My dilemma: We have a log file that dumps out info from an array. Four fields: Count FieldA FieldB FieldC In the log file, the field 'Count' will provide the number of entries in the array. There will then be 'Count' instances of each field (FieldA, FieldB, FieldC). For example: 2012.02.28 00:02:00.000|Count: 1, FieldA[0]: abcdefg, FieldB[0]: 12345, FieldC[0]: 1234abcd 2012.02.28 00:02:01.000|Count: 2, FieldA[0]: abcdefg, FieldB[0]: 12345, FieldC[0]: 1234abcd, FieldA[1]: hijklmn, FieldB[1]: 67890, FieldC[1]: 5678efgh We don't really care about FieldA[0] vs FieldA[1] for metrics, but we do want to know about the data for all instances of FieldA. Not sure if some combination of repetition and grouping will accomplish this or not. I will be testing it out, but was also looking for others' feedback and if they've done this before. Is there a 'simple' (and I use that term lightly) way to dynamically parse the fields using Splunk (transforms.conf, etc.)? ... View more

I'm trying to figure out the best way to extract a time stamp (not date) from a row when using multikv. Here's the raw data: " AIX Net Activity for Sunday, January 1, 2012 (00:00-00:00) (1) es2p375p" CPU KB PKTS PKT ERRS ------------------ --------- --------- ------------------------- %I %K %U %W logc I O I O In errs O errs Collisions --- -- -- -- ----- ---- ---- ---- ---- ------- ------ ---------- 20:00 95 4 1 0 0.40 0 0 * * * * * 18:00 95 4 1 0 0.38 0 0 * * * * * 16:00 95 4 1 0 0.38 0 0 * * * * * 14:00 94 4 1 0 0.42 0 0 * * * * * 12:00 95 4 1 0 0.41 0 0 * * * * * 10:00 95 4 1 0 0.40 0 0 * * * * * 08:00 95 4 1 0 0.41 0 0 * * * * * 06:00 86 4 5 5 0.73 0 0 * * * * * 04:00 85 5 7 3 0.95 0 0 * * * * * 02:00 93 5 1 1 0.51 0 0 * * * * * 00:24 95 3 1 0 0.36 0 0 * * * * * --- -- -- -- ----- ---- ---- ---- ---- ------- ------ ---------- SUM: 0 0 AVG: 93 4 2 1 0.49 0 0 I've already configured the multikv.conf and props.conf files to parse the log and extract the fields properly (there are multiple tables in a single log file, one table for each day). Splunk see's each table as a different day, but the timestamp for each event/row is always 00:00, as opposed to the time in the first field of the event row. For example, the row 20:00 95 4 1 0 0.40 0 0 * * * * * Will have a date/time stamp of January 1, 2012 00:00, instead of January 1, 2012 20:00. Any ideas on the best way to solve this? All suggestions are welcome. Thanks! ... View more

Splunk noob REGEX question. I'm attempting to customize the REGEX for the ootb Apache extraction. I've got it working for the most part, but I'm unable to get it to parse the referer, useragent, and cookie from the logs. They all get parsed as the 'other' field. REGEX: ^[[nspaces:clientip]]\s++[[nspaces:dummyip1]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[nspaces:bytes]?[[all:other]] Log Sample: 208.20.251.27 205.141.201.135 - - [03/Jan/2012:09:14:59 -0600] "POST /web/member/webflow.sf HTTP/1.1" 200 7726 "https://oururl.com/web/member/loginWebflow.sf?_flowExecutionKey=_c79820C50-FDCF-6ECA-7444-A686DB586CD2_kA41B8853-80E0-BC71-8652-6BD49F427558" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)" "__utma=242832726.1910715443.1325603689.1325603689.1325603689.1; __utmb=242832726.1.10.1325603689; __utmc=242832726; __utmz=242832726.1325603689.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); mbox=check#true#1325603751|session#1325603690349-869173#1325605551; JSESSIONID=0000LoZUujL4bBUy5HkrMitepvr:16i215taj; BIGipServer_MemberFront_DMZ_WAS_prodmember=2798226893.17440.0000; __utmv=1.DIV%3D%3ASEG%3D; __utma=1.1819453781.1325603691.1325603691.1325603691.1; __utmb=1; __utmc=1; __utmz=1.1325603691.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); remainingTime=null" Any assistance would be greatly appreciated. ... View more