I have a simple search with an eval that generates a valid HTML link: index=sonicwall "TemplateID=265" | eval support_url=("http://software.sonicwall.com/applications/gav/index.asp?ev=v&v_id=" + signature_id) How do I make so clicking on the link will follow it instead of adding it to search? ... View more

I'm getting the following error: Error in 'IndexScopedSearch': The search failed. More than 1000000 events found at time 1390985456. I found this existing question: http://answers.splunk.com/answers/76392/how-to-delete-a-huge-number-of-old-events-from-the-test-data-that-has-slipped-in as well as this one http://answers.splunk.com/answers/119467/indexscopedsearch-error-while-searching as well as this one http://answers.splunk.com/answers/3397/indexscopedsearch-error-details I tried removing the db directories and restarting splunk. Still getting same error. I tried this command: _time="1389689456" | delete Does anyone know how to remove the bad data? ... View more

I am working with IPFix data from a firewall. The first template returns the flow information. That is stuff like Source IP, Destination IP, Flow ID. The second template returns URL related data. Using the trasaction command I can correlate the events based on the Flow ID. In both templates are the dest_mac. The trouble is one of the templates always returns the MAC of 00:00:00:00:00:00 which is bad data. I would like to filter that data out any way possible. How do I filter it? ... View more

Sorry I use underscores "_" in my variable names and this forum causes those to be italics instead! So I changed all of them to be hyphens "-" I can do an inline lookup like this: lookup sonicwall-app-id app-id as app OUTPUT app-name but when I set it up as an automatic lookup like this: lookup table: sonicwall-app-id lookup input fields: app-id, app lookup output fields: app-name, app-name ... View more

I'm writing a python library to take some CPU/process data and send it via syslog to splunk. The data is naturally tabular and contains quite a few rows. I will be polling this information frequently (every second or every 10 seconds). Is it best to send each process name with it's own CPU stats (% of total and total time) 2 values or instead send all of them in a single log message? If I choose to send it all as one log message what is the best way to format it? I currently have it stored as nested python dictionary. Here are a couple of values: {'Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'} the local_dict for process tSchedObjTimer looks like: {'Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'} the local_dict for process tIkeMsgTask looks like: I'm thinking something like: process:tSchedObjTimer ['Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'] process: tIkeMsgTask ['Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'] or maybe tSchedObjTimer=['Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'] tIkeMsgTask=['Current CPU Percentage': '0.00', 'Total CPU Seconds': '0.00'] I was thinking about this last night. I'm going to have a lot of data and it would probably be best to aggregate the data and pack it. tSchedObjTimer=['Current CPU Percentage': '0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00', 'Total CPU Seconds': '0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00' tIkeMsgTask=['Current CPU Percentage': '0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00', 'Total CPU Seconds': '0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00','0.00'] ... View more

I am looking at firewall logs. The destination port appears twice in some log lines. I want a search that will show me all the events where the two values are not the same. here is a sample log where they do match Jul 19 09:08:03 10.203.14.34 id=firewall sn=0017C598FCCC time="2013-07-19 09:08:02" fw=10.203.14.34 pri=6 c=512 m=602 msg="DNS packet allowed" n=43102 src=10.200.0.52:53:X1:eng-dc-01.eng.sonicwall.com dst=10.203.14.34:55034:X1 proto=udp/55034 The values in this log we need are: dst=10.203.14.34:55034:X1 the formatting for this is (ip address):(port number):(interface) . So that means this connection was on port 55043. I call this one dst_port proto=udp/55034 This is formatted as: (transport)/(port number) . So in the example this is on port 55034. I call this one port I trying searches/filtering that looks like (main search) if not (dst_port = port) ... View more