This command works great with url as "www.splunk.com" - return status code as "200", But return http status as "0" when any path is added - i.e.“www.splunk.com/en_us/products.html” index=abc| eval url="www.splunk.com" |httpstatus |table url httpstatus Below is the python script : import sys,splunk.Intersplunk import string import httplib urlfield="url" if len(sys.argv)>1 and len(sys.argv) != 4: print "Usage |httpstatus url as <local-field> (or have url field name in data)" sys.exit() elif len(sys.argv) == 4: urlfield=sys.argv[3] results = [] try: results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() for r in results: if "_raw" in r: if urlfield in r: try: conn = httplib.HTTPConnection(r[urlfield], timeout=5) conn.request("HEAD","") res = conn.getresponse() r["httpstatus"] = res.status conn.close() except: r["httpstatus"] = "0" if (conn != None): conn.close() except: import traceback stack = traceback.format_exc() results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack)) splunk.Intersplunk.outputResults( results ) ... View more

Sample single event: [{"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.539Z"}, {"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.542Z"}, {"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.545Z"}] Please note the above event is an array with elements as JSON's with different timestamps. Is there an efficient configuration for props.conf to parse the above into 3 different events with their unique timestamps? ... View more