because, the list could be a form input field So, this sounds like you want to match any value for 'name', right? Because a user could put 'Susan' or 'David', but could also put 'mloven'. So, again, my first answer would work in this scenario. Maybe paste in some actual logs, and give an example of what you want the search to do. We can probably provide a more exact solution then. ... View more

So, you're looking for a set of results where a specific field (or list of fields) exist? So, let's say you have a field called 'myfield'. You want to show a list of results where myfield exists, right? If your search has something like: index=myindex myfield=* Then only events with a field called myfield will return. ... View more

perlish - You can find the details of the app here: link But the Splunk App for PCI Compliance is a premium app, so you'll need to contact your sales person to purchase it or to get a demo. There should be a "Contact Sales" button on that page I linked to. ... View more

part 2 - Retention time - it's likely that you'll want to keep certain data longer than others. This is an index-level setting. If you want perfmon data for 60 days, but application data for 180 days, you'll need to separate your indexes accordingly. ... View more

Sure. Two parts because it's a long answer - Basically, it's the two criteria I mentioned; retention time and security. Security - Say you have a group of sysadmins that need to be able to search server perfmon data, but don't need any access to any of the other stuff. With method 1, you couldn't give the sysadmins access to just the perfmon data and nothing else. With method 2, you'd simply limit the sysadmins role to only be able to search the perfmon index. ... View more

Hey proletariat99, the change from https to http is expected. The Splunk App for Enterprise Security changes splunkweb from http to https, so upon removal, it would revert back. Also, if you're antsy about removing apps in the future, you can just move an app to the disabled-apps directory $SPLUNK_HOME/etc/disabled-apps) and restart. That way they're always there if you want to move them back. ... View more

plop this in a props.conf file [sourcetypenamehere] LINE_BREAKER = ([\r\n]+)(?\d{1,2}:\d{2}:\d{2},\d{3} ... View more

bumping this. I'd like to know as well. ... View more

Hey Brian! Glad you got it sorted out! ... View more

sorry, I forgot my closing quotes on the rex commands (or else Answers ate them). at the end of each rex command, just before the pipes, put a closing quote. You should be adding two quotes: one after +)_ and one after +)$ ... View more

Try this search: "Health Probe" "changed state to" | rex "Health\sProbe\s(?<probe_name>[^_]+)_ | rex "changed\sstate\to\s(?<state>[^\$]+)$ | transaction fields="probe_name,state" startswith=UP endswith=DOWN keepevicted=t | search duration > 10800 ... View more

I assume that there are events that show a down message? And that they're pretty much the same text as the up messages you posted (only with a "DOWN" at the end)? So given an up message of this: [Date] [Time] [Server IP] : [Tag]: Health Probe NY_HTTP:80_PROBE detected Server Name in serverfarm NY_Serverfarm_01 changed state to UP and a down message of this: [Date] [Time] [Server IP] : [Tag]: Health Probe NY_HTTP:80_PROBE detected Server Name in serverfarm NY_Serverfarm_01 changed state to DOWN And you want to create a transaction based on an up message followed by a down message for the probe name (i.e. "NY")? Is that correct? If so, you'd want something like this: "Health Probe" "changed state to" | rex "Health\sProbe\s(?<probe_name>[^_]+)_ | rex "changed\sstate\to\s(?<state>[^\$]+)$ | transaction fields="probe_name,state" maxspan=180m startswith=UP endswith=DOWN keepevicted=t Hope that helps! ... View more

I'm assuming that the inputs.conf you posted is from your indexer? If so, I don't see a stanza in your inputs.conf for port 9997. ... View more

Do you have "Network Interface" in quotes in your config, like you do in your original post? I ask because I'm looking at the Splunk_TA_windows app right now and it doesn't have quotes around that string. ... View more

So, for each event with a "[" in the instance field, you're getting two values for object? One set to "Network Interface" and one set to "R] PRO_1000...."? ... View more

And while that isn't "wrong", it's not really what source was meant for. From the docs: Source - A default field that identifies the source of the event. In the case of data monitored from files and directories, source consists of the full pathname of the file or directory. In the case of a network-based source, the source field consists of the protocol and port, such as UDP:514. ... View more

How big are your access logs? How old is the oldest data in those logs? Are the logs actually rolling over? Splunk is detecting that the first 256 bytes of the file (by default) are different than the last time it tried to read the file. This commonly happens when a file rolls over. The "old" file becomes something like access.log.1, and your app starts logging to access.log. Splunk checks the file, sees that the first 256 bytes of the file are different, and basically assumes that your file rolled over. Therefore it starts over from the beginning of the file. ... View more

tb5821, Seems like this is two problems in one. The first thing you need to solve is grabbing the contents of the web page. Splunk doesn't have anything built in to do this, but it should be easily scriptable via a wget or curl script. Secondly, how to index that data. Once your script is outputting an html file, just input it into Splunk as you would any other file. It won't look pretty because it's not really a log message, but Splunk will index it fine. ... View more

Well, no, of course not. But your original question stated: ..." I want to verify that each of the servers with a light-SplunkUniversalForwarder installed is sending the appropriate data." ... View more

By the way, if dvc and state aren't being extracted, you can do that within your search. "Particular Server Name" "Changed State to" (DOWN OR UP) | rex "^( [^\s]+)\s" |rex "Changed\sState\to\s( [^\s]+)" | transaction fields="dvc,state" maxspan=180m startswith=Down endswith=Up keepevicted=t ... View more

"Particular Server Name" "Changed State to" (DOWN OR UP) | transaction fields="dvc,state" maxspan=180m startswith=Down endswith=Up keepevicted=t This assumes a few things: You are correctly extracting the server name as a field called "dvc". Feel free to change that to whatever you want. The state (up or down) is being extracted as a field called "state". Again, change that if you'd like. In "X amount of hours", X=3. Adjust accordingly. If that search works correctly, save it and set up an alert. Hope that helps. ... View more

hartfoml, Splunk should automatically extract your mac address. Can you post your props.conf for this sourcetype? ... View more