I have to find out the top 50 Ip addresses for error logs, but they are in a different format than Splunk recognizes. The IP information are listed in the _raw field of the log. I'm not sure how to extract them so I can look at them and chart just the IP addresses in the error logs. I know I can highlight over the IP addresses, but it only shows the logs containing that specific IP address. Is there any way I can tell Splunk exactly what field I want it to extract? ... View more

I am researching information into error log files and the way they're formatted is different so Splunk doesn't recognize the client ip addresses even though they're there and I have to format a report on the top 50 ip addresses, but I am not sure how to go about extracting them? Or if I need to add a new field? As well, I had to format a list of the top 50 error types and it turned out that there were only 10 error types that covered all the log. But, when I went to record the count, when I added them all up, there was more than Splunk is showing as the count of the whole log file. I have double and triple checked, isolated each of the events and adding them up and even excluding one event and checking to see the amount left over. I can't seem to figure out what could be wrong. ... View more

I want to figure out how many schools in my state are hitting my website. I was wondering if there is some way to be able to generate that information without manually having to go through and look at each individual IP address and figure out where it's coming from. Is there anyway to program a search or be able to tell if an IP address is coming from a school's computer lab or server? I know it seems a little bit of a far-fetched questions, but looking through millions and millions of IP addresses manually is not possible. I was wondering if anybody would know how to do this? ... View more

I have uploaded a single collection of logs for one time use in Splunk. I was wondering if there is a way to generate just a list of all the IP's listed in that collection? I can get the top IP hits, but I need all the IP's. Is there anyway to do this? ... View more

I downloaded Splunk for the MAC (I have the 10.7 version software, I'm not sure if that'll make a difference on how this works or not), read the manual, and went to the the directions for /Applications/splunk/bin/splunk start, none of the items in my folder (bin) had a splunk start, there was just a splunk, splunk-optimize, splunk-optimize-lex, splunkd, splunkmon, so I chose the splunk and it logged me in and gave me all these help commands. I thought I did everything right those were the steps I followed and so when I try to access the Splunk web server it gave me, it keeps saying Safari can't identify this server. Do I need to download another browser so it will recognize it? I asked another question similar to this and someone said I have to make sure the local: 8000 isn't blocked, I'm not sure how to go about checking that or changing it if it is blocked on a MAC. Can someone help me? I need like a step by step process on how to go about fixing whatever's wrong. ... View more