Hi guys I got a trouble on getting data to Splunk by java and I really need your help! I followed the instructions of To add data directly to an index in http://dev.splunk.com/view/java-sdk/SP-CAAAEJ2#add2index , using the attachWith method. Here is my code: public static void main(String[] args) { ServiceArgs serviceArgs = new ServiceArgs(); serviceArgs.setUsername("admin"); serviceArgs.setPassword("admin"); serviceArgs.setHost("local"); serviceArgs.setPort(8089); Index myIndex = service.getIndexes().get("folder"); try { myIndex.attachWith(new ReceiverBehavior() { public void run(OutputStream stream) { Event event = service. DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd-HH:mm:ss"); String date = dateFormat.format(new Date()); String eventText = date+" text=Testing!"; try { stream.write(eventText.getBytes("UTF8")); } catch (UnsupportedEncodingException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); } } }); } catch (IOException e) { e.printStackTrace(); } } The event was successfully indexed by Splunk, but with sourcetype "http-stream-too_small". By submit method in To add data directly to an index, it provides arguments to set the values of host, source, sourcetype and so on as we want. However, I don't see any argument as such in the example of attachwith method. Is it possible to customize the host and sourcetype by this way? ... View more

Hi guys, I have a device monitored whose system time is set 8 hours earlier than the Splunk server. Every time I search the data of device I have to set the search time 8 hours earlier and some weird things happen when I search this device with the other. Since I cannot change the system time of this device, can I change the timezone by changing some configurations of the forwarder and make the _time of the data from this device the same with the Splunk server? Thanks in advance. ... View more

Hi guys, I want to make a table with list in it with Splunk and I really need some help! I got a IPS to analyse and to see which source ips some certain attacks were from. When I get an ipA from attackA, I would like to how many times ipA did the attackA, which destiny ips are influnced and by how many times, and is there any other attacks ipA does. Here is my search line: index="security" attName="$some certain attack name$" | stats count as c by src attName des | stats sum(c) as total list(des) as desips list(c) as LC by src | join src [ search index="security" | stats values(attName) as otherAttack by src ] | table src total desips LC otherAttack | sort -total The table I expect to get is like: src total desips LC otherAttack 14.18.240.6 18 172.25.118.53 1 Adobe Reader And Acrobat Privilege Escalation Vulnerability 172.26.67.198 5 Microsoft Windows HTTP Services Integer Underflow Vulnerability 172.26.68.201 8 172.26.69.46 2 172.26.71.193 2 14.18.256.74 6 172.25.118.43 1 Adobe Reader And Acrobat Privilege Escalation Vulnerability 172.26.68.208 2 172.26.71.193 3 But what I really got was like: src total desips LC otherAttack 14.18.240.6 18 172.25.118.53 1 Adobe Reader And Acrobat Privilege Escalation Vulnerability Microsoft Windows HTTP Services Integer Underflow Vulnerability 172.26.67.198 5 172.26.68.201 8 172.26.69.46 2 172.26.71.193 2 14.18.256.74 6 172.25.118.43 1 Adobe Reader And Acrobat Privilege Escalation Vulnerability 172.26.68.208 2 172.26.71.193 3 I found that if I put values/list in a subsearch, the values of the field values/list will be all put in one row. I tried "| stats delim="/n" values(attName) as otherAttack by src" and didn't work. How can we separate them in different lines in one cell? ... View more