In testing for implementation on an enterprise Splunk implementation, I am working on my XP desktop with Splunk 4.31 installed. I have a file that is essentially a csv file but is delimited by pipes (|). I want to use props.conf and transforms.conf to extract the fields. I have everything set up, I THINK correctly, but the file simple will not index. I am getting no data. Any help appreciated! Here's the configs inputs.conf.... [default] host = MyPC [monitor://C:\Documents and Settings\c5012044\My Documents\ebqa4\ebqa4a.pipe] disabled = 0 followTail = 0 sourcetype = ebqa props.conf... [ebqa] SHOULD_LINEMERGE = false TRANSFORMS-t01 = csv1-fieldextraction NO_BINARY_CHECK = 1 pulldown_type = 1 and transforms.conf... [csv1-fieldextraction] DELIMS="|" FIELDS="TimeStamp","Start_Timestamp","Commit_Timestamp","Operation","Username","OS_Username", "Machine_Name", "SQL_Redo" Thanks in advance for your help. ... View more

I have a very chatty forwarder that I do not have access to, so cannot stop the noise. I have identified the log file that is sending millions of events an hour. I would like to use props.conf and transforms.conf to filter this log out pre-index time, but it's not working like I would expect. The log file (NOV.log) is in a deep path, but I just want to use the name and no worry about the full path. Here's my config: props.conf [source::...NOV.log} TRANSFORMS-Filter_Events = FilterNOVlog transforms.conf [FilterNOVlog] REGEX=. DEST_KEY=queue FORMAT=nullQueue Am I missing something really stupid, or shouldn't this work? Thanks in advance! Tim ... View more

We have been seeing strangeness with this command. It should show us all the clients that have contacted the deployment server. Yet, we frequently see servers missing from the list when using this command, that do show up correctly in the Deployment Monitor. Has anyone else experienced this, or can explain this? Thanks ... View more

I would like to send some events from a source to one index, and the rest to another. Can someone point me to a link that will help me accomplish this? ... View more

I am creating a criteria form for a report. When I use "text" fields, the labels work fine. But if I use radio or drop downs, the Label does not display. I wanted to post an example but can't get the Markdown to display the code not the form. But, if I use "input type="dropdown" token="myfield1" the label never displays. But if I use "input type="textbox" token="myfield2" the label works fine. Any ideas? ... View more

I want a form that will allow a user to "build" the appropriate "source" (or log file name) based on selecting various pieces of data. So the fields will be like this: Date Application Server I want to then build a string to use in the search. Trying to use eval but getting now where.... sourcetype=MySourceType | eval sourcelog=Date."-".Application."-".Server.".log" |search source=sourcelog This always returns 0 results. If I leave out the search function, the sourcelog field is populated. Once I can get this search to work, I can use it in the populatingsearch function of the form. Ideas? ... View more

I am just using some test data that I generated to try to get lookups to work. First, my log (completely manually generated and meaningless) file looks like this.... TimeDate:201108034352 USERID:100002 PRODUCTION:71 TimeDate:201105014327 USERID:100001 PRODUCTION:37 TimeDate:201112014446 USERID:100002 PRODUCTION:92 TimeDate:201107060448 USERID:100003 PRODUCTION:14 There are about 10000 lines. I've extracted the USERID: value to a field called UserID My lookup table, super simple, looks like this.... UserID,Username 100000,Elvis Presley 100001,Jim Morrison 100002,Jimi Hendrix 100003,Janis Joplin This is uploaded, and location defined in the Manager/Lookups/Lookup Table Files, and Called UserFile The Lookup is define in Manager/Lookups/Lookup Definitions, Named UserLookup, Type is filebased, and Lookup File is UserTable. Finally, under Manager/Lookups/Automatic Lookups, I created an automatic lookup named Username Lookup. The Lookup Table is UserLookup. The input field is UserID=UserID, and the output field is Username=Username. Obviously, the object here is to autolookup the Name field based on the UserID Field. But, it doesn't work. I dont' even see UserName in the field List. It's gotta be something super dumb/simple I'm missing here. Thanks in advance. ... View more

Consider log entries such as the following: 20110605.132223 CONNECT misc.data 10.10.10.2 ID=12345 20110605.132298 ADD misc.data ID=12345 20110605.132298 MOD misc.data ID=12345 20110605.132298 DISCONNECT misc.data ID=12345 So, this is a transaction, but notice that only the CONNECT event has the IP. I can't group on the ID value as it is not unique across log files. So I am using transaction to group the record based on a time range AND the ID. Now, there may be matches that include other IP addresses. This is because a transaction might be between 2 or more servers. So, post transaction, the resulting record from the search may have other IP's in it. Ultimately, the purpose of the report is to count the various transaction types (CONNECT, ADD, ETC) by IP, but I only want to include 4 specific IP's in the results. So, my chart will ultimately have only 4 IP's on it. How can I tell chart to only include the ip addresses that I specify using OR. ... View more

I have data that requires I use "transaction" to form events. I would like to filter the resulting data by a field (Source_IP) after the transaction function. But using the where function seems to have no result. source=*.log |transaction maxspan=10s maxpause=2 |where Source_IP="192.168.168.73"|chart........ The results still include all Source_IP's, not just the one in the where clause. Any ideas? ... View more