract_winsec, instead of TRANSFORMS. ... View more

Uhm, I'd think you could add config in both ways. In the end, for search time operations, what you've configured in the manager takes precedence over what's in the other config files. This because that kind of Manager configs get stored in etc/users/username/appname/... dir which has higher priority than etc/apps/... I'd suggest you to read through this, though: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ... View more

The | in regexes has to be constrained by round brackets, otherwise it will "split" your regex in two pieces and use them as alternative matches. EXTRACT-snort_signature = (?i) plugin_id="(?:10[0-9][0-9]|11[0-2][0-9]|113[0-1])".*log="\s*(?P<snort_signature>[^,]+) The (?: creates a non-capturing subpattern. I have also noticed that your regex does not take into account the log field's ending ", so you might want to check that too. Also, basing myself on this sample line I've found elsewhere: 2010-11-18 15:46:20 OSSIM-Message: Event received: event id="0" alarm="0" type="detector" fdate="1969-12-31 19:33:30" date="2010" tzone="0" plugin_id="1001" plugin_sid="1394" src_ip="63.215.202.48" src_port="80" dst_ip="82.150.0.6" dst_port="8197" sensor="10.1.116.31" interface="eth1" protocol="TCP" asset_src="2" asset_dst="2" log="[**] [1:1394:12] SHELLCODE x86 inc ecx NOOP [**] [Classification: Executable code was detected] [Priority: 1] 11/18-15:47:00.198740 63.215.202.48:80 -> 82.150.0.6:8197" If you have not altered Splunk's automated field extraction, you would end up with a ton of fields, including plugin_id and log. Why not just alias the field "log" to "snort_signature" in props.conf? FIELDALIAS-sno_sig = log as snort_signature This would sure enhance performance, but make the aliased field available to all the plugin_id values. ... View more

Rob, EXTRACT-snort_signature is a configuration in props.conf which will not rely on transforms.conf (that would be something like REPORT-snort_signature = transforms_stanza_name). It isn't the extract search command. Thus southeringtonp's comment. Also, in regex language, [^,]+ means "everything that's not a comma": the ^ as the first char inside a character classes ([]) is a negation. ... View more

Yes it does. You can just nest the <collection> tags one into each other. <collection label="Status"> <collection label="Search activity"> <view name="search_status" /> <view name="search_detail_activity" /> <view name="search_user_activity" /> <view name="search_ui_activity" /> </collection> <collection label="Index activity"> <view name="index_status" /> .... ... View more