What is the search you are running? What happens when you run it manually (what does it return)? ... View more

Unfortunately I cannot see the screenshot... check my updated example before, realized I forgot to add (?m) at the start to specify multiline events palmface ... View more

Could you be a little more clear in what you are seeing, what do you mean you are including everything after the values? if the event you are inspecting is a true multiline event then you should have no issue with using that field extraction inside your props.conf ... you could also be a little more specific like so: EXTRACT-fieldname = (?im).*Trap\sType:\s(?<fieldname>.+) Your regex should match everything until the end of the line, so if anything else is being picked up thats why I ask if it's a true multiline event you're inspecting. ... View more

Typically no, but there have been SplunkLive's that have been broadcasted before on the splunk tv site www.splunk.tv ... it would definitely be awesome if all were broadcasted! Shoot Splunk an email and make that suggestion. ... View more

Definitely support using the Deployment Monitor ... I've also written a short blog post where I extracted a lot of the queries so you can individually schedule or run them and alert as needed... see it here: http://www.joshd.ca/content/splunk-usage-statistic-searches ... View more

I've listed some searches on my blog to show the license breakdown by source, sourcetype, host, per index statistics and so on... I would start with running these various searches to narrow down where the actual culprit is... http://www.joshd.ca/content/splunk-usage-statistic-searches I would also suggest downloading and using the Splunk Deployment Monitor app as it can provide a wealth of information: http://splunk-base.splunk.com/apps/22301/splunk-deployment-monitor ... View more

Great to hear! That's why I wanted to post all the searches so they can independantly be used as alerts... Glad to hear it'll meet your needs! Remember to accept the answer posted so no questions are left in limbo as unanswered 🙂 ... View more

Can you edit your post, highlight the search string you have above and click the code button on the menu bar so that it pastes properly and does not apply automatic formatting. ... View more

I assume you are editing the file directly? did you refresh after making the changes? here's a related post: http://splunk-base.splunk.com/answers/8696/how-ro-reload-global-savedsearches You could also force a refresh on all splunkd resources (use with caution!) by accessing this URL: https://yourhost:8000/en-US/debug/refresh ... View more

Sorry I dont quite understand... are you confirming the field is being extracted even if it's blank or NULL? If you do just a regular search for null values it returns events? for example: * | where isnull(AV_Version) ... View more

And you are sure the AV_Version field is being extracted and appears in the events even if it's NULL or blank? For len you would just do ... | eval Severity=if(len(AV_Version)==0,"Informational",AV_Version) ... View more

That or you can use the if and isnull combination mentioned ... or you can go as far as to use len() to check the string length, if it's 0 then you know its empty 🙂 ... View more

Are you looking for the word NULL in AV_Version or just blank values? If you want to use case then you're missing a couple things... this should work.. eval Severity=case(AV_Version == "NULL", "Informational", AV_Version == "", "Informational") You can also look at using the isnull() and if() functions... eval Severity=if(isnull(AV_Version),"Informational",AV_Version) ... View more

Command reference can be found here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands Functions for eval and where are here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions Remember to vote the answer as correct, dont want to leave things lingering as unanswered 🙂 ... View more

Agree with you totally! I actually read your question wrong initially and thought you had commas where you wanted periods, hence why I immediately recommended the replace command then revised the usage of it, dwaddle beat me to the punch with sed, figured Id leave mine as an option anyhow 🙂 You also dont have to create a new field you can do: eval DEL_JOBS=replace(DEL_JOBS, ",","") ... View more

why not use replace on every occurrence of a comma then perform your calculations on the new field? ie. | eval amount=replace(DEL_JOBS, ",", "") ... View more

This error typically appears when the dashboard cannot find or access the saved search. Check the permissions on the saved search to make sure the dashboard can correctly find and access it. ... View more

I ran into this problem as well but with jboss access logs due to the logs automatically being rotated and a timestamp added to the file. I just decided to "live with it" since the webintelligence app is still in beta... but I finally got some time to sit and think about this now and I dont know how I missed such an easy solution to this... on your forwarder (presuming you're using one to move the log data to the indexer) just specify a custom source for the input. such as: source=srvexchange then you only need one entry in the sourcenames.csv I know you lose a bit of the mapping back to the original source but really that shouldnt matter. It's been a simple life saver for me and working great for me thus! ... View more

There's a very good article on understanding/configuring auditing in oracle found here: http://docs.oracle.com/cd/B28359_01/network.111/b28531/auditing.htm#autoId8 Using that you can configure oracle to audit the events you want, wether it be to a local file, database table, etc... As I had previously mentioned there are two ways I've used for doing it, either log to a local file using the "OS" AUDIT_TRAIL value and pickup the events using a universal forwarder on the machine or you can configure the "DB,EXTENDED" value for AUDIT_TRAIL which will cause it to log to the SYS.AUD$ table. Then you would need to write a script that will connect to the database as a user and dump out the contents of the SYS.AUD$ table and then implement this script as a scripted input running every X-mins. As also previously mentioned depending on the load on your database, etc.. one option may be better over the other for you. ... View more