These are (mostly) index time settings. Are your Indexers and Search Heads separate servers (distributed architecture)? If so, the KV_MODE setting of props.conf needs to be on your Search Heads. ... View more

If I were to need to do this, I would follow what is suggested in the "Forward data to third-party systems" documentation article at http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Forwarddatatothird-partysystemsd. If the data source is not in CEF format, then you might consider using the Splunk App for CEF ( https://splunkbase.splunk.com/app/1847/ ) and use outputs.conf to define how to get this data sent to ArcSight. ... View more

I know this is an 'older' question, but I am getting into the possibility that I too will be working with CEF data. II take it that what you refer to as the "tokened fields" that you mean the "cs#=" and the "cs#label=" fields that are in the "Extension" portion of the messages. I have not seen anything that indicates there is a way for Splunk to auto-ingest/field extract CEF data. You will likely need to create a transforms to do that and the RegEx should be fairly straight forward for that. More importantly, I am not sure you'd want to extract these fields at index time; the savings you'd get at search time with this is not likely to be worth the performance impact on index processing to do the extraction and indexing together. I suggest you keep to search time field extractions. ... View more

I concur with creating a lookup table from your customer data using a regularly scheduled search to keep the table current. Then configure the table for automatic lookup and your customer info will be added to each order event as it is processed. ... View more

Thank you for this information. The one issue still to resolve is the formatting of the log; it is BSON (Binary-encoded JSON). ... View more

Have you setup your Search Head to accept the XML formatted data so that it extracts the fields directly? Add this to the props.conf on your Search Heads for the sourcetype set for this data: [YOUR_SOURCETYPE] KV_MODE = xml Then you should be able to code your searches to look for the failed tests: YOUR_SOURCETYPE="your_sourcetype" status="FAILED" ... View more

You are correct, a restart of splunkd is not required when you add lookup tables via the Web UI. I typically use CamelCase for my variables and always CAPTIALIZE select keywords in the search code (i.e. OR and AS) to match the Splunk doc and make the code easier to follow. OR is required but I don't think AS is; I've used it as 'as'. The "| inputlookup oracle_returncode.csv" command returns the CSV file header as the field names for each column. Verify that these match your code. The lookup command in your search uses the syntax of | lookup {LookUp_Tbl_Name} {LookUp_Tbl_Field_1} AS {Event_Field_1} OUTPUT {LookUp_Tbl_Field_2} AS {Event_Field_2} For more info on the command's format, check out the Lookup Command1 doc. If you create a Lookup Definition (second item on the Settings >> Lookups page), then you do not need to specify the lookup table's CSV file name and use a shorter name instead. ... View more