Match = When the same field on both hosts has the same value. In the example below, both server1 and server2 have a value of "1" in Field_a. That constitutes a match. If Field_a on both hosts has a value of "1" then we have a match. Server1 - Field_a=1 Server2 - Field_a=1   I wish to verify that the values in each of the four fields on server1 match the values in each of the 4 fields on server2. Server1                Server2 node_name  =  node_name node_id      =     node_id active        =        active type         =          type   ... View more

I have 2 servers FLSM-ZEUS=-PSQL-01, FLSM-ZEUS-PSQL-02. Both servers are part of a SQL cluster. They both have identical records on them. The fields on both servers are node_name, node_id, active, and type. What I wish to do is come up with a search that makes sure the fields on both servers match. Some of them are multivalue fields. The reason for this is, if the cluster isn't communicating correctly, the records may become out of sync. If this happens, I'll create an alert letting me know. ... View more

My goal is to make sure that databases on 2 servers have the same data. I'll be using this search in an alert to monitor the health of a sql cluster. My goal it to create an alert that triggers when  the fields:  node_name, node_id, active or type  on both servers don't match each other. ... View more

I'm still doing something incorrect.  I'm editing /opt/splunk/etc/apps/Splunk_TA_nix/local/props.conf on my standalone enterprise server.  I added this at the bottom of the file. Sourcetype of the search is fileshares: [fileshares] EXTRACT-SystemTime = SystemTime="(?<SystemTime>[^"]+) EXTRACT-SubjectDomainName = SubjectDomainName">(?<Domain>[^\<]+) EXTRACT-SubjectUserName = SubjectUserName">(?<Username>[^\<]+) EXTRACT-ObjectType = ObjectType">(?<ObjectType>[^\<]+) I also tried this:  [fileshares] KV_MODE=xml Restarted splunk and neither of the above worked. Using |xmlkv works fine btw, but grabs way too many fields, slowing the search. Thanks ahead of time from the newbe. ... View more

XML: "" <Data Name="SubjectDomainName">US</Data><Data Name="SubjectUserName">fmtdc</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">File</Data> "" ... View more

I'm new at working with transforms.conf and props.conf. To better explain my issue. I've got an XML file that I'm trying to generate fields for. I'm using this search portion which works: index="fileshares" sourcetype="fileshares" source="/mnt/auditlog/*" | rex "SystemTime=\"(?<SystemTime>[^\"]+)" | rex "\"SubjectDomainName\">(?<Domain>[^\<]+)"  | rex "\"SubjectUserName\">(?<Username>[^\<]+)" | rex "\"ObjectType\">(?<ObjectType>[^\<]+)" I'd like to have these fields created so that the rex statements are not necessary. If using EXTRACT-fields is the best method for this, what should the configuration look like for these fields? ... View more