having some time trying to extract fields automaticaly from the message below. really wanted to test out the xtract before putting into a transforms / props etc. So tried to use the extract command on the event below ** extract kvdelim=; pairdelim=: ** and this one ** extract kvdelim=; pairdelim=": " ** As most of the KV are framed with ; and the values are noted by : but no luck at all I think it is due to the the KV pairs are enclosed in quotes and it looks that this throws off the extractor ... Nov 26 12:02:51 172.255.255.253 Verdict-Clean: "File Name:ie6.0sp1-kb958869-windows2000-x; Job ID:1417021278808146; SHA256:73a0db29059f81adbbe1c620c132bec58b6fe7efd8c0ce973595ac6ea346a8e6; Rating:Clean; Scan Time: 90 (seconds); Malware Name:N/A; Source IP:172.23.98.229; Destination IP:8.254.230.174; Send Over:HTTP; Device:FG100D3G14800455(FG100D3G14800455:root); " Also tried to do a rex to pull out the fields .. and that seems to work but as the KV can change postions the name never line up correctly so thus losing the KV pairs? So was thinking that you could run a extract command on a field ... i.e. use rex to extract the quoted extracted_field = "File Name:ie6.0sp1-kb958869-windows2000-x; Job ID:1417021278808146; SHA256:73a0db29059f81adbbe1c620c132bec58b6fe7efd8c0ce973595ac6ea346a8e6; Rating:Clean; Scan Time: 90 (seconds); Malware Name:N/A; Source IP:172.23.98.229; Destination IP:8.254.230.174; Send Over:HTTP; Device:FG100D3G14800455(FG100D3G14800455:root); " and then try to to a extract on the extraced field. But it seems you can not run extract on a field .. or can you ? Need some insight on this one ... ... View more

Question: I am seeing high latency on a lot of my source types in splunk By high latency we are seeing it takes over 24 hours to index some events. The SoS ( splunk on spunk ) app shows that most if not all the host sending messages to the syslog message file have high latency. the server hosting splunk seems ok as it has 10 cpu and running on avg 5-10% usr processes and 1.8 io . Does splunk multi thread indexing ? Or .my real question ... how do I get the latency on my events down to something more reasonable ... and not in the 24 hour range. ... View more

Splunk today is IPv4 subnet aware so that if you do a search with something like ip_address = 10.0.0.0/24 .. splunk knows to look for items 10.0.0.0 thru 10.0.0.255 ... NICE ! Now what about IPV6 ... I think the answer is No. my question is when or how can this be done example IPv6_ADDR = 2001:54FF::/48 would look for a whole lot of stuff but something like 2001:54FF:: to 2001:54FF:0000:FFFF:FFFF And this gets instresting as you can show the first part of the IPV6 address as 2001:54FF:0000:0000 or 2001:54ff:: or 2001:54ff:0000:: It depends on what the system sending the log spits out ... ... View more