@jpsnlyle, when you install splunk the wizard guides you through all the steps neccessary to run splunk properly. There you also set your initial Splunk admin password. The Username is: admin The Password is: <whateveryouchoose> After the installation you are able to access splunk via your browser. Use the following URL: http://localhost:8000 or https://localhost:8000 This should work fine. ... View more

How about this wonderful regex that only has 80 steps compared to 800,000 (I kid you not) steps from @woodcock 's solution. SEDCMD-strip_non_JSON_ending = s/^.+?\{(.+)}"$/\1/g ... View more

Hey @ashutoshab , which Splunk version are you using? Also can you post the specific stanza from the savedsearches.conf ... View more

Thank you @niketnilay for that in-depth explanation. 🙂 🙂 ... View more

Thank you very much @vnravikumar ... View more

@DEAD_BEEF, I don't want to discourage you from getting your answer, but for answers that are that far back it most likely is better to just ask a new question as to try to restart the conversation. It can also help to use @ in front of the username to notify the user that he or she was mentioned by someone somewhere on this site. @nnmiller Regards, pyro_wood ... View more

@zacksoft, I agree that it looks complicated at first and I'm glad that it works out for you. But it's not so complicated. I will explain to you why it isn't as complicated as it might look. ^ this is called an anchor, and points to the start of the line (will always be there) \d{4}-\d{2}-\d{2}\s*\d{2}:\d{2}:\d{2},\d+\s* this traverses over the date and timefields (will always be there) (?:\b(?:ACDT|ACST|ACT|ACWST...|BOT|...|WST|YAKT|YEKT)\b\s*)? this will look for a valid timezone abbreviation. A list of all valid timezone abbreviations I found on the web. It basically is a OR -list. If it doesn't find ACDT, it will look if it finds ACST, if not it looks if it finds ACT and so on. The very last ? question mark makes the entire statement that is encased in paranteshis optional. It means, that the timezone might be there or not. (optional) (?<level>\w+) regardless of the existence of the optional timezone field, the field that matches your text comes afterwards (will always be there) You might have notice the \b in the regex. \b marks a word-boundary. Long story short it makes sure that the timezone matching instruction doesn't match words like for example "ACTION", "BOTTOM", "PETS", "PHOTO" or "WESTWARDS". Hope this helps a bit. Regards, pyro_wood ... View more

Hi @zacksoft, try this one and tell me if it works. index=DEMO host=anything sourcetype=something | rex "^\d{4}-\d{2}-\d{2}\s*\d{2}:\d{2}:\d{2},\d+\s(?:\b(?:ACDT|ACST|ACT|ACT|ACWST|ADT|AEDT|AEST|AFT|AKDT|AKST|AMST|AMT|AMT|ART|AST|AST|AWST|AZOST|AZOT|AZT|BDT|BIOT|BIT|BOT|BRST|BRT|BST|BST|BST|BTT|CAT|CCT|CDT|CDT|CEST|CET|CHADT|CHAST|CHOT|CHOST|CHST|CHUT|CIST|CIT|CKT|CLST|CLT|COST|COT|CST|CST|CST|CT|CVT|CWST|CXT|DAVT|DDUT|DFT|EASST|EAST|EAT|ECT|ECT|EDT|EEST|EET|EGST|EGT|EIT|EST|FET|FJT|FKST|FKT|FNT|GALT|GAMT|GET|GFT|GILT|GIT|GMT|GST|GST|GYT|HDT|HAEC|HST|HKT|HMT|HOVST|HOVT|ICT|IDLW|IDT|IOT|IRDT|IRKT|IRST|IST|IST|IST|JST|KALT|KGT|KOST|KRAT|KST|LHST|LHST|LINT|MAGT|MART|MAWT|MDT|MET|MEST|MHT|MIST|MIT|MMT|MSK|MST|MST|MUT|MVT|MYT|NCT|NDT|NFT|NPT|NST|NT|NUT|NZDT|NZST|OMST|ORAT|PDT|PET|PETT|PGT|PHOT|PHT|PKT|PMDT|PMST|PONT|PST|PST|PYST|PYT|RET|ROTT|SAKT|SAMT|SAST|SBT|SCT|SDT|SGT|SLST|SRET|SRT|SST|SST|SYOT|TAHT|THA|TFT|TJT|TKT|TLT|TMT|TRT|TOT|TVT|ULAST|ULAT|UTC|UYST|UYT|UZT|VET|VLAT|VOLT|VOST|VUT|WAKT|WAST|WAT|WEST|WET|WIT|WST|YAKT|YEKT)\b\s*)?(?<level>\w+)" ... View more

Hey annie22, have you tried the | rex command yet? Other than that please give us more sample data + an expected output as your explanation doesn't tell me how it should look like in the end. Thanks, pyro_wood ... View more

Hi @agentsofshield, have you found the DB-Connect app yet? https://splunkbase.splunk.com/app/2686/ ... View more

Hi @aohls, I'm trying to understand what you are trying to solve. Unfortunately without any sample data I might not be able to. It would be good if you could provide us with some sample events you want to use your 'transaction' command on. Thanks! ... View more

Hi @hurt, I can tell you that much: You made a fine decision choosing Splunk and joining us "the Splunkers" on their ever-awesome journey with this product. New people to Splunk are most-likely best off learning about the product in an easy way using the following link: https://www.splunk.com/en_us/resources/getting-started.html This link and the links on the site will give you a better understanding about what an awesome plattform splunk is. Get back to me after that, if you have any further questions. 🙂 Regards, pyro_wood ... View more

DEPENDS Do you want to make a statistic about the internet usage of users in your company or about the users that use your splunk system? if COMPANY USERS Do you have any proxy logs in your splunk system? if SPLUNK USERS Check out index=_internal source="*ui_access*" ... View more

I think only @micahkemp can help here. :horse: ... View more

Hi @CTHolt01, was I able to help you with my solution? Need any further assistance? ... View more

@navd, did this help you? ... View more

@sravani27, if you found my solution helpful and it worked for you please accept the answer. Thanks! ... View more

Does the splunk user has sufficient permissions to create a directory at that location? ... View more

Hi @SlothB77, I just throw a random suggestion out there. How about: host=HostA sourcetype="SourceTypeA" | stats avg(ValueA) AS average_valueA, avg(ValueB) AS average_valueB by counter | stats values(*) as * | ratio=average_valueA/average_valueB Props go to @DalJeanis for help on the last two lines! ... View more

Hi @SlothB77, please provide us some sample data and an expected output with further clarification on what you are expecting to do. Unfortunately your SPL is just a mess. And I can't figure out what you are trying to do. ... View more