I'v already tried that. Been playing with this all day. The case is that I am indexing a binary encoded log file... Splunk indexes all ASCII characters without a problem... but there are a few non-ASCII characters that are indexed as "\x6\xD1" which would be "Đ". I've tried modifying the CHARSET but the only one that works is CP852, which is sadly not supported by Splunk. As for SED I have not been able to match the pattern with a sed regex within Splunk, however when using standalone Regex tools or OSX CLI sed I match and replace the patterns without problems... I have managed to work this out using transforms.conf with a regex and then applying that in props multiple times (ex. 10 times for a possibe 10 repetitions of the same character in 1 event). This is a very ugly workaround and I will try to find another way. Example: raw data: \x6\xD1\x6\xD1\x6\xD1\x6\xD1\x6\xD1 transforms.conf [bin2text] REGEX = (?)(.*)\x6\\xD1(.*) FORMAT = $1Đ$2 props.conf [sourcetype] TRANSFORM-test = bin2text, bin2text, bin2text, bin2text, bin2text result data: ĐĐĐĐĐ As I said a very ugly solution but the only one I got working. I'm open to suggestions if someone has an idea... ... View more

well the number of working hours between the start_time and end_time for example i start working on a task at 09:00 AM on monday and finish at 13:00 PM on wednesday... i wish to count the number of working hours on the task... ... View more

Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search... ... View more

no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month... ... View more

Thanks for the quick reply... that comes close but not quite what I am looking for... example... the max(_time) of the events is 15.08.2011 the latest time of the search is 31.08.2011 i run this search on the 15.09.2011 i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working... ... View more

I just tried using this and works pretty good. Is it possible to apply the css to a certain field insted of the row? ... View more

Hi jbsplunk, thanks for the quick reply. I have tried seting the charset manualy but splunk still garbles up the data when indexing. I have tried pretty much all the charsets available with splunk. Usualy with this type of data i use CP1250 and all goes well but with this set of data it is a no go with any charset config... I have tried this with a linux install of splunk, thinking it might be an OSX related issue, and get the same results... I am geusing this might be a bug but am not quite sure yet... ... View more

the schedule is set to run at midnight on the first day of every month... 0 0 1 * * ... View more

Hi... here is the complete command... ./splunk cmd python fill_summary_index.py -app noc -index firewall_summary -name fw_web_monthly_top_domain -et -1mon@mon -lt @mon -j 8 -owner admin -showprogress true -auth admin:changeme ... View more

thnx. i'we seen the guide but this will not work in this case... the examples in the guide match a regex and then based on that match set the source type manually... [some_stanza] REGEX = some_regex FORMAT = sourcetype::my_log (manually set source type to my_log) DEST_KEY = MetaData:Sourcetype This would require a stanza in props.conf for every source type i wish to have for a single scripted input source... what i am trying is to extract the source type itself using a regex and route those events to that source type... ... View more

The setup above works perfectly... It kicked in after splunk was restarted a few times... ... View more

Yes they exist... this is now working... for some reason the config kicked in after i restarted splunk a few times... wierd ... View more

Assuming your earliest timeis a relative earliest easiest would be to say something like earliest=-2h latest=-1h That would grab events from 2 hours ago to 1 hour ago. hope that helps ... View more

I have this set up and working fine... I have the panels within the tabs arranged identically when using columns... You have another option, to use the _grpx param instead of the colx... that way the panels do not have to be identical across tabs... you can have 2 charts/tables on row1 in one tab and 1 or 3 on the other tab working nicely... I still have some issues with panel titles but found i could use generic titles to describe all the modules within the panels... Requires some playing around but works great ... View more

Thank you also for the quick answer... i can't just use index and sourcetype because i run postprocess searches on the results and i get nothing unless i specify the fields=*... using the NOT != is a bit messy... i resolved my issue by using eval to write "NULL" into the empty fields. Again thanks for the help. ... View more