Splunk ES - What does correlation search do much than a savedsearch in this app ? [I see the Correlation search page is similar to a savedsearch page where some extra options like urgency,rule description, owner,etc are created - which will be output when that search is matched] Splunk technology add-ons are used to parse the device logs in Splunk. saved searches (i.e Correlation searches) are fired (in realtime or scheduled) to populate some addition fields and display the results . Flow example:- Palo alto firewall -> generate logs -> UDP -> reaches splunk-> parsed with PAN sourcetype (TA-PAN) ) -> Data resides in Index -> savedsearches are fired -> Results are displayed Results will contain some extra fields , using lookup efficiently to populate some more additional information specific to events. Tell me some more uniqueness of this app ? ... View more

If i set Timezone specific to host names , how do splunk search for the results , say for eg : I have a device in Sweden , i set the (props.conf) timezone for this device (TZ) to sweden time another device is in Australia , i set the timezone to Australia time. i have my Splunk deployment in UTC timezone, So when I do a custom time search , how the results are displayed ? ... View more

What does the below statement mean ? If 'append' is set to true (false by default), the data from the lookup file is appended to the current set of results rathering than replacing it. I use lookup like below, [mysearch] | lookup MyLookup field_1 as field_1 OUTPUTNEW field_2 field_3 So , with reference to field_1 value , i do obtain field_2 , field_3 ..etc what does that statement say, how append=t works ? ... View more

I cannot able to trigger alerts from splunk. Splunk Version : 6.1 Below is the error message that i can see in : source="/opt/splunk/var/log/splunk/python.log" Eg email : myemailid@domain.net alert_actions.conf [email] mailserver = smtp.domain.net reportServerEnabled = 0 reportServerURL = from = Splunk commands.conf [sendemail] filename = sendemail.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true ERROR Logs: 2014-06-20 09:20:02,244 +0000 ERROR sendemail:348 - [Errno -2] Name or service not known while sending mail to: myemailid@domain.net 2014-06-20 09:20:02,243 +0000 ERROR sendemail:112 - Sending email. subject="Splunk Alert: Top five sourcetypes", results_link="htt://splunkservername:8000/app/search/@go?sid=scheduler__nobody__search__RMD5d5bc9be9473d1026_at_1403256000_14627", recipients="[u'myemailid@domain.net]" ... View more

In the below stanzas , both are having same source-type names, how the priority will be in assigning sourcetype? Has anybody used rule based sourcetype, any example will be more useful. in the beloe case "MORE_THAN_75" means no. of events ? Normal sourcetype : access_combined [access_combined] pulldown_type = true maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = \[ Rule Based Sourcetype : access_combined [rule::access_combined] sourcetype = access_combined MORE_THAN_75 = ^\S+ \S+ \S+ \S* ?\[[^\]]+\] "[^"]*" \S+ \S+ \S+ "[^"]*"$ ... View more