Hello, I am trying to set up the Splunk App for Web Analytics and I am running into some problems with the Generate Sessions and Generate Pages searches. I have gone through setting up my sites, made sure that our sourcetype was listed included in the web-traffic eventtype, and included the index that contains the web traffic was included in my users "default indexes to search". I can search within the App for tag=web and I see results being returned. When I go to run the searches to fill the lookup tables it says that not results where found. I have double checked everything from the first two steps and everything appears to be correct. Any idea on why these searches aren't working and any way for me to troubleshoot further on what's going wrong? ... View more

Hi, We are filtering messages from our Cisco ASA logs that contain Teardown and Buildup, but we recently wanted to include messages that include SYN Timeout. The problem with the messages that contain the SYN Timeout also contain Teardown, which are getting filtered out by our transforms.conf file. My question: Is there a way for us to filter out the messages that contain Teardown, but keep the messages that keep SYN Timeout even though they contain the Teardown string? ... View more

Hello, I am trying to get dynamic sourcetype working for a set directories under Splunk. The intention is that the folder that contains the logs will be the sourcetype, and there are many folders underneath the Splunk directory that we are performing this on. Below are the configs I am using to perform the monitoring and sourcetyping of the logs. The issue that I'm having is that the configs do not to seem to work at all, I know the inputs.conf works by itself, but adding the props and transforms doesn't seem to work at all. inputs.conf: [monitor:///var/log/splunk/.../*.log] disabled = false recursive = true index = dev_test props.conf: [source::/var/log/splunk/.../*log] TRANSFORMS-sourcetype = override-sourcetype transforms.conf [override-sourcetype] SOURCE_KEY = MetaData:Source DEST_KEY = MetaData:Sourcetype REGEX = source::([^/]+)/[^/]+.log$ FORMAT = sourcetype::$1 Any help would be greatly appreciated. I've been banging my head against the wall trying to figure this out. ... View more

Hello, I have a monitoring stanza in my inputs.conf that is intended to monitor everything that is in /var/log/splunk that ends in .log. Reading the guides online, the triple dot ... is supposed to monitor every directory under splunk. The only thing is that nothing is getting indexed into Splunk. I'm not sure what is wrong with this stanza, any help would be greatly appreciated. [monitor:///var/log/splunk/...] disabled = false recursive = true whitelist = .log$ index = dev_test sourcetype = splunk_test ... View more

Hello, I am trying to generate reports of what packages and versions are installed on our hosts. The package source from the unix app is helpful, but doesn't extract the fields with NAME, VERSION, RELEASE, ARCH, VENDOR, and GROUP. Has anyone been able to extract these fields? Thanks. ... View more

I have some logs where there are actions and a site associated with that action, for example CREATE , site_1 . I am trying to have a count of how many CREATE , DELETE , UPLOAD , etc for each site in a table. I can get it by doing a stats count(site_name) by action , but all I get returned is just a count(site_name) for the second column instead of the individual site names. ... View more