I am trying to configure Splunk to properly split events from a data source. Here's what an event looks like: ---------------------------------------- Timestamp: 2/20/2012 3:30:44 PM <log details> ---------------------------------------- Each event begins and ends with dashes. The time stamp is always on the line after the initial dashes. Here's what I have tried (none of which work): [sourcetype] LINE_BREAKER = ----------------------------------------([\n\r]+)Timestamp:\s\d{1,2}/\d{1,2}/\d{4}\s\d{1,2}:\d{2}:\d{2}\s[A|P]M SHOULD_LINEMERGE = false MAX_EVENTS = 10000 MAX_TIMESTAMP_LOOKAHEAD = 80 [sourcetype] LINE_BREAKER = ([\n\r]+)Timestamp\s*:\s\d{1,2}/\d{1,2}/\d{4}\s\d{1,2}:\d{2}:\d{2}\s[A|P]M TIME_PREFIX = Timestamp\s*:\s* SHOULD_LINEMERGE = false MAX_EVENTS = 10000 MAX_TIMESTAMP_LOOKAHEAD = 35 [sourcetype] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ----------------------------------------[\n\r]+Timestamp\s*:\s*\d{1,2}\/\d{1,2}\/\d{4}\s*\d{1,2}:\d{1,2}:\d{1,2}\s*[A|P]M TIME_PREFIX = Timestamp\s*:\s* MAX_EVENTS = 10000 MAX_TIMESTAMP_LOOKAHEAD = 35 SHOULD_LINEMERGE=false LINE_BREAKER=----------------------------------------[\n\r]+Timestamp\s*: TIME_PREFIX=Timestamp\s*:\s* TIME_FORMAT=%m/%d/%Y %r What am I missing? ... View more

I'm adding a new field to an existing lookup table but it's not showing up in any searches. These are the steps I followed: Added the new field to the existing lookup .csv file Added the new column to the application props.conf LOOKUP Restarted splunkd The existing lookup fields are still showing up in searches, but not the new field. Am I missing a step? csv (Dependent_Service_Call_Group is the new field) ElapsedMetricDescription,Dependent_Service_Call,Dependent_Service_Call_Group,Target_Response_Time_At_90th,Planned_Throughput CDB Call [CPSDRVRA] Response time:,CDB Call,Checkout,500,12000 Standardize Address Request. Response time:,Standardize Address,Checkout,500,5000 Transforms.conf: [Dependent_Service_Metrics_NFR_Targets] filename = Dependent_Service_Metrics_NFR_Targets.csv props.conf: LOOKUP-Dependent_Service_Metrics_NFR_Targets = Dependent_Service_Metrics_NFR_Targets ElapsedMetricDescription AS ElapsedMetricDescription OUTPUTNEW Dependent_Service_Call AS Dependent_Service_Call Dependent_Service_Call_Group AS Dependent_Service_Call_Group Planned_Throughput AS Planned_Throughput Target_Response_Time_At_90th AS Target_Response_Time_At_90th ... View more

The following search which spans an hour returns 10,000 events which are all included in the final time bucket (ie 10:59). sourcetype="sourcetype" earliest=1/5/2011:10:00:00 latest=1/5/2011:11:00:00 | fields Application, Level, ThreadId, Message, host, cluster | search Application="*" Level="Activity" However, this search which spans one minute returns 15,000 events: sourcetype="sourcetype" earliest=1/5/2011:10:00:00 latest=1/5/2011:10:01:00 | fields Application, Level, ThreadId, Message, host, cluster | search Application="*" Level="Activity" We haven't made any changes to limits.conf and have just started to see this problem. One recent change was specifying LINE_BREAKER in props.conf. Any ideas on the inconsistency? ... View more

I'm receiving the following error message on a search: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression The expression is a search macro that takes a string parameter and returns a message based on a regex match using a case statement which uses the match function. This statement was working at one point, and then I started getting the error. Any ideas? ... View more

We are periodically seeing instances where data that was previously indexed no longer shows up, leaving "holes" in our index timeline. I did a search on the _internal index for the "delete" keyword and I'm not seeing any delete commands issued. I'm not seeing anything in the _audit index either. So I have two questions: why is this happening, and how do I fill in the gaps where data is missing? ... View more