Hello I have events similar to: 2014-07-16 9:40:20 msg="hello" time="2014-07-16 9:40:20" 2014-07-16 10:45:20 msg="world" time="2014-07-16 03:45:20" The first timestamp is used for indexing (which is OK for most of the cases) but I would like to use the content of the field time to build a specific timechart. How can I instruct splunk to do so? Thank you! ... View more

I have a legacy smallserver.example.com which works as a standalone splunk> server, indexer and search head. It has two indexes index1 and index2 . I also have now a brand new bigserver.example.com which I would like to somehow-move splunk so that: bigserver starts to index data in index1 searches would reach out to smallserver and bigserver to gather all data from both index1 The rationale for the changes are that smallserver is a historical mess, with plenty of indexes I am not interested in anymore, except for index1 . bigserver would take over the indexing and searches (but would still need data from index1 on smallserver ). I would instruct the data sources to point to bigserver . For some time the interesting data (on index1 ) will therefore reside on both servers. My questions: is it enough to deploy splunk on bigserver and somehow connect both (I was looking for the "somehow" in the docs about distributed search but they cover way more complicated cases than mine) how can I reach to index1 on smallserver while on bigserver ? I looked at how to configure search peers but again it seems overkill for my case. Thank you! ... View more

Hello I created my first map with the Google Maps app. Looks great. I now want to place this map in a new panel in an existing dashboard. I read from the docs that I should add the following example XML <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="true"> <param name="search">sourcetype=access_combined | geoip clientip</param> <param name="earliest">-24h@h</param> <module name="GoogleMaps"> <param name="height">500px</param> <param name="mapType">roadmap</param> <param name="scrollwheel">off</param> </module> </module> to my "advanced XML" (which does not exist anymore in 6.x, there is just "XML"). When I look at my dashboard I see the follwing XML <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>UnderConstruction</label> <row> <chart> <searchString>my search string here</searchString> <title>a panel</title> <earliestTime>-75d@d</earliestTime> <latestTime>now</latestTime> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="count">50</option> <option name="displayRowNumbers">true</option> <option name="drilldown">row</option> </chart> </row> <row> <chart> <searchName>something</searchName> <title>another panel</title> <option name="charting.chart">column</option> </chart> </row> </dashboard> My question is: how do I fit the first XML in the second one? (I do not see any common points, tried to put the module as if it was a chart but I get errors). Thank you in advance for any pointers! ... View more

Hello I get some data (TCP syslog) from a Juniper VPN server. Unfortunately they are incorrectly parsed by splunk because some data is prepended before the timestamp. A sample of the data (this is all in one block) is below, I have replaced by INFOINFOINFO the actual data from systlog (which varies): 197 <134>Juniper: 2014-07-03 17:11:02 - INFOINFONFO234 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO194 <134>Juniper: 2014-07-03 17:11:02 - INFOINFOINFO How can I tell splunk to discard (first example) the string 197 <134>Juniper: as the actual syslog data is afterwards? Thank you! ... View more