hello, Is there any good solution to the problem of cloning into multiple groups and receiving copies of data from the indexer, but not necessarily with precision? ... View more

the solution which works for me is the  CHARSET attribute in props try to set that to auto. it should work  ... View more

The FORMAT is source::$1$2 rather than source::$1$3 because the two optional numbers-grabbing groups are non-capturing, as marked by the (?: opening sequence. Converted 🙂 I wrote the regex into Splunk Answers directly... but I did indeed use regexr.com to make the screenshot. ... View more

You want to add new field, say country with values AU/IN/SG or Australia/India/Singapore? If first, then you just need field extraction (using rex/props.conf). If second, then you need field extraction and lookups both. ... View more

Ok i got this to work actually by extracting the entire line "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0", placing this into a field called "http_user_access" and downloading the necessary csv file for the app. (view read me). this worked. 🙂 thanks for the tips! ... View more

Sometimes there's invisible whitespace in the numbers: eval Avg=replace(Avg," ","") Had this same issue - numbers appear as text so don't calculate or plot, especially when extracted with REX at search. ... View more

well that did work. I guess my regex was selfish and greedy. thanks for the heads up! ... View more

OMG I totally forgot about that! Thanks you! Crisis averted! 🙂 ... View more

:::bump::: Any other takes on this? It seems to be breaking every time there is a timestamp and I don't want it to do that. ... View more

I am seeing the same behaviour here on Windows 2012R2. I 'had' been using DBConnect without issue on another server running Windows 2008R2. Trolling for an answer. ... View more

incorporated into original answer. ... View more

aah, I knew there was a simpler way... just never done much of source overriding, just index, host etc. ... View more

I removed the trial extended license we got from splunk and went back to the free license and the problem is solved. It's something to do with the license we got. I'll have to contact them. Thanks everyone for our input. ... View more

well the output of the script is in the log file in question, but it comes into the log file as the tasks are completed. It gives an idea of where the script is based on the output in the log OR if a part of the script breaks, it gives us an idea where. The log file that I'm indexing is a "summary" of all the runs of the script until it gets big enough to be rotated. The script is dumping a summary to this log every 2 minutes and runs constantly. ... View more

Can we do like this..when user just scroll over x axis,he can see the Debug string in tooltip? 😞 ... View more

The | metadata command will only ever give you the current stats, so it wont do you any good as far as comparing today's hosts with last week's host. and the _internal metrics data technically only lists stats from hosts that are significant contributors. So if there are a lot of hosts that are contributing relatively little, they wont show up there at all. The answer may be to just spin up a search that searches every event. If you run this search over a given time period: * | fields host | stats count by host | sort host it will give you an exhaustive list of all of the hosts in that period. If you run this search: * | fields host | timechart dc(host) that will give you a graph of the number of distinct hosts over time, which might be useful. And if you want to try doing the whole diff of this weeks hosts versus the hosts from a week ago, here are some searches that can do that: * | fields host | eval daysAgo=(now()-_time)/(24*3600) | eval interval=case(daysAgo<1,"recent",daysAgo>7,"last week") | fillnull interval value="in between" | timechart dc(host) by interval * | fields host | eval daysAgo=(now()-_time)/(24*3600) | eval interval=case(daysAgo<1,"recent",daysAgo>7,"last week") | stats dc(host) by interval ... View more

a similar answer, but closer to the actual expected output LINE_BREAKER=([\r\n]+)(=+[\r\n]+Check start) SHOULD_LINEMERGE=false should throw out the first [\r\n]+, and begin each event with your first row of =+ ... View more

In case you get trapped with a file not being monitored even if (1) all permissions seem correct, (2) your deployment script is set to Enable App, Restart Splunkd and (3) You see these errors 09-18-2015 12:28:47.311 +1000 WARN FilesystemChangeWatcher - error getting attributes of path "/software/app/oracle/admin/webhost1/diagnostics/logs/OHS/ohs1/access_log": Permission denied Then I found this actually did work: - Log on to the forwarder and check that your app with the file monitoring stanza has been deployed all OK - Do a splunk list monitor (if you’ve got the same problem it won’t be listed) - Restart of splunk e.g. /opt/splunkforwarder/bin/splunk restart - Do another splunk list monitor to see if it has worked Unfortunately in this exercise I didn’t do a ps | grep splunk on the remote host to check if the splunkforwarder process had been restarted by the utility server’s splunk reload deploy-server ... View more

Also I like this, but I'm not sure it's as nice as Transaction. With transaction, it's taking everything I mentioned and putting it as 1 result for 243 hours. For 7 days I'd like to get 7 results, but I get 70 right now. I am going to see if I can work transaction in there. ... View more

only one convert at a time, and they can have different formats. try something like | convert timeformat="$h:$m"$s" dur2sec(fieldA) AS Asec | convert timeformat="$d $h:$m"$s" dur2sec(fieldB) AS Bsec ... View more

I'll try this! ... View more

It's crazy but I've tried this over and over and it just doesn't work. I noticed all of my other extractions in props.conf usually start with like (?i) and such. This one doesn't. Not sure why it's not working. Works through search but trying to do this automatically isn't working. 😞 I even tried putting (?i) in the front and nothing. It works great in search...but automatic extractions are a no go. ;( ... View more

As per this post (https://answers.splunk.com/answers/5037/using-setcap-to-allow-non-root-splunk-user-to-start-splunkweb-on-port-443.html) I could not get setcap to work: setcap 'cap_net_bind_service=+ep' $SPLUNK_HOME/bin/splunk Still wouldnt let me use 443 and when I manually changed it Splunk would not start. setcap 'cap_net_bind_service=+ep' $SPLUNK_HOME/bin/splunkd caused LD_LIBRARY_PATH to not work giving /opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory So if you are not running as root (which I am not) then I don't think setcap will help. I have had to use iptables redirection in the end, which on Ubuntu meant added the following to /etc/ufw/.before.rules : *nat :PREROUTING ACCEPT [0:0] -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 8443 -A PREROUTING -i eth0 -p tcp --dport 514 -j REDIRECT --to-ports 5514 and then allow the actual listening port through the firewall: ufw allow from any to any port 8443 ufw allow from any to any port 5514 ... View more

The problem with your subsearch is that it is not used as an argument to a command. This may make more sense when you consider the following two examples and then imagine that the subsearch is "action" search term. sourcetype=pan_threat action=allowed sourcetype=pan_threat | search action=allowed similarly, the command that you need to precede the subsearch is "search" sourcetype="EPPWEB" source="/opt/log/dotinfo/web_server/info.log" OR source="/opt/log/dotinfo/*/web_server/info.log" WAT | search [ search sourcetype="registrarcount" ] | dedup registrar,description,registry | stats count(registrar) as numviewed,max(registrarcount) as registrarcount by description,registry | eval percent=numviewed/registrarcount*100| fields registry, description, numviewed, registrarcount, percent I know this is resurrecting an old thread, but it was never answered and I think that it would help others trying to understand the subsearch. ... View more