Still good after all these years ... View more

Just to update this thread and share that this stills working My context: I deployed recently a cluster env. and did not noticed that i my filesystem was getting close to the limit I realized when all my indexers status=AutomaticDetention As i was aware that the data was useless i followed your approach and worked ... View more

I had similar issue and nothing worked for me. Below props and transforms worked for me in my scenario where it ignored the lines started with #: transforms.conf: [setnull] REGEX=^[#\r\n] DEST_KEY=queue FORMAT=nullQueue props.conf: [sourcetype] TRANSFORMS-ignore_comments = setnull ... View more

Please be sure to get @rgresham_splunk  instead of me as I may not be able to help as much 🙂 ... View more

Bingo! That fixed it thank you very much! ... View more

Have a similar issue using Insights for Infrastructure. SMTP settings correctly set up. Alerts set up, but nothing showing up in python.log (empty 0kb) and no maillog.log file found. Are there other tests I can run from within Insights For Infrastructure to ensure splunk can send mail out and then we can focus on alerting? any help is appreciated ... View more

Thank you for reply. I have heard that we have splunkjavalogging library. which may solve my problem. Why I am going for memory is, for some conerns I could not write logs to file. Using SplunkLogging we can directly write logs to Splunk sever. Thanks & Regards, Yamini ... View more

Hi Rob, I have changed the "-" to "_". Thank you for your suggestion. I have also verified with btool that there are no overrides for iport_syslog. The only processing is done by those props/transforms. At this point I am baffled. All the transforms I have in the file work like a charm and the events show up formatted exactly like I want them to. The sourcetype rename is not kicking in. There is something I am missing but I can't see it! Theoretically this should work, right? ... View more

This will get the last value: rex ">(?<lastvalue>[^>]+?)!!$" ... View more

the search mode of smart/verbose/fast is not relevant in advanced XML because the framework handles the choice automatically. Basically if one or more modules are present in your config that implicitly requires a slower mode to be used, then that search will be dispatched with that slower mode. If you aren't using a reasonably recent Sideview Utils, the framework may be dispatching some searches inefficiently, but it's basically automatic. If you pastebin your XML I can comment as to what changes you could make. ... View more

Adding this to the the output seem to stop the heartbeat data for me heartbeatFrequency=0 eg. [tcpout:something] heartbeatFrequency=0 ... View more

so much awesomeness ! ... View more

+1 on a nice use of coalesce! ... View more

It is not taking the maxout configuration that is 100 events in a search query by defafult. Try this CLI example: Without maxout: ./splunk search "| savedsearch name" -output csv > /data/test/export.csv (in jobs view) | savedsearch Datos_Grupo_9 | head 100 | export add_timestamp=f add_offset=t format=csv segmentation=raw With maxout: ./splunk search "| savedsearch name" -output csv -maxout 0 > /data/test/export.csv (in jobs view) | savedsearch Datos_Grupo_9 | export add_timestamp=f add_offset=t format=csv segmentation=raw ... View more

In my personal experience, using ntpd doesn't completely eliminate the issue. Granted that the frequency goes down from every 10 minutes (when I cron every hour), to a few of them using ntpd. Maybe the timestamp checking is just too strict? ... View more

Unfortunately, this error message is very ambiguous because it really is just saying that the socket Splunk is listening on was not closed by Splunk. How or what closed that socket, even if it was done correctly, is something Splunk has no information on. There are a variety of possible reasons that this message can appear and in a distributed search on older versions of Splunk, it can definitely be a red herring. You may wish to double check your results of the search against the raw events. Due to the wide variety of reasons that the socket may close and spawn this warning message, its hard to say what the root cause might be. This ranges from the OS doing some clean up, to timeout settings, to network latency, cluster timeouts, performance limitations, etc. Streaming and non streaming search commands would pretty much have no effect as we are talking about different types of "streaming". The only exception would be in case of a search performance issue where making the search more performant may help in avoiding the error. Troubleshooting this error should start with checking the metrics for the search(audit.log, metrics.log, search.log from the dispatch) that generated this error message. In other words, find out if there is a performance issue for the as this is one of the most common causes of the socket being closed prematurely and causing this error to appear. Corresponding to that, checking the splunkd.log will give an indication of what splunkd is doing at the time of the error but you will want to take a look at events before and at the time the error occurs as there may be an underlying issue. An example of such might be that a timeout has occurred for reaching a search peer, or perhaps the splunkd processor is spending a lot of time in one of the processing queues, etc. If the error happens with every search and is a global problem, then you may want to focus on finding errors in splunkd if there are only certain searches this occurs with then you will want to investigate the search job. When opening a case to support for this error message, you will want to include a diag file and the dispatch folder for when the search ran that causes the warning message to be displayed. Depending on the issue, more information may be required and the support team will request it when needed. ... View more

Check this out http://apps.splunk.com/app/413/ ... View more

Changing the sources or sourcetypes, will prevent the issue to grow on the long term , but not improve the indexing speed. Except if you can roll the previous buckets to frozen. ... View more

Thanks. This combined with a little more searching helped me find the syntax. http://splunk-base.splunk.com/answers/3435/escape-and-in-the-xml-of-dashboards?utm_source=supportcase&utm_medium=link&utm_campaign=relatedanswers&utm_term=Syntax+error+when+adding+regex%27s+in+the+XML+of+a+dashboard ... View more

I'm guessing you could do this in several ways; 1) through the use of rex in the search pipeline ...| rex "<dist>(?<dist>[^<]+)</dist>" max_match=0 | ... 2) through props/transforms props.conf [your_sourcetype] REPORT-blah = dist_extract transforms.conf [dist_extract] REGEX=<dist>([^<]+)< FORMAT = dist::$1 MV_ADD=true Perhaps also xmlkv can provide multivalued fields, but I have little experience of that particular search command. Hope this helps, Kristian ... View more

You can define the sourcetype of your events in the appropriate inputs.conf file for the syslog monitoring stanza you have setup with something similar to the following. [tcp://syslog.corp.company.net:514] sourcetype = syslog Here is a link to the Splunk documentation for further information: http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureyourinputs#A_word_about_source_types ... View more

Thank you very much. I'll try these suggestions and see what happens. ... View more