I wanted to reconcile the data from 2 indexes say index=A and index=B both indexes have some common fileds like field1,field2,field3,field4,field5 at the end I wanted to compare the data from index A and index B side by side with time span of 1s. The report should display _time index1 index2 source field1 field2 field3 field4 field5 and difference between the 2 indexes eventcount or any other. ... View more

I'm trying to extract logname from the following.  So the logname value would be message.log/bblog.log/api.log Please Note :  When the timestamp date is between10-31 there is no extra space where when the timestamp date is single digit i.e.,(1-9 ) there is an extra space at the beginning of the event. ex: <10>Jan<space><space>4 15:30:02        <10>Dec<space>31 15:30:02 Here are the sample events  <10>Jan  4 15:30:02 a2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:02 message.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false   <10>Jan  4 15:30:02 ia2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:02 bblog.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false   <10>Dec 31 15:30:04 a2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:04 api.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false ... View more

The following event being parsed as single event. I'm trying to break the event into multiple events Sample data Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 I'm trying to break the event before ------------------- CommonMessageInput ---------------- so the events will be  Event 1 Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 Event 2 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 Event 3 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636   ... View more

Hello,  I have onboarded the data into Splunk which we have multiple timestamps in the event in different formats. I believe my props settings are correct however it's giving an error in Splunkd.log. Please Advise Error Details : DateParserVerbose [99999 merging_0] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (16) characters of event. Defaulting to timestamp of previous event Event Details:  Jul 10 14:19:08 abcdefgh81 dnsmask Jul 10 14:19:08 dnsmask[1520]: cached abcdefg43.wellness.com is 10.220.200.72 Jul 10 14:19:08 abcdefgh81 dnsmask -- [10/July/2022:18:10:10 -9900] dnsmask[1520]: cached abcdefg43.wellness.com is 10.220.200.72 Here are my props settings TIME_PREFIX=^ TIME_FORMAT=%b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 16     ... View more

Hello Splunkers,  I've an issue with my event time configuration. It has incorrect timestamp. Below are my props settings..it doesn't seem to be working. Please Advise TIME_FORMAT = %Y-%m-%d %H:%M:%S TIME_PREFIX = ^ TZ = UTC-4 MAX_TIMESTAMP_LOOKAHEAD = 20    Sample log format Time                                                                      Event 6/27/21 8:30:56.000 PM                #Software: banana Internet Information Services 19.0                                                                    #Version: 10.0                                                                    #Date: 2021-06-27 20:32:46                                                                    #Fields: Sacramento is the capital of California 6/27/21 8:30:56.000 PM                 #Software: pineapple Internet Information Services 39.0                                                                     #Version: 12.0                                                                     #Date: 2021-06-27 20:32:46                                                                     #Fields: Austin is the capital of Texas     ... View more

Hello Splunk Community, I've a query which lists accountNumber , targetAccountNumber, eventType, eventTime The query is working just fine..but it is displaying empty rows with eventTime being displayed accountNumber   targetAccountNumber    eventType      eventTime 123456                         789123                               apple               09/02/2020:12:00                                                                                         banana           09/02/2020:13:00   111111                        763333                                 mango               09/03/2020:15:00                                                                                        watermelon       09/03/2020:16:00   212121                         999999                              Texas                   09/04/2020 :18:00                                                                                                                        09/04/2020:19:00                                                                                                                       09/04/2020:20:00                                                                                                                       09/04/2020:21:00 I do not want the empty eventTime being displayed. It should display only there is an eventType for particular time. How should I exclude the empty eventTime My query is as follows index=newyork data | stats values(eventType) as eventTypes,values(eventTime) as "Event Time" by accountNumber, targetAccountNumber   Please help                                                                                                                         ... View more