Most probably your the values are tab separated. I assumed spaces. You could verify this in an good text editor or by using cat : cat -T yourfile.txt ... tabs will be displayed as ^I ... View more

You might open a case on splunk support for that. What Splunk Version are you running btw? Certainly something with the monogdb (kvstore): https://github.com/cvallance/mongo-k8s-sidecar/issues/77 All the best, Björn ... View more

Okay ... as for me, there are two approaches: (A): dynamically use the header within your first line (I think it is the text after the last occurance of #012 ) at index time (not detailled here) (B): Use rex on _raw in a slightly different way. I used \S (capitalized) to match everything but white spaces and \s (lower case) to match white space. There is one odd field (third to the end) that sometimes is filled with NULL, sometimes not at all. Moreover the "DB Server Type" is not always present. I used your raw data from above where I had a leading space in each line. I think that is due to copying it from here. That is the reason for me starting the regex with ^\s{0,1}... . Using this spl/regex I have the data in fields to start working with: index="main" sourcetype="..." | rex field=_raw "^\s{0,1}(?<field_01>#\d{3})(?<field_02>\S+)\s{6}(?<field_03>\S+)?\s+(?<field_04>\S+)\s+(?<field_05>\S+)\s+(?<field_06>\S+)\s+(?<field_07>\S+)\s+(?<field_08>\S+)\s+(?<field_09>\S+)\s+(?<field_10>\S+)\s+(?<field_11>\S+)\s+(?<field_12>\S+)\s+(?<field_13>\S+)\s+(?<field_14>NULL\s+)?(?<field_15>\S+)\s+(?<field_16>\S+)\s+$" | eval "Last Response" = field_05." ".field_06 | rename field_01 as "PREFIX" field_02 as "S-TAP Host" field_03 as "DB Server Type" field_04 as "Status" field_07 as "Primary Host Name" field_08 as "KTAP Installed" field_09 as "TEE Installed" field_10 as "Shared Memory Driver Installed" field_11 as "DB2 Shared Memory Driver Installed" field_12 as "LHMON Driver Installed" field_13 as "Named Pipes Driver Installed" field_14 as "UNKNOWN" field_15 as "Hunter DBS App Server Installed" field_16 as "Count" | table "PREFIX" "S-TAP Host" "DB Server Type" "Status" "Last Response" "Primary Host Name" "KTAP Installed" "TEE Installed" "Shared Memory Driver Installed" "DB2 Shared Memory Driver Installed" "LHMON Driver Installed" "Named Pipes Driver Installed" "UNKNOWN" "Hunter DBS App Server Installed" "Count" ... View more

Thats fine with me 🙂 Are all indexer running on the same plattform / version? And are all sources inputed the same way (all monitoring stanzas?) As for platforms, there might always be a whole set of pitfalls: - EOL: LF vs CRLF - paths: forward slash vs back slash - ... Good luck ... View more

In your props.conf stanza you have to type double colon ( :: ) after source : [source::<SOME_SOURCE>] ... View more

Yes, and if you want to reindex, you have to set crcSalt ... https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf ... View more

Hey, Your data looks kind of mixed (first line in comparison to the rest). How much information do you need from line #1? The Events, starting from line #2 look structured enough to let splunk auto-extract fields. On top of those events, some spl should yield into the desired result. ... View more

Hi, your regex does not look like it is written for you raw data? Moreover you might want to put that into an extra app and not into system/local . Maybe something like this might go into your intended direction: props.conf: [source::D:\\SplunkTest\\confidencial.log] TRANSFORMS-anonymize = cpf-anonymizer transforms.conf: [cpf-anonymizer] REGEX = ^(.+?),cpf:.*$ FORMAT = $1,cpf:########### DEST_KEY = _raw Edit: simplified regex, added props.conf and removed single quotes as mentioned by @ddrillic, thanks. This will take everything after ,cpf: until the end of the event and replace it by ########### . Hope that helps. ... View more

HI, maybe a dashboard with input forms will help better than putting the whole user guidance into a modal. But that could be a bad idea as well. As far as modals go, there are some points of information: - either you might have a look into using Bootstrap Modal: https://www.w3schools.com/bootstrap/bootstrap_modal.asp | http://docs.splunk.com/Documentation/Splunk/7.2.1/ReleaseNotes/Bootstrap - Make use of this App: https://splunkbase.splunk.com/app/3672/#/details - Look into this dev articel from 2014: https://www.splunk.com/blog/2014/02/24/using-bootstrap-modal-with-splunk-simple-xml.html Good luck! ... View more

Due to feedback from slack this behaviour is only showing in 6.5.2. Not in 6.5.1 nor in 6.4.2. ... View more

Hey, thanks for the feedback. the first one results in two an additional column named * , which does not disappear if sorted. my field does disappear though the second one results in a table where my field still disappears ... View more

Hey Giuseppe, I certainly could fix each field (table column) with this odd behaviour using fillnull value="" <FIELD_1> <FIELD_2> ... <FIELD_n> . But I need something more universal. Like the default behaviour of fillnull : field-list Description: ... If not specified, fillnull is applied to all fields. source: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Fillnull Do I have to file a bug here? ... View more

Hi, in Splunk 6.4 you could also use the new "Build A Custom Visulization" Feature: Release Notes: Link Developing Views and Apps for Splunk Web: Link Build a custom visualization: Link Cheerz - Björn ... View more

I had the exact same problem. I think your xml code has to start with the panel-element. My xml started with some xml comment, which narrowed down my edit options in Splunk UI. ... View more

Thanks for you input on this. I actually missed the batch_save endpoint. For #2 and #3: One could use the kv store as an interface to master data systems. Moreover in a scenario where (critical) process data is stored within the kv store the customer might be interested in having a non-proprietary access to this kind of data. ... View more

I had to edit my post above (angle brackets). Add an EXTRACT field extraction stanza to props.conf: http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Add_an_EXTRACT_field_extraction_stanza_to_props.conf This would result in something like this: [sourcetypeStanza] ... EXTRACT-myfield = (?:[^\x1d]*\x1d){6}(?:[^\x1c]*\x1c){10}([^\x1c\x1d]*) in Msg ... View more

Hi! How does this work? sourcetype=dhcp eventtype="nix-all-logs" | table dhcp_mac dhcp_ip dhcp_hostname | stats count by dhcp_mac dhcp_ip | where count > 1 ... View more

Either extend your macro or write a new one like this (macro name: setNewField(2) 😞 eval $fieldName$ = `getIpBasedOnMac($mac$)` Then this: ... | eval newField=`getIpBasedOnMac($mac$)` | chart values(field1) over newField by mac would change into this: ... | `setNewField(newField,mac)` | chart values(field1) over newField by mac ... View more