This is a thread from so long ago and is about a long forgotten version. Nowadays collect is much more flexible, especially if you're using output_format=hec ... View more

had | join query, it now works adding also : [subsearch] maxout = 700000 [searchresults] maxresultrows = 700000 ... View more

Thanks for the information, it was a tremendous help. This is what I used for subject: "ssl_subject\="(CN=(?<ssl_subject_common_name>[^=]*))?(C=(?<C>[^=]*))?(S=(?<ssl_subject_state>[^=]*))?(O=(?<ssl_subject_organization>[^=]*))?(OU=(?<ssl_subject_unit>[^=]*))?" ssl_start_time" This is what I used for issuer: ssl_issuer\="(CN=(?<ssl_issuer_common_name>[^=]*))?(C=(?<C>[^=]*))?(S=(?<ssl_issuer_state>[^=]*))?(O=(?<ssl_issuer_organization>[^=]*))?(OU=(?<ssl_issuer_unit>[^=]*))?" ssl_hash ... View more

check out the meta woot app, it makes monitoring your hosts sourcetypes and indexes real simple and includes some compliance reporting you can build on top of: https://splunkbase.splunk.com/app/2949/ It uses summary indexing and hashes the host sourcetype index combos in kvstore allowing for super performant searching of this data and takes some of the leg work out of having to craft searches like this... ... View more

I use this for managing a large number of hosts. In one case I temporarily used it with up to a nine thousand host entries. Entry in the serverclass.conf [serverClass:specific_host] whitelist.from_pathname = etc/system/local/host.txt restartSplunkd = 1 ... View more

subsearch has a limit. can we use simple stats to find what's missing in two sourcetypes based on a common field ... View more