Interesting perspective from @maciep at Is there a way to configure high availability for Splunk Forwarders, so if one is down, another will pick up and forward the data?? He said - -- Before my time here we had something kind of similar in active/inactive state. It was actually two syslog servers. Both servers would get the same data in the same folders/files but only one would have the forwarder running at any given time. The trick though was to put the fishbucket on a mount point and then symlink it on both servers from the normal fishbucket location. So the failover scenario was still manual - meaning we had to start up splunk on the backup server. But when it started, it was using the same fishbucket as primary so it knew where to start reading files from. I'm not sure how good of a solution that was but it could be an option for you. As long as the forwarders are reading from the same place and share a fishbucket, I guess it would work? In general though, we don't worry much about HA for forwarders. We have monitoring in place to start splunk if it stops and we get a daily report (from the Deployment Monitor app) of forwarders that haven't checked in to our deployment server. So typically we can address stopped forwarders before the data rolls. Hope that helps a little ... View more

That's awesome, thank you sundareshr ... View more

There are a variety of ways to do this, ranging from simple to complex and from slow to quick. I'm going to throw out one that should be fast, if it'll work for you. There's some things I can't quite tell from the information you supplied so some of this is a guess. But, it sounds like your WebLogs have all the information except the external IP address (which in the below I'm going to pretend is named "external_ip" to keep it straight), which comes from the ProxyLogs. sourcetype=WebLogs OR sourcetype=ProxyLogs | stats count AS Total, last(external_ip) AS Outside_Address By Time, IP_Address, hostname, UserAgent, loginname Again, I'm not positive it'll work for you (and I'm sure it'll need more fields and some alterations to make it work), but maybe this will give you a different idea on how to accomplish it. What it does is just take ALL those events together, then use the stats command to group them. The way the WebLogs and ProxyLogs connect together isn't perfectly clear in your question, and it's not clear in the above answer either - so the explanation is at this point that I'm assuming "loginname" is common to both. I don't think it is, I think you have one have "username" and the other "loginname", which I'm hoping is how they connect. In that case, you'll need to make them the same field so you'll have a match, but you can't just rename it because the field exists already. So here's a technique for that... sourcetype=WebLogs OR sourcetype=ProxyLogs | eval MyConnectingUser=coalesce(username,loginname) | stats count AS Total, latest(external_ip) AS Outside_Address By Time, IP_Address, hostname, UserAgent, MyConnectingUser So, for each event it'll have either a username or a loginname, right? (Because of my example, that is). The eval will coalesce those two into a new field, if username exists it'll copy username into MyConnectingUser and ignore loginname. If username doesn't exist, it'll take loginname and copy THAT into MyConnectingUser. Then the stats uses MyConnectingUser to "do things." Also note my "latest(external_ip)". It's a way to grab the latest external_ip from a group of them - stats will "group" the events so you HAVE to use some sort of summary field. earliest(), first(), last(), latest(), values() and list() are all ways to "summarize" a field without summarizing it, if you get my drift there. ... View more

Pretty sure this will do what you want... index=syslog username!="NULL" | transaction clientip maxspan=60m maxpause=2m | stats dc(clientip) AS "Client IP" values(username) AS "User Name" dc(username) AS "usernames" by clientip | where usernames > 5 | table clientip, "User Name" ... View more

Yup.. This worked, Thank you so much. ... View more

What about this? index=syslog | eval NullUserAgent=if(like(UserAgent, "-"), "True", "False") | search NullUserAgent="False" | stats count by UserAgent Or: index=syslog | rex field=UserAgent "^(?P<NullUserAgent>\-)$" | search NOT NullUserAgent | stats count by UserAgent ... View more

Refer this Simply put ((?[^:/?#]+):)?(//(?[^/?#]*))?(?[^?#|\s]*)(\?(?[^#|^\s]*))?(#(?.*[^\s]))? cs_uri_authority is the one you are looking for. ... View more

the Like command might be of use. ... View more