Thats weird, can you show me your query ? ... View more

Hi vrmandadi, Try like this, | eval average_response_time = strptime(EML_REQUEST_TIME, "%Y-%m-%d %H:%M:%S.%3N") - strptime(EML_RESPONSE_TIME, "%Y-%m-%d%H:%M:%S.%3N") Hope it helps. Edit: This might work, as you did not mention those brackets on your sample data. | rename "ENDPOINT_LOG.EML_REQUEST_TIME" as EML_REQUEST_TIME | rename "ENDPOINT_LOG.EML_RESPONSE_TIME" as EML_RESPONSE_TIME | eval average_response_time = strptime(EML_REQUEST_TIME, "%Y-%m-%d %H:%M:%S.%3N") - strptime(EML_RESPONSE_TIME, "%Y-%m-%d%H:%M:%S.%3N") ... View more

Somesoni's regex should work, the problem was your data sample, all the records ended with "OK+A" but it looks like not after all. So, you have to change/remove \+A\s+ after the OK from the regular expresion. ... View more

Hi there, try this. your_search | outputcsv yourfilename.CSV Get your file on $SPLUNK_HOME/var/run/splunk Hope it helps. ... View more

Are those fixed length fields ? Take a look at this, Edit: regex added main search | rex field=_raw "\d{2}\/\d{2}\/\d{2}\s\d{2}:\d{2}:\d{2}\s(?<A_TEMP>.*?)\sOK" | rex field=A_TEMP "(?<a_group1>.{4})\s(?<a_group2>.{8})\s(?<a_group3>.{7})\s+(?<a_group4>.{3})\s+(?<a_group5>.*?)\s+(?<a_group6>.*)" | table _time a_group1 a_group2 a_group3 a_group4 a_group5 a_group6 ... View more

Hi basher, Whats the bucket status on Cluster Master's Dashboard ? You should also read this, http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/CommandlinetoolsforusewithSupport#fsck ... View more

Hi cdstealer Try to add this, after your field extraction. main search | rex field=_raw ... | makemv delim=" " Privileges | mvexpand Privileges Hope it helps. ... View more

Hi there mate, Take a look at this, and you will probably understand how to strip the event as you wish. This example will remove event description. Add this to your props.conf and restart Splunk. [yoursourctype] SEDCMD-del_desc = s/(?mis)This event is generated.*$//g Or like this, to remove distinct types of event descriptions in the same regex. [yoursourctype] SEDCMD-del_desc = s/(?mis)(This event is generated|other_type_of desc_1|other_type_of_desc_2).*$//g Oh, and remember, events already indexed wont change after this but the new ones does. Hope it helps and let me know if it works. ... View more

Hi smudge, Did you try CSV lookups ? Check this out http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Addfieldsfromexternaldatasources#CSV_lookup_example Hope it helps! ... View more

Hi there Thats weird mate, what Splunk version are you running ? Because timestamp recognition works just fine for me on 6.2.3 & 6.3.0 ... View more

Hi there splunker, try like this. index=_audit tag=authentication info=succeeded | stats count by user, info, host | sort - info index=_audit tag=authentication info=failed | stats count by user, info, host | sort - info Dont know about your Splunk environment, but if you are looking to get this from all your instances, you have to forward _audit index to your Search Head. Hope it helps. ... View more

Can you share a data sample of the event ? ... View more

Use _time instead ServerTime, like this. | eval time24hs=strftime(_time, "%H:%M:%S") ... View more

Just to give you an example on a single instance of Splunk. This should work, had to change your regex a lil bit. On your props.conf... [detele_331] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom pulldown_type = true SEDCMD-longitude = s/(?<=\s)\(\d{1,}\)//g s/\(\d+\)/./g s/\.(?=\s+)//g EXTRACT-longitude = \w\s{9,}(?<longitude_site>\S+) From now on after adding this to your props.conf and doing a restart, new events will get modified by your SEDCMD regex. Then you must add the new field extraction that will be applied to the modified raw data at index time. Hope it's clear enough now. ... View more

Hi there, Can you paste your props.conf ? Did you check field extraction permissions ? What about your environment, single instance/distributed/cluster ? ... View more

He is asking for a data sample mate, that would be helpful. ... View more

Read this, http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath Can you share a sample event ? ... View more

Where did you create the new index, on your Peers or the Search Head? EDIT: For indexing small files (100 lines or less) , you should read the documentation. http://docs.splunk.com/Documentation/Splunk/6.3.2/admin/Propsconf ... View more

Thank you so much ryom 😉 ... View more

Just use this on your props.conf & btw I had a typo on my first answer and already fixed it. This should work as expected. [source::/var/log/abc/...] BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s SHOULD_LINEMERGE = true TIME_PREFIX=^ TIME_FORMAT=%y-%m-%d %H:%M:%S.%6N%z MAX_TIMESTAMP_LOOKAHEAD = 32 Hope this is clear now. ... View more

Oh I see, I forget that | top limit=30 ... my bad. Glad It works tho ... View more

Can you paste another data sample of those events that are not getting parsed correctly ? Run this at CLI and search for the affected sourcetype stanza to debug. %SPLUNK_HOME$/bin>./splunk cmd btool props list ... View more

What was already bad indexed wont get re-parsed. You should probably delete those and re-index. ... View more