It looks like each key/value pair is on its own line, and the keys are separated from the values by a : . This may be a valid regex to use in transforms.conf to extract the key/value pairs together: [colon_separated_key_value] REGEX = ^(?<_KEY_1>[^:]+):\s*(?<_VAL_1>.*)$ And in props.conf : [syslog] REPORT-colon_separated_key_value = colon_separated_key_value Check out the transforms.conf and props.conf documentation for more information. ... View more

Yes, thanks! I had linked to the correct page but put props for the text instead. ... View more

In case you're changing the sourcetype to enable props/transforms, you can do the same with source stanzas in props: [source::<source name>] [<spec>] * This stanza enables properties for a given <spec>. * A props.conf file can contain multiple stanzas for any number of different <spec>. * Follow this stanza name with any number of the following attribute/value pairs, as appropriate for what you want to do. * If you do not set an attribute for a given <spec>, the default is used. <spec> can be: 1. <sourcetype>, the source type of an event. 2. host::<host>, where <host> is the host, or host-matching pattern, for an event. 3. source::<source>, where <source> is the source, or source-matching pattern, for an event. 4. rule::<rulename>, where <rulename> is a unique name of a source type classification rule. 5. delayedrule::<rulename>, where <rulename> is a unique name of a delayed source type classification rule. These are only considered as a last resort before generating a new source type based on the source seen. ... View more

If you can get by with creating dummy data on this instance, try this to see what makes it to your summary index: | makeresults | eval [| makeresults count=150 | streamstats count | eval field="field".count, value="value".count | eval set_it=field."=\"".value."\"" | table set_it | mvcombine set_it | eval search=" ".mvjoin(set_it, ", ")] | collect index=<your summary index> ... View more

Actually, I'm not sure that's working as you expect. Try this: | makeresults | eval duration=3601 | eval myMin = strftime(duration,"%M:%S") Considering the format string one would probably expect (or at least hope) that the result would be 60:01 , yet it is 00:01 . I believe that strftime is just handling duration as if it were an epoch time, and therefore will only work if your duration isn't longer than your format string can handle without overflow. ... View more

My previous answer did not address the actual issue you're seeing. What you're running into is that your original data has the fields referenced by your description, but your correlation search results did not. Your notable event description needs to only reference fields returned by your correlation search. This may be as simple as adding a BY clause to your tstats search command, assuming your correlation search uses tstats . For further guidance you might want to post your correlation search and your notable event's drilldown search. ... View more

Can you include an event (or more) from source="SD_CallData2016.csv" host="DRN" index="drn" sourcetype="csv" ? ... View more

Great points that need to be considered. ... View more

Look into what you can do with streamstats . As an example: <your search> | streamstats current=false last(device_time) AS last_device_time BY session_id | eval time_diff=device_time-last_device_time ... View more

Does the indexed data show up as having sourcetype f5:bigip:syslog ? Have you tried searching in verbose mode to confirm that none of the fields are being parsed as expected? ... View more

I forced a permissions issue with a file such that the Splunk user had read, not write permissions to a file that was configured as a batch input. It resulted in this line in splunkd.log : 11-24-2017 22:49:10.062 +0000 ERROR TailReader - Unable to remove sinkhole file: path=/tmp/batch_del_fail.log, errno=Operation not permitted Can you look for a similar message to verify if it is a simple permissions issue? ... View more

Have you tried adding | fields * in the search prior to | collect ? ... View more

Since you were able to correct the issue, would you mind posting the answer and accepting it so that others can easily find the solution? ... View more

Variable substitution for the notable title only occurs (by default) on the builtin ES views. If you want to have the event itself show the substituted values you would have to add that functionality elsewhere. One potential solution is detailed here: https://answers.splunk.com/answers/544388/how-to-get-or-generate-splunk-es-notable-event-tit.html There are other solutions as well, but I can't find references to them right now. ... View more

You could just move the macro to the TA. It's perfectly reasonable to have a visualization app require knowledge objects from a separate TA. ... View more

Splunk can't filter (at index time) based on any kind of state (for monitor inputs). It can filter by regex of each individual event. What you are looking for can't be done at index time by Splunk natively. If you are willing to add complexity to your input method in order to accomplish this you can look into modular inputs. That would allow you to write code that can dedup events before passing them to Splunk to index. ... View more

Do you see any TRANSFORM- entries in the sourcetype for this input in props.conf? ... View more

Can you post the output of bin/splunk btool transforms list and bin/splunk btool props list ? I'm wondering if there is some NULLQUEUE filtering in place that you weren't aware of or forgot about. ... View more

I think this is expected behavior. Splunk will definitely allow you to have knowledge objects with the same name in different apps, and cloning a knowledge object is probably attempting to do so within the same app, which is probably why it prompts you of the issue. ... View more

Can you have your python script write to a text file, so you can see what the script does versus what Splunk does? ... View more