I am extracting a field "ipaddr" which is the result of using "eval" to convert a previously extracted field "nwclient_ip_hex" (IP address in hexadecimal, for example "a0b0c0d0") to decimal. The snippet below works fine in the Search app. How can I save "ipaddr" as a field so that other users of the app will be able to use it without needing all of that logic in the search bar? ... |eval d1 = tonumber(substr(nwclient_ip_hex,1,2),16) |eval d2 = tonumber(substr(nwclient_ip_hex,3,2),16) |eval d3 = tonumber(substr(nwclient_ip_hex,5,2),16) |eval d4 = tonumber(substr(nwclient_ip_hex,7,2),16) |eval ipaddr = d1+"."+d2+"."+d3+"."+d4 Thanks - Andy ... View more

Hi, I am trying to index some processing data from Urchin and having trouble with timestamp recognition and line breaking. I would be happy for each file to be treated as a single event with a timestamp based on the second line of each file, or the file date (local, preferred) or filename (UTC - would need to be converted to local), so that is the direction I've been heading. However, I'm winding up with multiple events. sample file - /opt/urchin6/data/history/%28NONE%29/splunktest/20110915_134600.log (file date 2011-09-15 09:47 ) ------------------------------------------------------ Urchin 6.5.00 (linux2.6_kernel) starting: 20110915 09:46:34 ------------------------------------------------------ Processing profile: Winter (on urchin1 6404) [09:46:37] Logfile: /opt/urchin/remote-logs/web0/urchin_log-20110914 data lines: 904129 (100%) data hits: 342 data proc: 391.39 MB in 00:00:14 (27.956 MB/sec) data range: 2011-09-14 03:33 (-0400) - 2011-09-14 23:39 (-0400) [09:46:51] Post processing data for 201109 sessions: 623 (100%) [09:46:52] Backing up database files for 201109: /opt/urchin6/data/reports/%28NONE%29/Winter/201109-backupv6-20110915051652.zip [09:46:52] Removing outdated backup for 201109: /opt/urchin6/data/reports/%28NONE%29/Winter/201109-backupv6-20110913051816.zip ------------------------------------------------------ Urchin 6.5.00 (linux2.6_kernel) finishing: 20110915 09:46:52 ------------------------------------------------------ inputs.conf: [monitor:///opt/urchin6/data/history] disabled=false sourcetype = urchin_history props.conf: [urchin_history] LINE_BREAKER = (?!) SHOULD_LINEMERGE = true TRUNCATE = 0 This gets indexed as five events with times at 9/14 9:46:51 (1 event), 9/15 9:46:34 (1 event), 9/15 9:46:52 (2), and 9/15 9:47:10 (1 - index time, I think.) When put together with a "| transaction source", the events are out of sequence. Thanks in advance, Andy ... View more