Hi, I'm using 6.1 I have a group of people who are looking at a way to create monthly reports based on their list of known URLs and then run a search against our proxy logs based on this changinging list of URLS. I used a script to convert their list of urls into a long command line: e.g. index=proxylogs google.com OR web.com OR blah.com How could this be automated ? They could provide a URL from where we can get their latest list we then need to somehow create the query using their list and run it and lastly export to an excel which we email back to them or somthing similar? Any hints? ... View more

Hi - I am archiving data to the frozen dir using the frozentimeperiodinseconds which works well. I now want to automate the deletion of this data from my frozen dir after a certain period. I have read somewhere this can be done - can someone point me to documentation which would help. ... View more

Hi - Where are the job manager search results stored on the disk if I want to find it via CLI? ... View more

Hi, I was advised that curl was a workaround used for exporting search results to csv. Problem is I do not know how to export specific jobs in the jobs manager and I need assistance with the correct syntax: curl -k -u admin:password! -o 120979_curl.csv --data-urlencode search="search source=log.tar.*" -d "output_mode=csv" exampleurl:8089/servicesNS/admin/search/search/jobs/export I suspect it is not working because of the search= source=log.tar.* being incorrect... What should I be adding in this field so I download the correct job? The search I ran was the following search * | regex _raw=".*/[a-f0-9]{32}/[a-z]{1,15}-[a-z]{1,15}.php" and this is how it appears in teh job manager. Lastly if I wanted to view the search jobs results on the cli - where would I find the results and couldn't I just scp this file off instead of using curl? ... View more

I am no longer seeing all my logs on the indexer after clearing the index of all data. Is there something that needs to be cleared or restarted on the forwarder so all the available logs can be gobbled up again? I used this command on the indexer splunk clean eventdata -index proxylogs -f ... View more

In the context of proxy logs - could Splunk (via APIs or what not) enable the resolution of IP addresses to the logged in username for a particular log from a proxy? ... View more

Can the Splunk-driven reporting process send a report via email with the results based upon the specific criteria? ... View more