The short answer is to use search-time operations to map those vendor-specific fields into some common model you define. So first come up with the field names you want to use in your Splunk app. Then for each sourcetype (vendor) decide which fields need mapped where. To do those mappings, you can use aliases, evals, field extractions, lookups, etc. All of those will happen at search time. So for example if you choose to use item_name, then vendor1's field won't need to change. But for the sourcetype of vendor2, you alias product_name as item_name. Now when you search vendor2's sourcetype, both item_name and product_name fields will be there. Your app's searches will just use item_name. If you need to normalize something like categories, typically a lookup would work - maybe sale type or payment method or something (not real familiar with pos systems). If you need to maybe concatenate a couple fields of one sourcetype to match a field in your common model, use an eval. Etc. Hope that helps a little ... View more

Do post an entire event along with the current configuration you use for that sourcetype. While Splunk will recognize epoch timestamps out of the box with zero configuration, some defaults may trip you. For example, it'll only look at the first 150 characters of each event by default. ... View more

It is awkward, but you could teach executives (is that even possible?) to change their own TZ settings when they do this by going to "Your User Name" -> Edit Account -> Time Zone and setting this to the appropriate value and Splunk will automatically normalize both the timepicker and all the results as they are presented to you. ... View more

We were having the same issue. I took your masterpiece and spun it up with our search and WHAMMO! Extreme Goodness! Thank you very much! ... View more

@ronak you can use INDEXED_EXTRACTIONS = JSON for accomplishing this INDEXED_EXTRACTIONS = < CSV|W3C|TSV|PSV|JSON > * Tells Splunk the type of file and the extraction and/or parsing method Splunk should use on the file. CSV - Comma separated value format TSV - Tab-separated value format PSV - pipe "|" separated value format W3C - W3C Extended Extended Log File Format JSON - JavaScript Object Notation format * These settings default the values of the remaining settings to the appropriate values for these known formats. * Defaults to unset. in props.conf on the UF set in $SPLUNK_HOME/etc/system/local/props.conf: [your_sourcetype] INDEXED_EXTRACTIONS = JSON KV_MODE = none restart splunk $SPLUNK_HOME/bin ./splunk restart http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Extractfieldsfromfileheadersatindextime ... View more

where it that in DMC? ... View more

Hi, it won't work to do this. The architecturally different DB Connect 2 would work though. ... View more

You could create a macro US_CURRENCY(1) that takes the field as its argument and is defined something like this: fieldformat $field$ = "$$".'$field$' and use it in your searches like this: some search | `US_CURRENCY(total)` | ... ... View more

You could possibly setup a scripted input running through the forwarder on Server1 that leverages some utility to read what you want out of the database, and return the results. An alternative maybe is to implement Splunk DB Connect : https://apps.splunk.com/app/958/ ... View more

This could be deployed with a deployent server to the Search Heads. You would just need to create the app and put the python scripts in the $app_name$/bin folder. Caveats to this would depend on how and what exactly your authscript is doing.. ... View more

Very nice example Raghav. Things to remember are the following: $time_range1.earliest$ $time_range1.latest$ index=_internal | timechart count by sourcetype Use ... and NOT .... ... View more

I don't think you can do that in SimpleXML, but I am not sure. If you are on V6.x, you can convert your dashboard to HTML and probably implement this in JavaScript. You can create a hidden panel which runs | rest /services/authentication/current-context/context | fields username roles to get the current user name and the roles that user is part of (can be multiple) and then set the refresh property. Note: I have not tested whether dynamically setting the refresh property will actually work, or whether the value is only read once when the dashboard loads. Easy enough to try. ... View more

Hi ronak, Yes you can! 😉 So what i have done previously is to gather my configuration in a/one central app, lets call it myAuth . That means i am editing the authorization and authorize files manually (well in some cases with scripts) . Then i deploy myAuth with the deployment server or what other means i have for deployment. After the app is deployed i have been using the rest-api endpoints to "force" an update on those, meaning i don't have to restart my search-heads to update the roles and what not. With search-head clustering and the new functions in splunk 6, this method should still be valid i guess even if deployment server is not used anymore to push confs to indexers and search-heads. You could also use something link rsync or robocopy to keep the configurations in sync between your nodes . It is preferable to combine this with AD or LDAP. Since it will spare you some work. Here you will find some tips on how to update / reload roles and users without the need for a restart; http://answers.splunk.com/answers/129654/how-to-i-trigger-reload-of-authentication-configuration-programmatically.html Hope this helps and gives you some ideas of what you can do ... View more

Right, Please see below; To disable time picker: Click edit -> Edit panels -> push the x next to the timepicker To add prompts, which I believe you mean 2 input fields, you can use the form elements and set tokens, i.e. $fromdate$ To add constraints, you could use a number field, and set a maximum number of 15, or alternatively, use a drop-down with -1d, -2d, -3d etc. Hope this is what you're looking for, if not leave a comment and I'll get back to you ... View more

I've monkeyed around with having a lookup that maps groups to specific alert to thresholds - something like alert1,group1,5 alert1,group2,4 alert1,group3,10 What you are proposing potentially could be done in a lookup but my mind slides more toward a complex case statement like ...| eval queue_time = case(group=client1, assign_timestamp - min(create_timestamp, queue_timestamp), group=client2, quue_timestamp - create_timestamp, 1=1, "fix me") | .. Of course that doesn't really fit what you are looking for; conditions not being in the query or a macro. Of course if you have it in a macro it makes it much easier to update and keep track of /shrug. ... View more

Set the dashboard to be the default view for your app(s) and set the roles to use your app(s) as their default app. Then each user will automatically load that dashboard after logging in. The role-based index visibility will take care of displaying only their own data if you have only one dashboard for everyone. As for having two URLs, you could have as many DNS names pointing to your search head as you like. ... View more

I'm pretty sure Splunk will require a user context. There's preferences to store, private knowledge objects, user-created dashboards, auditing of user activity, and so on. ... View more

Values separated by AND in a bracket belong to one search result. When multiple results are obtained, you would see and OR separating two different search result. ... View more

Feature request... Is there any way to make a single extract that runs before KV_MODE = JSON kicks in? I keep seeing cases where just the body of the message is json, listed after the date, level and logger. In that case, you have to run the rex first followed by the spath. To the original question... If the whole body of the event is json, then the fields will automatically be extracted. It "just works." You can summarize like any other extracted field. I've never measured the performance, but it seems pretty good, but just think about what it's doing... you probably don't want to convert all of your logs to json. The only caveat I can give is to avoid complicated json documents if you can control the documents. For example, if you have arrays of objects that are actually each an event, you'll have to do some gymnastics with mvexpand to keep the fields in each nested event related. ... View more

The response you received points you to the job that has been created for your search (jobid 1421682152.110 ). You can query the job as to whether it has finished, whether there's a preview already available, what the eventual search results are, and so on. ... View more

This is not related to the REST API Modular Input. But to answer your question , you can execute Splunk searches via Splunk's REST API : http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTsearch Further more , we have SDK's in various languages to make it easier to use the Splunk REST API to execute searches : http://dev.splunk.com/view/sdks/SP-CAAADP7 You'll find loads of examples under those links I posted. ... View more

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it! https://splunkbase.splunk.com/app/4175/ ... View more

Try adding |table * at the end of your search, this should allow any custom extracted fields to be displayed in your field output. ... View more

The only way to "change" that bar is with roles, as some roles only display pieces of the Splunkbar. Other than that, don't do this without fully understanding the repercussions of editing core files. ... View more

Hi, you can create a search for a complete day with the following earliest and latest filters: index=_internal earliest=@d latest=@d+24h What you can do then, is you can add or substract hours, minutes or seconds like this: index=_internal earliest=@d+1h+10m latest=@d+24h-1h So, if you have two textinputs and the inputs have tokens $from$ and $to$ you could create a search like: index=_internal earliest=@d$from$ latest=@d+24h$to$ and all your users have to do, is type +14h and -6h to get the timerange from 14:00 to 18:00. Greetings Tom ... View more