Hi, I have recently started using json log lines which works great with Splunk. There is one issue, however, which I cannot resolve at the moment. The idea is to construct the original request out of json object I have a field with structure: req.args.paramA = value1 req.args.paramB = value2 req.args.paramC = value3 What I want to have in the end is a string: paramA=value1&paramB=value2&paramC=value3 By design, I don't know param real names. Those can be changed, depending on what user submitted. I tried using (as a test): eval params= ""| foreach req.args.* [eval params=params + <>] Gave me only Splunk errors... Thanks ... View more

Hello, I am a splunk version 5.0.4 (build 172409) user. I have a view with N-amount of charts and stats which is delivered weekly as pdf to AD group. Everything works like a clock. However, we came to idea that we need a ftp/sftp/etc. storage for older reports. So you can view them later. I can copy it manually with every delivery, but would be great to automate it. So my question is: Can i (within splunk) sent the same pdf report not only to the email, but to the storage server via scp/rsync/http/etc. ? I have one idea to try splunk sdk and trigger pdf export with that. Will not be the same report as via mail, but at least something. (I am actually not aware is it possible to trigger pdf export like this) Any ideas are welcome. -- Nikolai ... View more