Glad I could help! Can you mark the answer as accepted? (Click the checkmark) That way anyone finding this in search later knows it has a working solution. Thanks! ... View more

What is the timeframe of your search? The section without an explicit earliest/latest will be bound by the timeframe you select in the UI. ... View more

Multisearch isn't necessary. Just use simple boolean operators. (index=A earliest=-1d@d latest=@d) OR (index=B) | ... modify earliest/latest requirements as needed. ... View more

Subsearches can be useful, but be careful with them. They essentially add 'foo' OR 'bar' OR 'baz' OR ... to your search, which gets really messy when the sub search returns a lot of values. I also highly recommend ending the sub search with the | format command, as that will format the output in proper search terms. (ContextId=12345) OR (ContextId=23456) OR ... ... View more

You just search for exactly what you said: (AppName="Master" Status=500) OR AppName="AppServices-Master" | stats first(Name) as Name first(Status) as Status by ContextId | stats count by Name It is also worth noting that including filters on Index and Sourcetype can significantly help performance, so include those in your initial search whenever possible. ... View more

A easy way to do this is with the transaction command: <search which gets both types of events> | transaction ContextId | search Status=500 | stats count by Name But the more efficient way is with stats: <search which gets both types of events> | stats first(Name) as Name first(Status) as Status by ContextId | search Status=500 | stats count by Name ... View more

Put the following after your transaction: | eval duration=if(eventcount==1, case(Event=="LOG_OFF", _time-relative_time(_time, "@d"), Event=="LOG_ON", relative_time(_time, "+1d@d")-_time), duration) This does the following: Checks if eventcount==1. If not, it uses the existing duration value. If Event=="LOG_OFF" then it calculates the difference between the timestamp and the start of the day. If Event=="LOG_ON" then it calculates the difference between the timestamp and the start of the next day. That will allow transactions with a proper start/end to keep their transaction generated durations, while incomplete transactions will show durations according to your conditions. Then you should be able to do stats as expected. ... View more

Here's how I would tackle this with stats. (This assumes each ip address can only appear in each data set once) index=A OR index=B | rename sourceip as ipaddress | stats count first(name) as name first(packets) as packets first(category) as category first(classification) as classification by ipaddress | where count>1 The where filter will omit anything which only shows up in both datasets. (You could also filter on a specific field being null, such as |where isnull(category) for example. ... View more

I've not composed my own scripted input, so I don't know why it's not working in splunk. I will recommend checking out the scripted inputs included in the app as potential reference. (etc/system/bin/external_lookup.py for example) Good luck! ... View more

Your props.conf stanza indicates that the lookup only applies to the [externalLookup] sourcetype. Is that intended? If you're planning to manually invoke the lookup in search (as in your example) then there doesn't need to be anything in props.conf for this. Your lookup script itself should live in etc/apps/search/lookups/ as well, not /bin. Finally, the last question is scope. As configured, the lookup is only available in the search app context. If you're in another app, it will give you the error you're seeing. You can change this by adding an export to /etc/apps/search/metadata/local.meta [lookups] export = system You may also need to restart splunk for the lookup to be visible. ... View more

Thank you! Another reason to beg and plead to get our enterprise install upgraded. Does this mean there is no mechanism to do what I want in Splunk 5.x? ... View more

You don't need to do anything special in Splunk for this. Just change the formatting in Excel from 'General' to 'Number'. You may also need to remove decimal places, but that's trivial. (See below) It's worth noting that the change to scientific notation (and all formatting changes) in Excel are all in display only. The underlying data is not modified, and no precision is lost. If you ~really~ need it to be a string, you can do something like the following: index=_internal | head 10 | eval foo=1234567890123 | table foo | eval foo2="\""+tostring(foo)+"\"" ... View more

1) Once something is indexed in Splunk, it's in Splunk. Changing the monitor settings doesn't delete the data from your index. Deleting the old files doesn't delete the data from your index. You can selectively delete data from Splunk, but that only removes it from search results, not from the index itself. (So it doesn't free disk space or anything) Generally this isn't recommended. You can find out more about the delete command here 2) You probably don't want a real-time alert here. It would be much better to set up an alert with a short interval that only searches within that interval. So set up your search to look at the past 5 minutes, and then run every 5 minutes. It'll only trigger on new events, as you don't look at the same span of data twice. It also won't monopolize a CPU to keep a realtime search running. ... View more

The airport data app is included when you install Splunk 6. (Look for an app named "Splunk 6 Overview") This includes data models and pivot. ... View more

Some added details: If the thing separating your pairs (in the above, the space and equals characters) could occur in your values, then quote them. key=some_value key2="Some value" key3=12345 key4="prop1=foo prop2=bar" Something like that will auto-extract very well with splunk, and you end up with: key = some_value key2 = Some value key3 = 12345 key4 = prop1=foo prop2=bar prop1 = foo prop2 = bar ... View more

can you post your final serverclass.conf? I tested the format I gave you locally, and it worked as expected. ... View more

The problem is where your whitelist= lines live. Those are only valid in global or serverClass stanzas, not in app stanzas. (Which is where you have them) Your stanzas should look like the following: [global] stateOnClient = enabled filterType = whitelist continueMatching = true [serverClass:serverclass1] continueMatching = false whitelist.0=matchingclient [serverClass:serverclass1:app:app1] [serverClass:serverclass2] continueMatching = true whitelist.0=* [serverClass:serverclass2:app:app2] ... View more

So if you have something like: [serverClass:clientSpecific] whitelist.0=matchingclient continueMatching=false [serverClass:clientSpecific:app:bar] [serverClass:general] whitelist.0=* [serverClass:general:app:bar] then the general class no longer matches and the apps are uninstalled? ... View more

With the way your events are formatted, Splunk should have no issue automatically extracting the fields with zero configuration. I think the primary problem with your setup is the KV_MODE = none setting. This tells Splunk not to do any automatic key-value pair extraction, which is the opposite of what you want. Get rid of that setting in all of your props.conf stanzas, and get rid of the [logger_field_extraction] stanza in transforms. I would expect your fields to work as expected after that. If you insist on keeping KV_MODE = none, then change your transforms stanza as follows: [logger_field_extraction] DELIMS = " ", "=" Keep in mind that may get inconsistent where your values can contain spaces. Auto-parsing handles this when the values are quoted, as yours are. ... View more

As aholzer says, make sure your rex is properly extracting your date. Then give us an example of what the extracted date looks like. Then we can possibly give you a suggestion for how to convert it. ... View more

Include the following line in your stanza: continueMatching = false And then make sure all other stanzas with whitelist=* come after that stanza in your conf file. Details can be found in the documentation EDIT FOR CLARITY: Your stanzas should look like the following: [serverClass:specificHost] continueMatching = false whitelist.0 = specificHost [serverClass:specificHost:app:foo] [serverClass:broad] whitelist.0 = * [serverClass:broad:app:bar] Note that the app stanzas are separate stanzas from the serverClass stanzas. So you can't put the whitelist under them. ... View more