Have you checked the Splunk app for Web Intelligence? ... View more

The way to re-use your field extractions is by applying them at the sourcetype level. This also means that you should set the same sourcetype for all logs of the same type. While your setup may be better in some cases, this is probably not one of them, since you will have to maintain a bunch of identical field extractions. It may make more sense to change the host value, either through host_segment or host_regex , so that each website gets a unique host name as seen from splunk. You can look this up in the docs for inputs.conf Or you could limit searches on the source when you want to differentiate between them, e.g.; sourcetype=iis source=*W3SVC4* | the_rest_of_your_search Hope this helps, Kristian ... View more

This is something we intend to address in a forthcoming release of the web intelligence app. ... View more

Convert it to some time format you prefer using eval and strftime . " %+ " is often a good quick format modifier for getting a readable timestamp. sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | eval earliest=strftime(earliest,"%+") | table TransactionID earliest duration ... View more

Here is a very simple regex , to get you started, that will extract the roomname value out to the field "roomname_field" "chat://\w+/\w+/(?<roomname_field>\w+)" Without seeing a sample of many possible values I dont know what characters could be in the room, domain and roomname path parts. \w just captures [a-zA-Z_0-9] . Adjust as necessary. ... View more

thanks, exactly what i was looking for! ... View more

@rroberts : Sorry for the mistake, the <code> tags I used to wrap the search string still required backslashes to be escaped. I fixed the string and tested a copy/paste of it with success. ... View more