I inserted a search command in a splunk search app as follows : sourcetype="sexuality" | replace "Yan Yi" with jtyi in partner. The partner field value did change but when i refresh and view the search results i saw that the new value did not replace the old value for the partner field. How do i make sure that the field value is being replaced permanently each time i do this? ... View more

For the search app, I want to modify a field called "partner" (new field added when data is sent to Splunk in receivers endpoint) with a value of "Yan Yi" and replace the "partner" field value to "muktar". I put in this search command in the search app, sourcetype = " sexuality" | replace Yan Yi with muktar in partner The search app threw an error : [EventsViewer module] Error in 'replace' command : Usage replace[orig_str WITH new_str] + [IN field1,field2,..] What is the issue with this? Is there any way i could correact the syntax of the search command?? ... View more

I added events through Splunk's REST API and i added new fields to the new events that i added to Splunk. Then i search the added events and retrieved the new events added. When i retrieved the new events added from the search app, i realised that in the xml format there are no new xml tags for the new fields. When i added the new events to splunk, i formatted the new field=value pairs in the log message, Splunk created new fields after i added them through the REST API. But however i retrieved those new eventsm as an xml, i saw the new field value pairs present within the "_raw" xml tags. Why is that so? How to ensure that there are new field tags are created whenever i retrieve the new fields during search? ... View more

Since fields in Splunk are generally not set at index-time, except for a few key values like source, sourcetype, _raw and index. Lets say i extracted other fields at search time and set the values for the fields and then send back to Splunk. I realised that i cannot set the values for linecount, index , splunk_server etc while i can set the other fields when i want to add events to Splunk server. That means the values for linecount, index, splunk_server fields values cannot be set although i retrieve those fields at search time. Is that true? ... View more

How do i format a log message with a timestamp so that when i send the log message to the splunk server i am able to see the timestamp when i open up the search app. ... View more

I put the key value pairs of the log message into the content body whenever i create new events throught the splunk's receiver endpoint, so that i can see new fields being added. hater = yes, nothater = suck, splunk_server=L33603 splunk_server field was retrieved during serach and i set the value to it. When i sent the data for indexing, the new fields are created but the value of the splunk_server field wasn't the value that i set. ... View more

I set the key=value pairs into the body of the REST HTTP request directly using Java REST SDK API. Example : RequestMessage reqMsg = new RequestMessage(); reqMsg.setMethod("post"); reqMsg.getHeader().put("x-splunk-input-mode", "streaming"); reqMsg.setContent("hater = yes, nothater = no"); Then i send the message to the simple reciever rest endpoint. String path = "/services/receivers/simple?host=localhost&index=main&source=addfields&sourcetype=addedfields"; ResponseMessage resMsg = authService.send(path,reqMsg); Then, When i opened the search app to see the added data, i saw both the new fields and the raw data which is the key=value pairs that i set directly added. I only want to see the added key=value pairs below the raw data, not together with the raw data. When i tried adding the raw data and the key=value pairs to the content body of rest http request like this using java rest sdk api, reqMsg.setContent("rawdata1 - hater = yes, nothater = no"); i see this added on the search app. rawdata1 - hater = yes, nothater = no (for the added raw data value) the new fields hater and nohater are added below the raw field. I just want the rawdata1 as the raw data value. Has it to be done using Java logging framework if i'm using java. ... View more

I opened up the splunk search app and added this splunk search command : sourcetype="addedfields" wrap | delete The event is retrieved but cannot delete. I saw this error message thrown : Error in 'delete' command: You have insufficient privileges to delete events. How do i resolve this?? so that i can delete the search events. ... View more