About gvmorley

gvmorley · ‎02-09-2017

Hi there, This should be possible. I have a go with your data using this in props.conf : [test-ext] TRUNCATE = 0 SHOULD_LINEMERGE = false LINE_BREAKER = (NULL) DATETIME_CONFIG = CURRENT MAX_EVENTS = 100000 REPORT-test-ext = sourcetype-test-ext You'd need to change the TRUNCATE , MAX_EVENTS and LINE_BREAKER to whatever works best for you. This was just for a quick test. Also, if you want to use the Date from your data as the Index time, then take a look at the TIME_PREFIX and TIME_FORMAT options. Then in transforms.conf : [sourcetype-test-ext] REGEX = ([^:]+):\s([^\r\n,]+) FORMAT = $1::$2 Which gives me this in Splunk: Hopefully that gets you closer to what you're looking for.

gvmorley · ‎02-09-2017

Very strange. This was the props.conf which I created to test with: [not-breaking] TRUNCATE = 0 SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?:FATAL[\s]+|ERROR[\s]+|INFO[\s]+|WARN[\s]+|DEBUG[\s]+) MAX_EVENTS = 100000 TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N Are you using something similar?

gvmorley · ‎02-08-2017

Hi, I think you may need to double-escape the backslash in your second regex. As a test, I tried this: | makeresults | eval field1="api.twitter.com" | eval field2="ABC\xyz1aul4" | regex field2!="(?i)abc\\\xyz[a-z0-9]{5}" Which worked (i.e. it returned no results). Likewise just invert the logic to see if it does match: | regex field2="(?i)abc\\\xyz[a-z0-9]{5}" See if that does it.

gvmorley · ‎02-08-2017

I'd also suggest going with the SHOULD_LINEMERGE = false and only having the capture group for the [\r\n]+ You could also do a combination of this answer, with your original approach and go for: SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)(?:FATAL[\s]+|ERROR[\s]+|INFO[\s]+|WARN[\s]+|DEBUG[\s]+) (?:) in regex is a non-capturing group, so also handy for this sort of grouping.

gvmorley · ‎02-08-2017

Hi, You could do a bit of config here to probably get you where you want to be. I had a go with your sample data. Assuming that your data is being written to a file, in my example, inputs.conf looks like this: [monitor:///path-to-folder-where-file-is] crcSalt = <SOURCE> host = index = json-test sourcetype = not-json If your is coming in via a different input, it shouldn't be a problem. In the example above I'm just setting the sourcetype to 'not-son', so that in props.conf I can do: [not-json] TRUNCATE = 0 SHOULD_LINEMERGE = false LINE_BREAKER = (},) MAX_EVENTS = 100000 TIME_PREFIX = "TimeStamp": TIME_FORMAT = %Y-%m-%dT%H:%M:%S This means that the different SequenceNumber blocks will appear as individual events, with the timestamp from that block: You could then add some of the extractions to your props.conf EXTRACT-seqnumber = "SequenceNumber": (?<seqnumber>[^,]+), EXTRACT-action = "Action": (?<action>[^,]+), EXTRACT-context = "Context": (?<context>[^,]+), EXTRACT-messages = "Messages": \[[\n\r]+(?<messages>[^]]+)\], Which would then allow you to do searches like: index=json-test | table _time seqnumber action context messages | makemv delim="," messages | sort +seqnumber Giving you a table such as: I'm not 100% if that exactly what you're looking for. But it might get you closer, or just give you a few other things to try. Oh, and if you want to strip the quotes from the values in the fields later, you could use something like rex in sed mode: | rex mode=sed field=context "s/\"([^\"]*)\"/\1/g"

gvmorley · ‎02-08-2017

Hi, Sounds like your just looking to use the rex command. So either of these depending on what format you want: | rex "product_type_(?<type>[^\s]+)" or | rex "(?<type2>product_type_[^\s]+)" Which would look like this:

gvmorley · ‎02-07-2017

Ah, I can see where you're coming from. I think in your position, I'd absolutely start with a single server set-up in one of your datacenters. Run it there as a PoC for a good few weeks with a variety of inputs. Then you'll be able to see the volumes that you're getting for your different hosts & sources, etc over time. Use the very excellent built-in Monitoring Console to drill down into this info. This will then give you a really good feel for the volume of data (intersite traffic) which you may get from similar feeds from your second datacenter. That will then allow you to weight up the value of going with Enterprise (with Distributed Search) or Light. You never know, it may be more cost effective to up the bandwidth between your DCs! Enjoy.

gvmorley · ‎02-06-2017

Hi, Using your sample data as a .csv, you can do something like this at search time: | inputlookup timetest.csv | eval newtime="000000".INT_TIME_DIM_SEQ | eval newtime=substr(newtime,-6) | eval datetime=INT_DT_DIM_SEQ." ".newtime | eval datetime=strptime(datetime,"%Y%m%d %H%M%S") | eval datetime=strftime(datetime,"%d-%m-%Y %H:%M:%S") Given that's the case, it would most likely be possible to do that extractions in props.conf [mysourcetype] EVAL-datetime = strptime(INT_DT_DIM_SEQ." ".substr("000000".INT_TIME_DIM_SEQ,-6),"%Y%m%d %H%M%S") Note, this is just at 'search time'. If your data is some sort of log file, then you could set the index time to the current time. I.e. the time that it was ingested, based on that of the Indexer. So in props.conf [mysourcetype] DATETIME_CONFIG = CURRENT Then when you write your searches and reports, you can use the new 'datetime' field to order them. Or just use: | eval _time=datetime to replace the original time with the one you want. Again, this is only at search time, it doesn't change the value for _time in the Index. I'm pretty sure this isn't exactly what you want, but maybe will do as a workaround for you?

gvmorley · ‎02-06-2017

Hi there, Have you got some samples that you could share? It would be great to see some example event and maybe a few lines from your lookup file (is this something like a .csv table). Also, how big is the lookup file (how many lines?). Maybe there's a different way to structure some of this to make it more performant for you?

gvmorley · ‎02-06-2017

Hi, Looking at the comparison page on Splunk's site (https://www.splunk.com/en_us/products/splunk-light/splunk-light-vs-splunk-enterprise.html) I'd say no. What you're describing is called 'Distributed Search' and it doesn't look like this is supported in Splunk Light. But, depending on your use-case, do you need multiple servers (Indexers & Search Heads)? Splunk is pretty performant even running as a standalone server. If you haven't already, get one installed with either the Trial or Free license and see how you get on.

gvmorley · ‎02-05-2017

Hi, Would you be able to post the XML of your dashboard? One thing to try is if you're using an inline search, you could wrap the query in the <![CDATA[]]> tag and see if that helps. So it would look like: <search> <query> <![CDATA[sourcetype=blabla... | fields - RPTMois]]> </query> </search> From my understanding, anything inside this CDATA tag is not parsed by the XML interpreter, so should be 'left alone'. See if it helps. If not, post up your Dashboard code (and also the version of Splunk that you're using) and I'm sure there's a solution. Graham.

gvmorley · ‎02-05-2017

Hi, There's probably a couple of ways to do this, depending on how you want to output to look at the end. One option is using appendpipe and stats as a replacement to addcoltotals (which is what I'm guessing you're using). Here's an example (you can ignore the makeresults and append stuff, the first 7 lines, that's just to simulate your data): | makeresults count=1 | eval bytessent=30 | eval bytesreceived=40 | eval xtime="00:15" | append [| makeresults count=1 | eval bytessent=40 | eval bytesreceived=40 | eval xtime="00:30"] | append [| makeresults count=1 | eval bytessent=50 | eval bytesreceived=50 | eval xtime="00:45"] | fields - _time | eval totalbytes=bytessent+bytesreceived | eventstats max(totalbytes) as maxbytes | appendpipe [| stats sum(bytesreceived) as bytesreceived sum(bytessent) as bytessent sum(totalbytes) as totalbytes max(maxbytes) as maxbytes] | table xtime bytesreceived bytessent totalbytes maxbytes This would give a table that looks like this: As you mentioned eventstats , it sounds like you were already 90% of the way there anyway. I hope that gets you closer to what you're looking for. Graham.

gvmorley · ‎02-04-2017

Hi, It would be great to understand why you don't want to use transaction for this? It feels like it would be well suited to the job? | where Pressure<3 | eval timedate=Date." ".Time | eval _time=strptime(timedate,"%d/%m/%Y %H:%M:%S") | transaction UID,Site maxpause=2m mvlist=t | sort +_time,Site,UID | eval start=min(timedate) | eval end=max(timedate) | eval Site=mvdedup(Site) | eval UID=mvdedup(UID) | eval duration=duration+60 | table Site UID start end Pressure duration | eval duration=tostring(duration,"duration") Which would result in a table like this: Note: As the duration field in the transaction is the elapsed time between the first and last event, you can decided if this is OK, or if you want to 'fill' it with an extra minute. For example, if you've got one pressure reading that's less than 3, was the 'duration' 0 seconds, or was it 60 seconds? It's more a preference thing on how you want to interpret your data. If anyone else has a non-transactional way, I'd be interested too.

gvmorley · ‎02-04-2017

Hi, I think what may be tripping you up here is the use of inputlookup as opposed to lookup . I would suspect that inputlookup is appending the entire lookup table to your results. As opposed to what you want to do, which is the CIDR match of c_ip to the SubNet column in your csv table. Therefore, to add the 'Location' fields to your results, you want: | lookup SubNetLocations SubNet as c_ip I've knocked up something that you could try (this just uses makeresults to create some sample data): | makeresults count=1 | eval time_taken=1000 | eval host="serverA" | eval c_ip="172.31.33.1" | append [| makeresults count=1 | eval _time=_time+1000 | eval time_taken=2000 | eval host="serverB" | eval c_ip="184.174.182.128"] | lookup SubNetLocations SubNet as c_ip | timechart max(time_taken) as IISLatency by Location The syntax in your transforms.conf is also slightly off. The match_type line needs to specify a column in your lookup table. In your example, this would be 'SubNet'. Go for this: [SubNetLocations] filename = SubNetLocations.csv min_matches = 1 match_type = CIDR(SubNet) Also, the contents of your 'MyServers' file needs more than one column. One that has something to match on from the events and then others that you want to add based on that match (like a friendly name). I hope that gets you a bit closer to what you're looking for. Graham.

gvmorley · ‎02-04-2017

Hi, Many thanks for the detailed reply. It's reassuring the see that you also saw the same inconsistency when trying the re-set the same token in the change block that was used for the input. Maybe it's by design? If any of the Splunk folks are reading, if it is, perhaps a little update in the change & condition docs to just highlight this? Your approach makes a lot of sense. Essentially, just have a 'disposable' or 'temporary' token for the the input (in your example token="unused" ). Then just set new tokens based on the value contained within it. I like it - a really good approach. Thanks for taking the time to put together your response. Graham.

gvmorley · ‎02-01-2017

As mentioned by the previous poster, the problem is a bit abstract without your specific data. But if you wanted to build yourself a simplified test, you could use the example below... If you went with this for the first set of results: | makeresults count=1 | eval a="bob" | eval b="fred" | append [| makeresults count=1 | eval a="jane" | eval b="clare"] Which returns: _time a b --------------------------- ---- ----- 2017-02-02 12:46:31.000 ICT bob fred 2017-02-02 12:46:31.000 ICT jane clare And this for the second set of results: | makeresults count=1 | eval a="bob" | eval b="ellen" | eval c="anna" Which returns: _time a b c --------------------------- --- ----- ---- 2017-02-02 12:48:08.000 ICT bob ellen anna You can then test the results of the join with: | makeresults count=1 | eval a="bob" | eval b="fred" | append [| makeresults count=1 | eval a="jane" | eval b="clare"] | join type=inner a [| makeresults count=1 | eval a="bob" | eval b="ellen" | eval c="anna"] Which results in: _time a b c --------------------------- --- ----- ---- 2017-02-02 12:50:25.000 ICT bob ellen anna The field a & b are retained from the results of the first search and field c is join, as field a is a match. If you change this to an outer join, you'll also retain the results which don't have a match. So you will get: _time a b c --------------------------- ---- ----- ---- 2017-02-02 12:51:39.000 ICT bob ellen anna 2017-02-02 12:51:39.000 ICT jane clare So for the join to work, the 'value' of the field named 'a' needs to match. If you use this code as a simplified example, you can insert your own values for the fields to make sure everything works at a basic level first. Or just post up some sample data, so that folks can in a bit more detail what the problem might be.

gvmorley · ‎02-01-2017

Don't feel like you have to do it all in one rex command. You could do: | rex "MSIAuth,.*,(?<result>SUCCESS|FAILURE)," | rex "MSIAuth,.*,FAILURE,.*,(?<failure_cause>[^,]+)," | rex "MSIAuth,.*,SUCCESS,(?<success_services>[^,]+)," You can also do some testing by using makeresults, eval & append to create your test data: | makeresults count=1 | eval text="2017-02-01T15:17:02.057Z,au:23,MSIAuth,24.27.228.162,!xxxyyy@aaa.company.com,xxxyyy,0/0/0/840,nycmny83-cr01ras01.wifi.rr.com,54-26-96-1B-54-BC,74-3E-2B-2E-16-20:CableWiFi,,,,CableWiFi,95ms,0A440002060000000BD71DFC,86400,,SUCCESS,TWCULTIMATEINTERNET300,ServiceName:ABWAUTHSVC01" | append [| makeresults count=1 | eval text="2017-02-01T15:17:01.867Z,au:16,MSIAuth,24.27.228.162,!xxxyyy@aaa.company.com,xxxyyy,0/0/0/840,nycmny83-cr01ras01.wifi.rr.com,54-26-96-1B-54-BC,,,,,CableWiFi,62ms,0A440002060000000BD71DC4,86400,,FAILURE,TWCULTIMATEINTERNET300,DeviceLimit,FAILURE -- FAILURE -- Failure response from 75.180.151.70:1812"] | rename text as _raw | rex "MSIAuth,.*,(?<result>SUCCESS|FAILURE)," | rex "MSIAuth,.*,FAILURE,.*,(?<failure_cause>[^,]+)," | rex "MSIAuth,.*,SUCCESS,(?<success_services>[^,]+)," (ignore _time in this example; this is created by makeresults. You're just testing your extractions) The rex statements in the example are fairly 'loose', but if you know your data, you can make them more specific as required.

gvmorley · ‎02-01-2017

Hi, I'm trying to understand a bit better the behaviour of 'change' and 'condition' tags when specifically used within Text Input Forms. I'm seeing some strange (to me at least) behaviour and want to understand if others had seen the same. Or if it's possibly a bug of some sort. To demonstrate the problem, I've just put together a simple Form: <form hideEdit="false"> <label>Input Text Test</label> <fieldset autoRun="true" submitButton="false"> <input type="text" token="tok_text_1" searchWhenChanged="true"> <label>Enter any text</label> <change> <condition value="bug"> <set token="tok_text_1">CHANGED</set> </condition> <condition> <set token="tok_text_2">$tok_text_1$</set> </condition> </change> </input> </fieldset> <row> <panel> <title>Token 1: $tok_text_1$ | Token 2: $tok_text_2$</title> </panel> </row> </form> I've got a couple of expectations of what should happen here when I enter text into the Input: If I enter anything other than 'bug', both tokens should be set to the text I've entered: The $tok_text_1$ is set by the input The $tok_text_2$ is set by second change condition Therefore the panel title should show the value of both tokens, which should be the text entered in the input If I enter 'bug' , then $tok_text_1$ should be changed to 'CHANGED'. $tok_text_2$ should remain either unset or with it's previous value The $tok_text_1$ is altered by the first change condition The $tok_text_2$ is undefined (if 'bug' is first work entered). Or is remains set to it's previous value if there had been previous inputs Therefore the panel title should show 'CHANGED' for the first token and either an undefined placeholder for $tok_text_2$ or it's previous value Now if I run though some scenarios of what actually happens... Load the Form, which has the URL: http://127.0.0.1:8000/en-GB/app/search/input_change_test Type 'test' into the input box and press return: This results in a title of: Token 1: test | Token 2: $tok_text_1$ If I then type 'test2' into the input box and press return: This results in a title of: Token 1: test2 | Token 2: test So what's happening here? - In step 1, it would appear that the second change condition isn't being applied to set $tok_text_2$ - In step 2, it would appear that the second change block IS being applied, but based on the PREVIOUS value of $tok_text_1$ Now let's take a new scenario. Again, reload the dashboard with the URL from above (I.e. Remove and lingering $form.xxx$ tokens from the string). Type 'bug' into the input box and press return: This results in a title of: Token 1: bug | Token 2: $tok_text_1$ Type 'bug2' into the input box and press return: This results in a title of: Token 1: bug2 | Token 2: bug So what's happening here: - In step 1 , it would appear that the first change condition isn't being applied to alter $tok_text_1$ to 'CHANGED' - In step 2, it would appear that the second change block IS being applied, but based on the PREVIOUS value of $tok_text_1$ Both are very similar. But here's another little twist... If you load the URL as: http://127.0.0.1:8000/en-GB/app/search/input_change_test?form.tok_text_1=bug This results in a title of: Token 1: CHANGED | Token 2: $tok_text_2$ Now to my question. Can anyone help me understand what's happening here? - I'm interested in knowing if this is expected behaviour? - What's the 'flow' around how these change conditions get evaluated? The closest explanation I can come up with is from the Token Usage in Dashboard section of the manuals. This suggests that 'value' isn't a available token in 'text' inputs, therefore can't be used in change conditions. 'label' and 'value' are only available in: check-box drop-down lists multiselect radio button If that's the case, then how can you reference the text that's been entered into the text input? Thanks in advance, Graham.

gvmorley · ‎11-24-2016

Hi All, I'm very pleased to say that this all appears to be resolved in version 6.5.1 Thanks to the Splunk Team.

gvmorley · ‎10-01-2016

Hi Chris. Thanks for coming back to me on this; it's good to know that it's not just me! 6.5.0 is still a great release, so will keep a lookout for the maintenance patch.

gvmorley · ‎09-27-2016

Hi Chris. Unfortunately is doesn't appear to be working. I agree with you that 'it should' be on by default and the settings in etc/apps/user-prefs/default/user-prefs.conf (shown above), suggest that it is. But it's not working for me. Happy to share configs or work with someone to investigate further. I can only guess that it's 'upgrade' (from 6.4.3) or 'Free License' (as this doesn't allow user context configuration) related.

gvmorley · ‎09-26-2016

Hi, Does anyone know how to enable the new 'Search Syntax Highlighting' and 'Compact' Assistant features when using the Free License? The Splunk Overview 6.5 App has a section which says that these can be enabled from your 'Account settings' page. Something which isn't accessible with the Free License! I've checked in: etc/apps/user-prefs/default/user-prefs.conf And these options are included: [general] search_syntax_highlighting = 1 search_assistant = compact But they don't appear to be working. I've checked in: /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf to see if the options are being disabled, but they're not. I've also tried adding the options into that file (/opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf) and restarting, but still no luck. I have also tried using both Safari (10.0) and Chrome (53.0.2785.116) to see if it was browser related, but both behave the same. This 6.5.0 install was an upgrade from 6.4.3 (already set-up using the Free License). These look like great features, so if anyone has thoughts on how to get them going, that would be great.

gvmorley · ‎08-26-2016

That's the one! Working great now. Thanks again for your support with this. I really appreciate it. I'm completely new to Python, so it's been a bit of a voyage of discovery. The final version that's working for me is: class AirTableEventHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint): if response_type == "json": output = json.loads(raw_response_output) #Print results from the first response for record in output["records"]: print_xml_stream(json.dumps(record)) offset = output["offset"] #Create the pagination loop while offset is not None: #Construct and Get the next URL next_url = response_object.url+'&offset='+offset next_response = requests.get(next_url) output = json.loads(next_response.text) #Print out results from pagination looping for record in output["records"]: print_xml_stream(json.dumps(record)) #There is no "offset" value in the last JSON response. #Need to check for its existence, otherwise get KeyError #If doesn't exist, set to None and the while loop will exit if "offset" in output: offset = output["offset"] else: offset = None else: print_xml_stream(raw_response_output)

gvmorley · ‎08-26-2016

OK, After a bit of trail and error, I needed to change: next_url = response_object.url+'?offset='+offset to: next_url = response_object.url+'&offset='+offset So replacing the '?' with '&'. It will now pull all of the records that I'm expecting (4 REST requests/iterations in total). But then doesn't run at the next polling interval. The splunkd.log has this error: 08-26-2016 09:17:05.240 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" KeyError: 'offset' So it looks like the process bombs out due to the missing 'offset' key (which is correct - it's not there in the last iteration). Therefore just need a way to exit cleanly at the end of the while loop.

gvmorley · ‎08-26-2016

Hi Damien, Thanks so much for taking a look at this for me. The logic makes sense. I had to add import requests at the top of responsehandlers.py for it to initially run. Interestingly it does 2 iterations (so pulls 200 'records'), but that's it. Looking in the splunkd.log I get: 08-26-2016 08:38:55.457 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception in thread Thread-1: 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Traceback (most recent call last): 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" File "/opt/splunk/lib/python2.7/threading.py", line 801, in __bootstrap_inner 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" self.run() 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" File "/opt/splunk/lib/python2.7/threading.py", line 754, in run 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" self.__target(*self.__args, **self.__kwargs) 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" File "/opt/splunk/etc/apps/rest_ta/bin/rest.py", line 521, in do_run 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" handle_output(r,r.text,response_type,req_args,endpoint) 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" File "/opt/splunk/etc/apps/rest_ta/bin/rest.py", line 614, in handle_output 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" RESPONSE_HANDLER_INSTANCE(response,output,type,req_args,endpoint) 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" File "/opt/splunk/etc/apps/rest_ta/bin/responsehandlers.py", line 69, in __call__ 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" for record in output["records"]: 08-26-2016 08:38:55.458 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" KeyError: 'records' So does that mean that some part of the while loop logic isn't working? Regards, Graham

Posts	86
Solutions	16
Karma Given	5
Karma Received	41
Member Since	‎10-03-2012

Online Status	Offline
Date Last Visited	‎06-08-2021 01:07 AM

Fortigate TA Config Queries

user-prefs.conf - More Undocumented Settings

Issues with the 6.x Dashboard Examples App

Change & Condition within From Text Inputs

Search Syntax Highlighting - Free License - 6.5.0

REST API Modular Input: How to implement a custom ...

Has anyone else come across unexpected behavior us...

Selfjoin - Keeping All Results

SingleValue Module Changes in 5.0

Re: Tried DELIMS, REPORT but cannot get neither wo...

Re: Why are my multi-line events getting broken in...

Re: Regex field != expression not matching

Re: Why are my multi-line events getting broken in...

Re: How do I use a regular expression to extract a...

Re: How to create a new key-value pair from variou...

Re: Is it possible to run Splunk Light with 2 inde...

Re: strptime() format based on multiple fields

Re: How to optimize my search involving calculated...

Re: Is it possible to run Splunk Light with 2 inde...

Re: Splunk strange bug with the command "Fields" a...

Re: How to calculate max of transaction from sum o...

Re: How to generate a search to calculate the dura...

Re: How can I use timechart to report IIS time_tak...

Re: Change & Condition within From Text Inputs

Re: Why is my search using join returning zero res...

Re: How to extract fields from my raw data?

Change & Condition within From Text Inputs

Re: Search Syntax Highlighting - Free License - 6....

Re: Search Syntax Highlighting - Free License - 6....

Re: Search Syntax Highlighting - Free License - 6....

Search Syntax Highlighting - Free License - 6.5.0

Re: REST API Modular Input: How to implement a cus...

Re: REST API Modular Input: How to implement a cus...

Re: REST API Modular Input: How to implement a cus...

Join the Conversation