Hi All, I have a lookup that currently works. I've set match_type to CIDR(netRange) in my transforms file and everything works when I pass it an IP address to find in the range. However, I'm looking to use this lookup table without a search. So I went with the creating command inputlookup , but for the life of me, I cannot get a CIDR match to work. I want to pass it an IP, and have it find the matching CIDR notation in netRange. Is there no way to do this with the inputlookup command — why is it not honoring my transform? This works: index="main" | eval cip="1.1.1.1" | lookup IP2ASN netRange AS cip This does not work |inputlookup IP2ASN where netRange=1.1.1.1 ... View more

I took a look at quite a few of the threads on here to solve my problem first, but mine seems to be a little more unique than what already exists. Consider the following log entry: --------------------------------------------------------------- 04/13/17 08:50:51 RELEASE by 192.168.1.2 to www and M4 : /some/horrible/code/pushedbyprogrammer/code1.r /some/horrible/code/pushedbyprogrammer/code2.r /some/horrible/code/pushedbyprogrammer/something.pdf /some/horrible/code/pushedbyprogrammer/image.jpg /some/horrible/code/pushedbyprogrammer/code3.p Just Released 5 programs This is my regex: ^\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\s+\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+\s+\w+\s+(?P<codePusher>[^ ]+) to (?P<serverPushed>[^:]+) :\s+(?P<codePushed>[A-z0-9\s\/.]+)Just Released (?P<numberPushed>[\d]+) program These are the fields I get: codePusher: "192.168.1.2" serverPushed: "www and M4" codePushed: /some/horrible/code/pushedbyprogrammer/code1.r /some/horrible/code/pushedbyprogrammer/code2.r /some/horrible/code/pushedbyprogrammer/something.pdf /some/horrible/code/pushedbyprogrammer/image.jpg /some/horrible/code/pushedbyprogrammer/code3.p numberPushed: 5 My problem is the "codePushed" in that I'm trying to build an event that only looks for extensions ending in .p or .r. at first i tried (codePushed="*.r * OR codePushed="*.p *") but unfortunately, the space/carriage return is not recognized and i get nothing. So i tried something like (codePushed="*.r* OR codePushed="*.p*") with no spaces and this works for the most part, but then it also picks up things like ".pdf" which i do not want. My other solution was to filter out what i don't want but in the case above, if i say codePushed!="*.pdf*" then it doesn't give me anything because the entire field is treated as a single line which brings me to my next point. The other issue i have is that it treats all of the pieces of code pushed as one field. Is there anyways to split this up into an array?? I'm not really sure how to approach this problem. ... View more

Last night a received an alert that we went over our bandwidth Cap. Upon closer inspection, I saw a new "host" in the 30 day license chart... the host was SPLUNK. I ran this command (same as the 30 day license command) only i limited it to just Splunk index=_internal [ `set_local_host`] source=*license_usage.log* type="Usage" h="SPLUNK" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | timechart span=1d sum(b) AS volumeB by h fixedrange=false | join type=outer _time [ search index=_internal [ `set_local_host`] source=*license_usage.log* type="RolloverSummary" earliest=-30d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] This report shows that Splunk NEVER logs anything towards our ingest limit... until yesterday where it indexed .25 GB of data. What would cause this? ... View more

when using python, the host gets inventoried but never sends any perfdata. I realized the difference between this host and a working host was that this host used python over perl. I edited nmon2csv.sh and nmon_cleaner.sh to look for version 2.9 instead (arbitrary higher version number). Everything works fine using pearl, except that i can't get config data. EDIT: since i wiped all data from the index but left the old config time stamps it looks like i'll have to wait about an hour before it sends another config. I'm running the latest version of everything. ... View more