Had same problem - this worked for me... Created field extract named bcoat_proxysg: EXTRACT-cs_uri_authority with regex: (?)..*?.(?P [a-z]+.[a-z]+(?=/) then changed the search/view. ... View more

Skimming through docs and help I cannot see any clear statement that you can use true or false in place of 1 and 0. Do you know if we can safely use 'true' / 'false' in all cases where '0' or '1' is in the examples/docs? I'm guessing I'll see a parsing error on start up of the forwarder if 'true' or 'false' is not accepted in place of '0' or '1' ... not seen one yet. Ta. David. ... View more

I got it work with sname for the event logs. How do I do dhcp or any other application logs ... View more

That time/date would be outside the data that's currently in the main index ... ... View more

Sure. That sounds like you want a basic "workflow action" (what used to be simply called "field action"): http://www.splunk.com/base/Documentation/4.1.4/Knowledge/CreateworkflowactionsinSplunkWeb ... View more

you can ignore pulldown. It just controls whether the sourcetype appears in the GUI list. the other problem may just be that you need a faster machine or faster disk. ... View more

The splunk-optimize process can´t run on that subdirectory, since it doesn´t exist. Even if i create it manually, splunk-optimize won´t notice, except by creating another error: 05-11-2010 13:10:40.476 ERROR databasePartitionPolicy - Index is empty refusing to move. oldDirPath=/opt/splunk/splunk/var/lib/splunk/fishbucket/db/db-hot The other message is still there: 05-11-2010 14:33:52.045 WARN timeinvertedIndex - splunk-optimize failed to start for index /opt/splunk/var/lib/splunk/fishbucket/db/db-hot ... View more

Also make sure you have 'logging timestamp' enabled on your FWSM module (and other Cisco devices) to include that in messages. Cisco logging is very flexible, but that means the default config isn't always how you'd like it. ... View more