I've got a pretty strange issue, and I'm sure there is a simple answer for it. Here is my env: 7.1.2 All default configs, but the inputs.conf which contains [monitor:///Users/MYUSER/splunk_messages] index = test sourcetype = json When I update the splunk_messages file with the following JSON, it's cutting it off right before "created": { "Data": { "id": "-LGDT2S8qYVIJvqoLJwC", "created": "2018-06-30T02:14:18Z", "expires": "2018-07-01T02:14:18Z", "status": "WAITING", "completed": 0, "reason": "NONE" } } The result is There are no other events after or before this event. It's not like it's splitting the event. I then remove "created" key and value and the full JSON event shows: Does anyone know what could be causing this? I've been looking through the default conf files and can't find anything to cause this. Maybe it's a default behavior of splunk and I'm not seeing it in the docs. Thanks! ... View more

Howdy, I want to monitor NFS wire data using the stream app. Right now, I can enable NFS on the search head and it does obtain NFS for that specific server, as well as every other server I use NFS on. I don't want this. I want to limit what servers actually send their NFS, FTP, and whatever else to the indexers. I'm seeing this may be possible in the streamfwd.xml, but I'm not comprehending the documentation for that file properly as everything I try is not working. There are not enough examples in the documentation.... Can someone point me to the right configuration to use? I wonder is the inputs.conf can be used here... Edit: I'm wondering now if it's actually a matter of disabling everything but what I want on all hosts in the network that use the stream app. I can puppetize this, but I'll wait to hear back from someone here about how best to achieve this. ... View more

Hola, To avoid filling up our license, I'd like to find the total amount of data being indexed from the forwarders for a 24 hour period. I'm new to my environment, splunk, and was not sure where to start. Anyone got any suggestions? ... View more

Greetings, I'm receiving XML files and noticed that the first half (around 257 lines) is a single event, but everything after that is a separate event. Reading the documentation, I see mention of modifying the props.conf to fix this. So, I've decided to use the following: [source::elemental_job] SHOULD_LINEMERGE = true MAX_EVENTS = 2000 BREAK_ONLY_BEFORE = ^(<command) MUST_NOT_BREAK_BEFORE = ^(</command) However, this does not work. It seems to have no effect actually. Can someone tell me what I'm doing wrong? ... View more

I'm trying to append xmlkv results to my original search string. Here is what I've tried, and what is not working. index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval XML_SRC=("/opt/elemental_se/web/log/*/job_"+JobID+"/*_emecmd.xml") | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at) | fieldformat completed_at=strftime(completed_at,"%H:%M:%S") | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at | eval JobLength=strftime(TimeDiff, "%M:%S") | append [ search source=XML_SRC "<command value='job'>" | xmlkv ] Is the XML_SRC going to work in a subsearch like that? Any suggestions on how to achieve this? If anything, I'd like to obtain just one result of the xmlkv in the subsearch. It's named file_size. But there is a bunch more I'd like to eventually include, so I figured just bringing it all in as extra fields would be best. ... View more

Search Head: V6.2 Goal: Obtain XML data from URL, which is dynamically created with IDs set in search string. Search string: index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id I want to then create and, from what I've read, use urldecode & xmlkv : index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval _raw=urldecode("http://kemgr-ch2-a1p.domain.com/jobs/"+JobID+".xml") | xmlkv I should then be able to rex this and get some sort of result into file_size field: index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval _raw=urldecode("http://kemgr-ch2-a1p.domain.com/jobs/"+JobID+".xml") | xmlkv | rex field=_raw "(?<file_size>\d+)" This produces the field file_size, but it's "2" for everything, regardless of the actual number/file_size in the xml doc. I don't think I'm doing something right... Can someone point me into obtaining the value in the URL's XML? Here is an example of the XML: <general> <duration>30mn 4s</duration> <format>MPEG-TS</format> <id>2 (0x2)</id> <overall_bit_rate>3 750 Kbps</overall_bit_rate> <file_size>807 MiB</file_size> <overall_bit_rate_mode>Constant</overall_bit_rate_mode> </general> Thanks in advance! ... View more

Hi all, I'm new to splunk but have been thrown into a project and need to figure things out on my own. I'm using DBConnect app, dbmon-tail, and am placing the results into an index named content_eng. When I setup the dbmon-tail, it works when I leave default/blank for the index. What possibilities could cause it not to work with content_eng? It would seem like a permissions issue, just not sure. I've gone into Access controls » Roles and made sure the dbx user has all capabilities (to test, not perm), but that hasn't helped. The index content_eng does exist on the indexers directly. ... View more