I just ran into an issue with the accepted answer. While the $ work for a normal query. When using it in a dashboard the $123$ is evaluated as a dashboard token rather than a field. For a dashboard you must change it to single quotes.   | stats count as 123 | eval abc = round('123', 2) ... View more

In my case I'm eliminating header using transforms.conf before it indexing . So still can I able to capture timestamp from the csv file from each row. your answers could help me a lot.    Props.conf TRANSFORMS-eliminate_header = eliminate_header INDEXED_EXTRACTIONS = CSV FIELD_DELIMITER = , TZ=UTC TIMESTAMP_FIELDS = Date,Time HEADER_FIELD_LINE_NUMBER = 1 Transforoms.conf [eliminate_header] REGEX = "Date"|"Time"|"Action"|"Category Name"|"Localized Country"|"Policy Name"|"User"|"Workstation"|"Domain"|"Protocol"|"Query" DEST_KEY = queue FORMAT = nullQueue ... View more

Okay. To use the third timestamp, you're going to have to use TIME_PREFIX with something like: TIME_PREFIX = ^(?:[^\,]*,){16} i.e., skip the first 16 field/comma sets. ... View more

Update on this. Answer by Ayn was helpful in finding a couple of syntax errors, but the primary issue persists. [source::/var/log/billing/462819316490-aws-billing-detailed-line-items-*] sourcetype = aws-billing-detailed CHECK_METHOD = modtime SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD = -1 TIME_FORMAT = %Y-%m-%d %H:%M:%S Note: I am setting checkmethod = modtime just to make debugging easier. Once I figured this out I will remove it. But this is still not properly extracting the time from the field showing in the original data snippet. ... View more

Hello, I have been having a lot of issues with my database lookups as well. Does your user_agent_parser.py script output when you call it to the command line...eg, if you parse an csv file to the script, does it connect to the database correctly and give you the desired output? I would love to know how to debug the lookups correctly as well, so if you find your answer I think I will find my answer. Regards, Vince ... View more

Index-time, no. Luckily, as it would have horrible performane implications 😉 Search-time, certainly. Set up a script that serves as a dynamic lookup. More information in the docs here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script ... View more

I believe the line needs to be in regex format (according to: http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/Whitelistorblacklistspecificincomingdata). so, it should read: goonhilly_access$ where $ = end of line ... View more

That's not the question. THe problem is that the sourcetype is not getting set now that the props.conf is being menaged in the deployment by the deployment server instead of being configured manually on the forwarder box. ... View more

Go into the manager, then into access controls, click on roles, select the relevant role and make sure the relevant index is applied to their role. If the index this file is going into is on the left hand side under "Indexes" (and not in the grey box on the right hand side) then you need to click on the green arrow beside the index name so it gives the role permission to search on that index. Also you may wish to make it a part of the "Indexes searched by default" so that when they run their search they do not need to explicitly specify the index=whatever cheers ... View more

jcbrendsel, The "sample_app" app ships with Splunk and is told to index the following by default: ## inputs.conf [monitor://$SPLUNK_HOME/etc/apps/sample_app/logs] index=sample sourcetype=sendmail The error is likely caused by the disablement of the sample index that also ships with this app. I would recommend disabling the "sample_app" altogether, or re-enabling this index. ... View more

I use ResultsHeader module after a HiddenSearch module in my advance XML dashboards which will display the following: 123 results in the last 60 minutes (from 2:28:00 PM to 3:28:50 PM on Wednesday, April 20, 2011) in your dashboard. Example of the module in my XML: <module name="ResultsHeader"> <param name="entityLabel">results</param> <param name="entityName">results</param> Then make sure to close it out. Another option you could play with is SimpleResultsHeader, specially when working with drilldowns: <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">$time$</param> </module><!-- SimpleResultsTable--> Link with more info: http://www.splunk.com/base/Documentation/4.2.1/Developer/ModuleReference#ResultsHeader Hope this helps Travis. ... View more

You may want to look at the concurrency search command, if you're trying to just count the number of transactions running in a span: http://www.splunk.com/base/Documentation/latest/SearchReference/Concurrency If you're doing more than that, I'm not sure, it would depend exactly what you were trying and what the data looked like. ... View more

I can confirm that SEDCMD is ignored by a Universal Forwarder's local props.conf except if the sourcetype stanza's force_local_processing clause is = true (in which case a SEDCMD on the indexer will be ignored). ... View more

Old topic but someone may find it via google looking for a solution. For me saved search with map command, to which $variable$ is passed worked in the following way... savedsearch_1: foo | map savedsearch_2 var1=$var1$ var2=$var2$ savedsearch_2: search bar | where var1=$var1$ var2=$var2$ | head 1 Trying different syntax like: foo | map search="search bar | where var1=\"$var1\" var2=\"var2\" | head 1" worked well in interactive search but on saved and scheduled the variables weren't passed to the map command so the search always was returning no results. ... View more

It could be a bug. However there is a known behavior difference. In the search view all fields are requested. In a scheduled environment, only the requested fields are generated from the data. it's possbile that there's some further wrinkle about the fields command needing to be at the right point in the pipeline, I don't fully undrestand your search at the moment. You may want to try the search in the 'advanced charting' view which should skip requesting all the fields and possibly allow you to debug. ... View more

Are you using Splunk's deployment server to manage forwarder configurations? That should be the best way to solve the issue. Otherwise, you could use props/transforms stanzas to override the sourcetype assignment at runtime. You could run a regex on the "source" field and assign a predefined sourcetype if the event matches the regex. You can find lots of details here: http://www.splunk.com/base/Documentation/latest/Admin/Advancedsourcetypeoverrides ... View more

Nice I was able to help. Actually those commands have different use cases. "fields" actually restricts the field extractions automatically performed by Splunk (..| fields + A B C will discard all the fields which are not A, B or C). You can use it to boost performance as there's no need to compute stats for the fields which you dismisse. "table" instead is used to show the selected fields in a tabular manner (in the "results table" panel), while the others are still hanging in the field picker (so no performance increase there). ... View more

Thanks. That did the tricks. I inserted the numbers into the report names to force the sort order. ... View more

Uhm, I'd think you could add config in both ways. In the end, for search time operations, what you've configured in the manager takes precedence over what's in the other config files. This because that kind of Manager configs get stored in etc/users/username/appname/... dir which has higher priority than etc/apps/... I'd suggest you to read through this, though: http://www.splunk.com/base/Documentation/latest/Admin/Wheretofindtheconfigurationfiles ... View more