Hi there folks, I am building a custom alerts dashboard based on a search that returns a table (see demo screen below). I have it doing a lookup and adding a few custom fields I need based on the specific types of alerts found. Now I want to add a link to the dashboard so the user can go directly to the correct dashboard based on the specific alert. Unfortunately, the link I added based on a lookup doesn't actually work. This link is just a standard table drilldown. Any ideas on how I can make my field use the link I give it? Can I specifiy this link in some part of the search so that when the table renders this field will use my link rather than a standard drilldown. Here is the search in case it matters: index="_audit" sourcetype="audittrail" action="alert_fired" ss_app="itg" | eval trigger_time=strftime(trigger_time,"%Y-%m-%d %H:%M:%S") | dedup ss_name | `replace_numeric_severity_with_text` | rex "(?i) *ss_name=\"(?P<ss_prefix>[a-z]+_)" | lookup itg_app_alerts search_source as ss_prefix OUTPUT support_team as local_support_team, dashboard_url as local_dashboard_url | table trigger_time, ss_name, severity, local_support_team, local_dashboard_url And here is a picture of the search thus far to give you context. As you can see I have an URL in the last field that I want to use. But my URL doesn't get used, it's just the standard drilldown URL used by default in Splunk tables. Thanks for any thoughts you have 🙂 ... View more

Hi folks, I am trying to build KV pairs from some UNIX command output. The log entries look like the output below. In this case I would like to build keys from the headers (%usr, %sys, %wio, %idel) and values for each from the values shown (2, 5, 0, 93). I will then graph multiple entries over time. While the preview here shows this all in a line, the log is a preformatted table. HP-UX van-sama B.11.31 U ia64 08/21/12 12:49:47 %usr %sys %wio %idle 12:49:48 2 5 0 93 The likely search function seems to be "extract(kv)" but I am unclear on how to go about this and the examples in the docs seem weak. Can anyone put me on the right track? Thanks 🙂 ... View more

I am trying to get the Splunk Fortigate application running as it would be very useful. When I go into it and give it a device and vdom it just reports no data is found. I have setup the UDP:512 port on Splunk and the sourcetype/IP config per the README file but I still seem to be unable to get the app to display the data. I am not sure what I have done wrong and I'm not sure even where to begin looking at this point. Can anyone offer some troubleshooting suggestions? You can see I have log data per my splunk data: date=2012-07-06,time=13:48:53,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=50962,dst=###.###.###.###,dstname=###.###.###.###,dst_port=53,service=53/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V645_ITG_MGMTS",dst_int="V998_MGMTN",SN=582346120,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:53,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=162,dst=###.###.###.###,dstname=###.###.###.###,dst_port=162,service=162/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346112,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:53,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=162,dst=###.###.###.###,dstname=###.###.###.###,dst_port=162,service=162/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346110,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=58072,dst=###.###.###.###,dstname=###.###.###.###,dst_port=53,service=53/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V645_ITG_MGMTS",dst_int="V998_MGMTN",SN=582346087,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=48295,dst=###.###.###.###,dstname=###.###.###.###,dst_port=514,service=514/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346085,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=48295,dst=###.###.###.###,dstname=###.###.###.###,dst_port=514,service=514/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346084,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=48295,dst=###.###.###.###,dstname=###.###.###.###,dst_port=514,service=514/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346073,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=48295,dst=###.###.###.###,dstname=###.###.###.###,dst_port=514,service=514/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346072,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" date=2012-07-06,time=13:48:52,devname=FW-NAME,device_id=FG###########,log_id=0022000003,type=traffic,subtype=violation,pri=warning,status=deny,vd="root",src=###.###.###.###,srcname=###.###.###.###,src_port=48295,dst=###.###.###.###,dstname=###.###.###.###,dst_port=514,service=514/udp,proto=17,app_type=N/A,duration=0,rule=0,policyid=0,identidx=0,sent=0,rcvd=0,shaper_drop_sent=0,shaper_drop_rcvd=0,perip_drop=0,shaper_sent_name="N/A",shaper_rcvd_name="N/A",perip_name="N/A",vpn="N/A",src_int="V998_MGMTN",dst_int="V999_MGMTS",SN=582346071,app="N/A",app_cat="N/A",user="N/A",group="N/A",carrier_ep="N/A" ... View more