Hello. I have a script that invokes the command line splunk tool on an single index/search head to oneshot index log files. Is it safe to delete the input log file after splunk oneshot returns with status 0? The reason I ask is the search status webpage shows the number of indexed events ticking upward for a while after that the command returns. It seems to work, but I don't want to do it this way if it is not safe. ... View more

In transforms.conf, I have a transform defined like this: [mytransform-fromlist] REGEX = from=(?<fromlist>\w+) I want to extract an additional field from the fromlist. I'm trying to do this in props.conf with something like this: REPORT-fromlist = mytransform-fromlist EXTRACT-from = (?<from>.*) in fromlist Note that the trivial from regex is just for testing so that I can assure that the from field will show up in the search results. When I run this search, I do see the fromlist field, but not the from field. I figure that somehow the fromlist is not available to EXTRACT-from at search time. But I can't find any documentation on this. I also tried using a transform to extract the from field by adding this to transforms.conf: [mytransform-from] REGEX = (?<from>.*) SOURCE_KEY = fromlist ...and a corresponding REPORT in props.conf like this: REPORT-from = mytransform-from Help! ... View more

Ahoy. We've been experiencing a search performance problem and I'm having trouble figuring out what to do about it. I've been following the advice and techniques outlined here: http://wiki.splunk.com/Community:PerformanceTroubleshooting The very simple search I am performing is this: splunk> sourcetype="mysource" ...for the last 60 minutes. The search trudges away revealing "0 matching events" for about 10 minutes before revealing anything. During this period, the CPU performing the search shoots to 100% usage. iostat reports low tps (like ~10). vmstat shows no swap activity. So I'm pretty sure this is CPU bound. The search log shows AMPLE time consumption by "SearchOperator:kv", and all of the default kv searches are being performed. The "access-extractions" system default extraction seems to take about 5 whole minutes. The job inspector reports practically all of the time in "dispatch.evaluate.search". (I found it odd that the job inspector didn't identify command.search.kv considering the contents of the search log.) Note that according to the high-level summary on the search page, "mysource" has about 276 million events. Not sure if this is a lot or not. Any ideas? UPDATE: So many of the time-consuming "SearchOperator:kv" lines in the search.log file seem to be coming from specs in the config files that are not related to my custom sourcetype. For example, the access-extractions transform is referenced by a bunch of default sourcetype specs, but not by my custom sourcetype spec. The following search: | metadata type=sourcetypes index="main" ...shows a single result that is my custom sourcetype. ... View more