I've seen something that looks similar to this. Are you using LDAP authentication and do you have referrals enabled? It seems to be working properly with this disabled (in this case, referrals are not required). ... View more

Because if you could get files with the header, you could use: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime ... View more

dswanson, create a field which extracts "server 1" or "server 2", then use that in the first section of the transaction command ... View more

Can you get the logs as files, with the headers, instead of syslog streamed? ... View more

Hi, The best approach is to specify a size for warm, and have a max bucket count in excess of what you would expect, so that the volume limit takes effect. You can do this in two ways: Set the homePath.maxDataSizeMB for the index homePath.maxDataSizeMB = * Limits the size of the hot/warm DB to the maximum specified size, in MB. * If this size is exceeded, Splunk will move buckets with the oldest value of latest time (for a given bucket) into the cold DB until the DB is below the maximum size. * If this attribute is missing or set to 0, Splunk will not constrain size of the hot/warm DB. * Defaults to 0. Set up a volume, and use that for hot. # volume definitions; prefixed with "volume:" [volume:hot1] path = /mnt/fast_disk maxVolumeDataSizeMB = 100000 [volume:cold1] path = /mnt/big_disk # maxVolumeDataSizeMB not specified: no data size limitation on top of the existing ones [volume:cold2] path = /mnt/big_disk2 maxVolumeDataSizeMB = 1000000 # index definitions [idx1] homePath = volume:hot1/idx1 coldPath = volume:cold1/idx1 Buckets are not guaranteed to reach their maximum size; they can roll over 'early' for a number of reasons. I'd slightly prefer the second option, as it's easier if you have multiple indexes. Duncan ... View more

Try: source="udp:514" ((BGP_NEIGHBOR_STATE_CHANGED ("Established to Idle" OR "Established to Active" OR "Established to OpenConfirm") OR (BGP-5-ADJCHANGE Down)) | rex field=_raw "neighbor (?<neighbor>.*)" | table neighbor | dedup neighbor | stats count as BGP_DOWN | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe ... View more

I mean in the same place the data of the event is sent, not as extra parameters ... View more

The reason for the second one is that Splunk uses PCRE internally to implement the filters. The log message reflects the regex as used internally. ... View more

I think that is the same solution. ... View more

You can generate a lookup table which contains the hosts which you have seen Windows data for in the past. This search will merge them into a lookup, so you could schedule it to run each day or another appropriate time period. sourcetype=windowsupdate OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:System" | stats count by host | eval isWinHost=1 | fields host isWinHost | inputlookup append=T windows_hosts.csv | outputlookup windows_hosts.csv You can then use this lookup table to check if a host is a Windows host, or you can get a list of all Windows hosts by using the inputlookup command. ... View more

You could use log4j to send data to Splunk over TCP, or you could use the REST API to write data to Splunk. See the receivers endpoint documentation See also the Splunk Java SDK ... View more

You can add fields in the data in key=value pairs and they will be extracted automatically. See also the docs on the receivers endpoint ... View more

You also can't do this via the simple XML. You can convert your dashboard to the advanced XML, and then change the layoutPanel attributes to place them in groups. In the example below, 4 charts are in the 1st panel, using layoutPanel like so: layoutPanel="panel_row1_col1_grp1" <view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html"> <label>test</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="DashboardTitleBar" layoutPanel="viewHeader"/> <module name="Message" layoutPanel="navigationHeader"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> <param name="level">warn</param> </module> <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1_grp1" group="test" autoRun="True"> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <param name="groupLabel">test</param> <module name="ViewstateAdapter"> <param name="suppressionList"/> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">10</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <param name="entityName">results</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1_grp2" group="test" autoRun="True"> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <param name="groupLabel">test</param> <module name="ViewstateAdapter"> <param name="suppressionList"/> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">10</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <param name="entityName">results</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1_grp3" group="test" autoRun="True"> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <param name="groupLabel">test</param> <module name="ViewstateAdapter"> <param name="suppressionList"/> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">10</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <param name="entityName">results</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1_grp4" group="test" autoRun="True"> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <param name="groupLabel">test</param> <module name="ViewstateAdapter"> <param name="suppressionList"/> <param name="savedSearch">Admin - Recent Timestamping Issues</param> <module name="HiddenFieldPicker"> <param name="strictMode">True</param> <module name="JobProgressIndicator"/> <module name="Paginator"> <param name="count">10</param> <param name="entityName">results</param> <module name="EnablePreview"> <param name="enable">True</param> <param name="display">False</param> <module name="SimpleResultsTable"> <param name="drilldown">row</param> <param name="entityName">results</param> <param name="allowTransformedFieldSelect">True</param> <module name="Gimp"/> <module name="ConvertToDrilldownSearch"> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> </module> </module> </view> ... View more

Check out the SideView Utils application, which provides an HTML module, which sound like it would be just the trick. ... View more

Is this a multi-line log? If it is, check out the documentation on multi-line events. ... View more

This is possible: import splunk.client as client service = client.connect(**{'username':'admin','password':'changeme'}) service.parse('search index=*', parse_only=True) job = service.jobs.create('search index=*',**{'timeout':'123456'}) ... View more

When using LINE_BREAKER you have a regular expression in up to three parts: LINE_BREAKER = the previous event end (the data between events) the new event here That is to say only the part in the capturing group is removed. So to break only on newlines followed by digits as per your pattern: LINE_BREAKER = ([\r\n]+).\d{7}.\d\d:\d\d:\d\d.\d\d This seems to cause some confusion, but using LINE_BREAKER (with SHOULD_LINEMERGE = false ) is my preferred method as it only requires remembering one thing, and covers most cases in a quick and simple way. ... View more

Hi krusty, You can use startswith and endswith on your transaction to ensure the transactions get closed: | transaction Handle_ID Process_ID startswith="EventCode=560" endswith="EventCode=562" | see also the docs on transaction ... View more

That all looks correct. You may want to ensure you set to index and forward in outputs.conf [default] indexAndForward=true See more examples at the splunk documentation ... View more

There is an endpoint in 4.2 for storing credentials, which the SDEE app will likely be updated to use. See this other question ... View more

Can you clarify your question, perhaps with an example set of data? Transaction does add a linecount property, which you might be able to use to determine the number of unique link events, possibly in conjunction with the dedup operator. ... View more