I am trying to parse several custom CSV files. The files are being processed on a universal forwarder which then forwards data off to central indexer. Here are the first three lines in the csv file. The lines is a note/comment. The second line is the header fields. And the data starts with the 3rd line. Don't see your tags in the report? New tags are excluded by default - go to https://portal.aws.amazon.com/gp/aws/developer/account?action=cost-allocation-report to update your cost allocation keys. InvoiceID,PayerAccountId,LinkedAccountId,RecordType,RecordID,BillingPeriodStartDate,BillingPeriodEndDate,InvoiceDate,PayerPONumber,ProductCode,ProductName,SellerOfRecord,UsageType,Operation,AvailabilityZone,RateId,ItemDescription,UsageStartDate,UsageEndDate,UsageQuantity,BlendedRate,CurrencyCode,CostBeforeTax,Credits,TaxAmount,TaxType,TotalCost,user:server_name,user:deployment,user:instance_size,user:Name "Estimated","462819316490","258616683277","LinkedLineItem","600000000095199124-0","2012/12/01 00:00:00","2012/12/31 23:59:59","2012/12/17 15:57:09","","AmazonEC2","Amazon Elastic Compute Cloud","Amazon Web Services, Inc.","BoxUsage:c1.medium","RunInstances","us-east-1b","307215","$0.06 per Linux/UNIX High-CPU Medium Instance (c1.medium) instance-hour","2012/12/10 16:31:29","2012/12/31 23:59:59","548.16826504","0.141158167","USD","77.378427","0.000000","0.000000","None","77.378427",,,, Here is the stanza in my props.conf file on the universal forwarder: [source::/var/log/billing/462819316490-aws-cost-allocation-*] sourcetype = aws-billing-cost-allocation CHECK_METHOD=mod_time SHOULD_LINEMERGE = false TIME_FORMAT=%Y/%M/%D %H:%M:%S But only the first two lines are being indexed and returned. Any ideas why? Jon ... View more

I am having problems blacklisting a sourcefile from being indexed. We currently run version 4.3 and deploy configurations to a number of remote universal forwarders. By default, our universal forwarder indexes index everything, defined as follows: #/opt/splunkforwarder/etc/apps/search/local/inputs.conf [monitor:///var/log] disabled = false There are several logs that are unnecessary and that generate large logs that I would like to stop from getting indexed. To do that, I modified inputs.conf on the indexer/search head as follows: #/opt/splunk/etc/deployment-apps/forwarder/local/inputs.conf [monitor:///var/log/httpd] blacklist = goonhilly_access As you can see, this inputs.conf file is different than the one that is used for the default configuration (search). I then deployed this to the remote universal forwarder in question and restarted. The problem is that the file is still getting indexed. Do I have a problem with inputs.conf files being in conflict? The Any ideas? ... View more

I am wrapping numerically names fields in $...$ to force splunk to interpret them as field names. This works great in interactive search, but is breaking saved search. For example: eval 800k=round($800k$/360,1) generates the following error when used in a saved search: [SimpleResultsTable module] Server reported HTTP status=400 while getting mode=results Error in 'eval' command: The expression is malformed. An unexpected character is reached at '/360,1)' Any idea why? ... View more

Is there any way to explicitly typecast a number in Splunk so that it is interpreted as a string literal rather than as a number? IE, I want '64' to be interpreted as a string rather than as an integer. Is this possible? ... View more