Pulling the time and date out as two separate fields would possibly require the least processing, if that suits: EXTRACT-Last_Updated = (?i)<x:lastupdated>(?P<last_updated_date>[^T]+)T(?P<last_updated_time>[^<]+) Maybe then you could concatenate them if necessary. ... View more

Similar problem here - 2008r2 x64, Splunk 4.3, applied the January Microsoft patches and now get this when the SplunkWeb service tries to start: The instance's SvcRun() method failed File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun self.SvcDoRun() File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 37, in SvcDoRun subprocess.call(gMakeCertsCmd) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 493, in call return Popen(*popenargs, **kwargs).wait() File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 679, in __init__ errread, errwrite) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 893, in _execute_child startupinfo) <type 'exceptions.WindowsError'>: [Error 193] File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32\win32serviceutil.py", line 785, in SvcRun self.SvcDoRun() File "C:\Program Files\Splunk\bin\SplunkWebService.py", line 37, in SvcDoRun subprocess.call(gMakeCertsCmd) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 493, in call return Popen(*popenargs, **kwargs).wait() File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 679, in __init__ errread, errwrite) File "C:\Program Files\Splunk\Python-2.7\Lib\subprocess.py", line 893, in _execute_child startupinfo) is not a valid Win32 application Tried removing the patches, but no good. I fixed it by: Installing all Windows patches Shutting down Splunk services Backing up \var and \etc directories. Uninstalling Splunk Deleting any leftover directories Reinstalling Splunk Shut down Splunk services Renaming \var and \etc directories Copying the backed-up \var and \etc directories back into the Splunk directory Restarting Splunk services. All good now! ... View more

The information is in the event, so you just need to "teach" Splunk how to see it. The easiest way is to use the interactive field extractor (search for "extract fields" in the User Manual). If that isn't successful then find the extractions in props.conf (probably under $SPLUNK_HOME/etc/users/MyUserName/AppName/Local) and tweak them. They might look something like this (after tweaking): [sourcetype_name] EXTRACT-SyslogFacility = (?i)^.*-p\s(?P<Facility>[^\.]*) EXTRACT-SyslogSeverity = (?i)^.*-p\s\W*\.(?P<Severity>[^\s]*) There are umpteen different ways to extract the same data with regexes and I'm no guru so hopefully someone else can provide some tips on optimising this. For a start you could merge them into one extraction: EXTRACT-SyslogFacSev = (?i)^.*-p\s(?P<Facility>[^\.]*)\.(?P<Severity>[^\s]*) This regex says: (?i) = ignore case ^ = beginning of line .* = any amount of any character -p = "-p" \s = one whitespace (?P [^.]*) = capture any characters up to the next "." and call them "Facility" . = "." (?P [^\s]*) = capture any characters up to the next whitespace and call them "Facility" You could also use "alternatives," where you list all of the possible options that could be the facility or priority, but I'm not sure if that would be any more efficient. I find Expresso really handy for learning about and testing regexes. Just remember to add the "P" in to the capture group when you paste it into props.conf ... View more

Splunk doesn't "see" the real source host, as Kiwi is sitting in between. You need to tell Splunk where to find the hostname in the event (search for "Override default host values based on event data" in the user manual). Kiwi may "break" some extractions because it can add its own timestamp (depending on which file format you choose to save as). We are saving in "Kiwi format ISO yyyy-mm-dd (Tab delimited). For Cisco devices I use the following: props.conf [cisco_firewall] TRANSFORMS-extract = cisco_firewall_hostoverride transforms.conf [cisco_firewall_hostoverride] DEST_KEY = MetaData:Host REGEX = \S+\t\S+\s(.*)\t+ FORMAT = host::$1 The start of a Cisco firewall event that has been logged by Kiwi looks like 2011-04-15 15:18:45 Local4.Info 10.11.12.13 Looking back, my regex could be a bit tidier, but it works. The \S+\t matches everything that isn't whitespace that appears before a tab (15:18:45) The next \S+\s matches the facility and severity (Local4.Info) - the \s should probably be a \t, but it still works fine. The (.*)\t+ "captures" the host (10.11.12.13) as all the characters before the next tab. ... View more