If you're asking about extracting the field name along with the field value, you can do that with a combination of props.conf and transforms.conf: props.conf [your_sourcetype] REPORT-kv = extract_quoted_fields ... transforms.conf [extract_quoted_fields] REGEX = "(?<_KEY_1>([^"]|\\")+)"\s*=\s*"(?<_VAL_1>([^"]|\\")+)" Make sure my Q'n'D regex actually suits your data, didn't test it myself. The main thing is to use the magic _KEY_x and _VAL_x names to extract both field names and field values in one swoop. ... View more

Only the email admin can set/raise message size. Find out what is the maximum message size and if it can be increased for Splunk alerts. ... View more

To forward data to secondary site, when the primary site is down, we have a new feature in 6.6 that can handle this case automatically. More info: http://docs.splunk.com/Documentation/Splunk/6.6.0/Indexer/indexerdiscovery#Configure_the_forwarder_site_failover_capability ... View more

That approach doesn't work because you're essentially overwriting the same value from the second stanza - it has the same name so it's the same stanza. You can rewrite the index value in transforms.conf: [send_to_A_index] REGEX = Category="Error" DEST_KEY = _MetaData:Index FORMAT = Awindows [send_to_B_index] REGEX = Category="Info" DEST_KEY = _MetaData:Index FORMAT = Bwindows Then refer to those stanzas in props.conf: [sourcetype, source, or host identifier] TRANSFORMS-index = send_to_A_index,send_to_B_index Usually these are on the indexer(s), and in most cases it's best to keep it that way. However, it's possible to use a heavy forwarder on the source host to have the HF do the parsing, filtering, etc. ... View more

I am facing the problem in deployment server the thing is i have a path and sourcetype and index i need to do configuration in deployment server already existing app and inputs.conf file is there and serverclass is already setup, so when i configured the new path, sourcetype the data is not reflecting in splunk and also i am not able to see any changes in universal forwarder i tried CLI command also but no changes has shown and my deployment server is windows server. even same socket error message is showing whenever i reload the DS ... View more

This stanza doesn't work, tried on UF 6.1.1 and Indexer 6.1.1 data still coming to indexer after pushed out the app, checked is on the UF client and restart the UF client but still getting data to the indexer And this only disabled a particular apps in UF? IU? i want to disable UF if it sending too much data or a least able to turn on/off as needed. ... View more

Try something like this: index=_internal source=license_usage.log type=Usage earliest=-4w@w | eval tdw=upper(strftime(now(),"%A")) | eval cdw=upper(strftime(_time,"%A")) | where cdw==tdw | timechart span=1day sum(b) AS volume_b by idx Adding the earliest clause limits you to the last four weeks of data. The first eval clause computes today's day of the week. The second eval clause computes the day of the week for each event. Finally, the where clause compares the two and filters out data that doesn't match. ... View more

The problem as I see it: you need to decide how to group the events. You can try cluster but it better if you define "common". Here is one possible search: error* | stats count by source sourcetype host | sort -count This will give you a count of the events that contain the word "error", with the most common host source and sourcetype listed first in the list. Here is another - this also groups the errors by including a few of the characters that surround the word "error" error* | rex "(?<msg>.{0,25}error.{0,25})" | stats count by source sourcetype host msg | sort -count ... View more

The known issues for 6.0.4 is still showing this issue, SPL-82389, as active and not fixed in 6.0.4. ... View more