I constructed transactions with "startswith" and "endswith" and I am trying to identify those incomplete transactions by using keepevicted=true. I would expect those incomplete transactions should have either "startwith" condition/event or "endswith" condition/event. I found that the splunk outputs some transactions that satisfy neither "startwith" nor "endswith" condition/event. For example, the following search string "A" "B" "C" "D" "E" | dedup _raw | transaction startswith ="A" endswith="B" keepevicted=true | NOT "A" AND NOT "B" gives me one or two transactions. Since the transactions do not match my startswith or endswith criteria, I am just wondering why/how they are generated as transactions. ... View more

Is there an easy way to download/retrieve the original source file via the web interface after finishing a search? It would be convenient to pull the data directly from web interface without going to the data repository via CLI. ... View more

I tried to set up a gmail imap account in windows for splunk to download and index the email data. I followed the same configuration as indicated in http://splunk-base.splunk.com/answers/2803/imap-app-with-google-mail and got the following error messsages when running "splunk cmd python .\etc\apps\imap\bin\getimap.py --debug" The main error message is " could not log into server: mail.google.com with password provided" but I am pretty sure I provided the correct password and user account, port=993, useSSL = False or True (neither works). Any suggestion on how to debug. Traceback (most recent call last): File ".\etc\apps\imap\bin\getimap.py", line 327, in getMail M = imaplib.IMAP4(self.server,int(self.port)) File "C:\Program Files\Splunk\Python-2.7\Lib\imaplib.py", line 163, in init_ _ self.open(host, port) File "C:\Program Files\Splunk\Python-2.7\Lib\imaplib.py", line 229, in open self.sock = socket.create_connection((host, port)) File "C:\Program Files\Splunk\Python-2.7\Lib\socket.py", line 553, in create_c onnection for res in getaddrinfo(host, port, 0, SOCK_STREAM): gaierror: [Errno 11004] getaddrinfo failed None Traceback (most recent call last): File ".\etc\apps\imap\bin\getimap.py", line 698, in parseArgs() File ".\etc\apps\imap\bin\getimap.py", line 691, in parseArgs imapProc.getMail() File ".\etc\apps\imap\bin\getimap.py", line 339, in getMail raise LoginError('Could not log into server: %s with password provided' % se lf.server) __main .LoginError: Could not log into server: mail.google.com with password pr ovided ... View more

I tried to use subsearch to find the 2nd last synchronization event by using the following: synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest] but I received the error message Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side. What is wrong here and what is the fix? Thanks. ... View more

I want to extract two adjacent events, i.e., the first one with keyword "synchronization" and the event immediately follows the "synchronization" in the log file. Then I can use regular expression to extract some values from these two events. I tried to use transaction to accomplish this. I cannot rely on event time (i.e., cannot rely on maxspan) as there is a problem with clock synchronization). The script I used is host=A | transaction host startswith="synchronization" maxevents=2 The result includes many transactions that don't begin with "synchronization." 1) Can you help to fix the transaction script so the result contains only the transactions that start with the "synchronization" event. 2) Is there any other way than "transaction" to extract two adjacent events? ... View more