The error is produced when I click the "Launch App" link. ... View more

@gregwilliams you should post your comment as an answer as it directly fixes the problem. I would up vote it. ... View more

I'm not sure what may have changed, but here's a different approach. You're basically trying to use the dest_ip field from one search to find events in another search, right? A basic pattern for that looks like this: "User Authentication" [search "Trojan" | dedup dest_ip | table dest_ip] The subsearch will evaluate to something like this: ( ( dest_ip = "..." ) OR ( dest_ip = "..." ) ... OR ( dest_ip ="..." ) ) ... View more

It's CentOS 6.3 ... View more

I was trying to follow this step with Splunk6.0.2, but it did not work. Any chance since this question answered? ... View more

Thanks kallu, that helped me think of something else to ask. ... View more

Not sure I follow. Are you expecting to see a difference in the log entries themselves? The lookup values appear as new extracted fields, so you should start to see them in the field picker at the left. You might need to click pick fields to bring up the full list. ... View more

Yeah, I noticed that the splunkbase comment stripped the backslashes off those inner quotation marks. I'll update the original answer. Glad you got it working. 🙂 Oh, if you schedule that search, you'll need to save the map's search off as its own saved search (see http://splunk-base.splunk.com/answers/27658/map-command-breaks-when-scheduled). ... View more

good idea. ... View more

The problem is that the pop-up displayed when running on a non-windows operating system doesn't have an 'ignore' button. We are working on fixing that ASAP. ... View more

You can't do a DNS lookup as part of the transform, but Splunk does ship with a script that can be used to with a Splunk lookup. Look at "Example of external fields lookup" within this manual page http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsfromexternaldatasources ... View more

Thanks! The fields are fixed length so this works perfectly for what I'm trying to do. ... View more

I'm using ext4 on an OpenSUSE 12.1 system with a 2TB volume with no problems. Performance is more than adequate too ... View more

This should change the last octet to aaa for an IP address: | rex field=src mode=sed "s/(\d+\.)(\d+\.)(\d+\.)(\d+)/\1\2\3aaa/g" ... View more