Hello, this worked!! Thanks 🙂 ... View more

The < (less-than sign) is a special character in regular expressions, and must be escaped. Also, I have found that it works best to specify "non-capturing" parentheses. So I would use this regular expression, and I think it would do what you want. BREAK_ONLY_BEFORE = (?:\<jms-system-resource>|\<jds-datasource) ... View more

For a LINE_BREAKER that does not ever match, I use LINE_BREAKER = (?!) ... View more

have you tried using spath command http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Spath all the best, and happy Splunking!! ... View more

Put the scripted input on your actual Windows forwarders. Simply follow the steps for setting up a scripted input in the documentation. ... View more

Yes, that's correct. ... View more

Thanks. I think I actually want to reword my question to look at a better solution. Will delete this and raise another ... View more

It is awesome that they built this into version 6.2+! I tried it, but with no luck. What I would to get is the IP address of the Splunk UF associated with an event. We have a ton of events coming from cloud hosts which have artifical hostnames that we have created and assigned in the inputs.conf. So I can't use "host" value in splunk for a reverse lookup. What I really want to reveal is the ip associated with the Splunk UF agent for each event. I can see these ip addresses in the Deployment Server view but they are lost as my search head view. Any suggestions? ... View more

Starting in Splunk 6.1, this ability is built into the product. Edit your search and look under the "Click to edit email action" link in the "Alert Actions" section. It's a simple check box you can uncheck. It's in the picture in step 4. http://docs.splunk.com/Documentation/Splunk/6.1.1/Alert/Setupalertactions ... View more

Thankyou! This works 🙂 ... View more

Yes, it is intended behavior. As a rule, we don't use any _* fields in mvcombine. This is because you may often see events that differ only in internal fields that are not shown (i.e. _cd), and then wonder why they weren't combined. ... View more

Hello thanks the Break in "<machine name" works very well in props, but I would now need to do a sort of sub break and take the machine sections and break them up again (they have multiple value sections)... any idea about how to do this? ... View more

I still don't understand this. They are in different indexes, but they are on different indexers, reporting to different search heads... so how can this work? ... View more

I just tried using this and works pretty good. Is it possible to apply the css to a certain field insted of the row? ... View more

You may be missing essential firefox components on your linux server. (apt-get install firefox) or equiv. for your flavor of linux (this fixed this for me). Also - is your Splunk instance running as http or https? If you are using https, you MUST use a valid SSL cert, or you'll just end up in "certificate is not valid" hell. 🙂 Gary ... View more

Hi @Janakiramanmani ·, can you provide your xml so that I can guide you .... ... View more

Hi Hazel, it seems like you lost the "multivalue" property for those fields. Have you tried to force a: ... | makemv delim="<proper delimiter>" factoryconfig | makemv delim="<proper delimiter>" config at the end of the search string? You might have to cook a delimiter into the original fields to be able to split them at the end of the search string. I was able to obtain a messed up table as in your example with this query: index="test" earliest=-10d | rex field=source "(?<path>(\w+\\\\)+)" | bucket _time span=10m | transaction path | fields host, path, source | fields - _time | join s max=0 [search index="test" earliest=-10d | rex field=source "(?<path>(\w+\\\\)+)" | rex field=source "(?<filename>[^\\\\]+)$" | bucket _time span=10m | transaction path | fields host, path, source, filename | fields - _time] And was able to restore the multivalues by appending this at the end: ... | table host source path filename | makemv delim=" " source | makemv delim=" " filename Hope that helped you out a bit ... View more

Hello. Not to worry, I was misunderstanding the answer - as pointed out above now, I can't have a multiline field. However, I am now trying to implement your stats list which was working great on individual searches until I tried to join them, would you have any ideas? - http://answers.splunk.com/questions/1912/using-multiple-stats-list ... View more

dejavu should at least be installed. Ideally installing the firefox package will pull in sufficient fonts to get reasonable rendering of web pages. Perhaps you can just ask rpm what packages it depends on, and grep through there for the font list? ... View more

gkanapathy is right about your problem is. I just had a few thoughts that wouldn't fit in a comment. Just so you know, you can use named capture groups, like (?<emsinstance>\w+) in your transforms.conf file just like you do using rex . When your using named groups, you don't need the FORMAT line anymore. I found that this approach makes it quicker to jump between interactive testing with rex and then copying the regex into my transforms.conf file. In this case, you also have the option of using an EXTRACT entry in your props.conf file. I rather prefer this approach, since you can setup everything in one place, and you don't to come up with some arbitrary name transformer name. 😉 Here's an example in props.conf : [source::/app/ems/envs/uat/*/logs/trace.log] EXTRACT-fields = [/\\]uat[/\\](?[\w_]+)[/\\]logs[/\\] in source Notes: I use [/\\] because it will match both unix-style and dos-style paths (if that's a concern for you and you can use that in your source config entry too, although it looks ugly: [source::[/\\]app[/\\]ems[/\\]envs[/\\]uat[/\\]*[/\\]logs[/\\]trace.log] ). You may also note that I'm not matching the whole path in the regex, which is because in this case, you really don't need to, your [source::...] stanza is doing that work for you already. ... View more

I think there might be some options here: http://www.splunk.com/base/Documentation/latest/Developer/ChartReference or maybe the "bar" vs "column" charts would work, or maybe one of "width" or "orientation" settings would work. I haven't really used these. ... View more