@jcrabb_splunk - Is there a workaround available until the new version comes out? When are the new versions scheduled for rollout? ... View more

Can you post a sample event? ... View more

Below should work - <eval token="stuff">replace('value', ",", " OR ACCOUNT_NO=")</eval> ... View more

Nice logic!! Wanted to create a view to analyze time zone issue for logs going into future and this is exactly what I need 🙂 ... View more

Thanks Slosh for the detailed response! Just one last question. If I am doing a lot of filtering at Indexer level will it impact the Indexer performance (increased CPU or indexing lag)? ... View more

My requirement is to filter events at the heavy forwarder, before I send them to the Indexer. So can both communication happen on 9997? UF -> HF - 9997 HF -> IDX - 9997 Also, if I don't use a heavy forwarder and do the filtering at Indexers, will it consume any license? ... View more

Thanks! Above post answers most of my queries 🙂 ... View more

You can use metadata query and get the information - | metadata type=hosts | eval diff=now()-lastTime | where diff > 3600*24 | convert ctime(lastTime) as last_connected | eval not_reported_since=strftime(diff,"%T") | table host last_connected not_reported_since ... View more

You can use eval and do it this way - To 100s - | makeresults | eval number=22113 | eval number=number-(number%100) To 1000s - | makeresults | eval number=22113 | eval number=number-(number%1000) ... View more

Can you try this way - | eval flag=if(like("$dropdown_token$","notdef"),"*","$dropdown_token$") | search param1=$param1_token$ AND param2=$param2_token$ | where dropdown_param=flag ... View more

You can enable summary indexing for the search and then search the results in the summary index. ... View more

You are filtering out based on the Message field, so you don't need to use it with stats command - source="**" Message="Finished Cleanup" | stats max(_time) as time | eval End_Time=strftime(time,"%m/%d/%Y %T") Also you are filter fields using the fields command. http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Fields ... View more

Can you paste the exact value in the EVENT_MESSAGE field? when I tested with the sample provided by you it worked. | makeresults | eval EVENT_MESSAGE="Number of Offers ready to send: 6" | rex field=EVENT_MESSAGE "\D+(?<offercount>\d+)" | table offercount You could also try - <your search> | rex field=EVENT_MESSAGE "\D+(?<offercount>\d+)" | table offercount ... View more

Setting max_searches_per_process = 1 in limits.conf resolved the issue. http://docs.splunk.com/Documentation/Splunk/latest/admin/limitsconf max_searches_per_process = <int> * On UNIX, specifies the maximum number of searches that each search process can run before exiting. * After a search completes, the search process can wait for another search to start and the search process can be reused. * When set to “0” or “1”: The process is never reused. * When set to a negative value: There is no limit to the number of searches that a process can run. * Has no effect on Windows if search_process_mode is not "auto”. * Default: 500 ... View more

Try this rex field=EVENT_MESSAGE "Number of Offers ready to send: (?<offercount>\d+)" | table offercount ... View more

Just have this as your sourcetype and test the line breaking once. Remove any other line breaker related configuration apart from the below and try. [appname-access-log] TIME_PREFIX = \[ MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %d/%b/%Y:%T %z LINE_BREAKER = ([\n\r]+)(?=\[\d+\/\w+\/\d+\:\d+) SHOULD_LINEMERGE = False ... View more

And what is the logic for populating the compliance field? ... View more