I am trying to find out whether a report or search can run every second tuesday of a month. I have checked the presets and time range doesn't have any option and I am thinking, is it possible by cron schedule? Please share your valuable answers here. Thanks ... View more

Hello Experts, I have 2 different sources source 1 has hostname, ip address source 2 has hostname, os, os version I want to do a comparison on both the sources and get the events which have hostname common in both the sources. How this can be done?...Thanks in advance. ... View more

I heard that all dashboards that are created in ELK can also be created in Splunk. Is it possible and can anyone provide me a document or any sample work that illustrates the example? Thanks in advance ... View more

Hello Experts, I am new to splunk and learning it. http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad I have read the above document in splunk regarding routing and filtering of data ,Can someone please explain with an example in detail how the parsing,filtering and configure routing(configuration files) is done if possible.. Thanks in advanace ... View more

Hello experts,below is the json data {"actions": [{"date": "2012-05-17 00:00:00", "action": "Read for the first time and referred to the Senate committee on Judiciary", "+amendment": null, "type": ["bill:reading:1", "committee:referred"], "actor": "upper"}, {"date": "2012-05-18 00:00:00", "action": "Read for the second time and placed on the calendar", "+amendment": null, "type": ["bill:reading:2"], "actor": "upper"}, {"date": "2012-05-21 00:00:00", "action": "Unfinished Business", "+amendment": null, "type": ["other"], "actor": "upper"}.................................. I want to break the above data starting with a date into single events,Is that possible I tried using sourcetype=json and kv_mode=json but still it is not breaking .Please help ... View more

Hello Experts, I am very new to Splunk. I can import data into Splunk from .csv file by: add data->select source->sourcetype(access_combined)->next and click save. I can view the data by searching by giving the correct index and source name. In the same way, what is the process for JSON data? Can anyone explain me the detail steps of it starting from the props.conf? Below is the sample data which I have {"version":"2.4","user":{"zipCode":"","pcnNumber":""},"event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"},"productInfo":[{"productName":"DeltaGold","pmc":"113"}]}],"page":{"attributes":{"rbpnIndicator":"","preApproval":"NPA","appCache":"","appType":"Co-Brand","channel":"Non-DTW","rwd":"desktop","appConfig":"","experience":"Microsite","partner":"dal","acqCardType":"CCSG","appDecision":"","partnerAppType":"Co-Brand","acqExperience":"Microsite","productInfo":[{"productName":"DeltaGold","pmc":"113"}],"applicationId":"CPI_WEB","formName":"appForm","tool":"","autotrack":false,"appLength":"Long","decisionIndicator":"","flowType":"Prospect","sid":"2s0Hfr1lhsBhm8ad3hw01C2"},"pageInfo":{"country":"US","language":"en","pageID":"ng31hcrmnnh11zp","pageName":"DeltaGold_StartApp"},"category":{"primaryCategory":"Acq","subCategory1":"CCSG","subCategory2":"Microsite","businessUnit":"AMEX","subCategory3":"CPI"}}} In the above data, do I get a separate field for each separated by semicolon and separate fields for the one which are there in the flower brackets? example: "event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"} Sorry for such a big question and thank you in advance ... View more