Yes, if that's the only reason, please prefer using the search time and if you are able to solve the issue using my solution. Please mark the answer as accepted 🙂 ... View more

to be precise, [general] serverName = ... View more

Could you please check serverName config in server.conf file under $SH/etc/system/local and if not updated with your PC name and change it and restart Splunk and try connecting with http://MyPcName:8001 ... View more

Why are you looking to change at index time ? Anyway, you have 2 options to replace Y with new value 1) using the Ingest-eval in transforms.conf props.conf [my_sourcetype] TRANSFORMS-y = change_y transforms.conf [change_y] INGEST_EVAL = y=if(x LIKE "%foo%","YY",'y') But using this will override the other settings that you might have defined for this sourcetype at index time like REGEX,FORMAT..etc. Please refer https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Transformsconf#transforms.conf.spec 2) Using the REGEX and FORMAT in transforms.conf to modify the _raw data itself props.conf [my_sourcetype] TRANSFORMS-y = change_xy transforms.conf [change_xy] REGEX = (x.*foo\s+)y.* DEST_KEY = _raw FORMAT = $1ynew_value Please write REGEX to match your X with value XX , this will match event with X having XX and replace with X and with the newvalue that you update in FORMAT If you are considering to update the Y value at search time, please update your props.conf as below, [my_sourcetype] ... <your props configs> .... EVAL-Y = if(x LIKE "%XX%","YY",'Y') ... View more

Could you check if you are able to ping local host ? ping localhost And check if your loopback address is getting accessed with the local host name ? nslookup 127.0.0.1 ? ... View more

Hi @jibin1988 could you please be more specific, what exactly is not getting parsed? Is it line breaking? time stamp or field extractions? Also please provide some sample events for us to check and identify the issue ... View more

Hi, You could write the regex to match the field values to capture the commands in your newly extracted field. See below, | makeresults | eval commands="vi,cd,hello,world" | makemv delim="," commands | mvexpand commands | rex field=commands "(?<abc>.*)" | eval contains_command=if(match(abc,"vi|cd"),"Yes","No") Here I have extracted field abc from field commands and then I used eval and simple regex using match function to identify the commands in field abc If it's there then I will see result as yes and no respectively. ... View more

Did you mean to say you need to break event every time it finds `2019-11-12T09:51:28.291 ' in your log file? Is that time stamp going to be constant or that is going to change? And also as I understand, you need to pick the local timestamp of indexer as _time not the time in event? Please confirm? Also, we appreciate , if you could provide some more sample data ... View more

Please try below config in your props.conf [ your_sourcetype] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true BREAK_ONLY_BEFORE_DATE=true TIME_PREFIX=^\( TIME_FORMAT=%Y-%m-%d%t%H:%M:%S.%3N I see that it's breaking as you are expected ... View more

Hi, Using HF in your current setup depends, how much data you are indexing per day? your budget HF will reduce performing impact on Indexers , it helps you to parse,filter, can index locally and with many other benefits. Please refer the documentation https://docs.splunk.com/Documentation/Splunk/8.0.0/Forwarding/Typesofforwarders If you need all these benefits then you should consider having HFs in your environment ... View more

Hi, First, you create a CSV file with the host names and IPs' Then, go to settings and create a lookup file and upload the CSV file. Next, you could use that lookup file to create a lookup definition or automatic lookup. https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Create_a_CSV_lookup_definition For creating automatic lookup https://docs.splunk.com/Documentation/Splunk/8.0.0/Knowledge/DefineanautomaticlookupinSplunkWeb Cheers, Sanjeev ... View more

You can try this way [monitor:///tmp/*.log] blacklist = abc.log ... View more

Hi @Inayath_khan are you talking about the scheduled search or just searched you saved as report/alert ? Try searching in $SPLUNK_HOME/etc/users/<user Name>/<app>/local/savedsearches.conf ... View more

If you just want to list all the fields getting extracted, then you can use the fieldsummary command https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Fieldsummary Or if the question is to expand the event view please refer below URL https://answers.splunk.com/answers/559/how-do-you-tweak-splunk-to-display-an-event-that-is-more-than-500-lines-long.html ... View more

I agree with @maciep , if you still want to move to other index at the index time, please check if you can do it by using sourcetype For example: props.conf [WinEventLog:Security] TRANSFORMS-winevent_dmz = set_index_winevent_dmz transforms.conf [set_index_winevent_dmz] SOURCE_KEY = MetaData:Host REGEX = (WINSERVER01|WINSERVER02|WINSERVER03....) DEST_KEY = _Metadata:Index FORMAT = winevent_dmz ... View more

For me it did work, however there is otherway | tstats latest(_time) as l earliest(_time) as e where index=* host IN (x,y,z,a,.......) by host | eval diff=now()-l | eval diff_in_days = round(diff/86400,2) | convert ctime(l) as lasttime ctime(e) as first | where diff_in_days>1 place the host names from your CSV the above query for host IN by separating them with , ... View more

@walia_sapient Could you please give the error message ? ... View more

You don't have to unistall old version for UF upgradation, you can install new version on top of the old version. You can download the new version and doubleclick it, it will install new version and installation log will be updated in C:\TEMP If you wish to do it using cmd line, msiexec.exe /i <path to downloaded file>\splunkforwarder-7.3.1-bd63e13aa157-x64-release.msi Example: msiexec.exe /i C:\Users\test\Desktop\splunkforwarder-7.3.1-bd63e13aa157-x64-release.msi ... View more

Please try below query | tstats latest(_time) as l earliest(_time) as e where index=* [| inputlookup x.csv | rename hostname as host | table host] by host | eval diff=now()-l | eval diff_in_days = round(diff/86400,2) | convert ctime(l) as lasttime ctime(e) as first | where diff_in_days>1 ... View more

You could check the directory size on the syslog-ng server, your /etc/syslog-ng/syslog-ng.conf will tell you where you are storing the incoming syslog data. du -h <directory> will provide you the size of directory in typical linux environment. ... View more