I have a directory with about 750 log files. The files are all text files and the total size of this directory is 117 GB. I need to index the files once (not continuously).  Would the best option to index all the files in the directory be to copy the files to my Splunk instance and then use the directory input option from Splunk Web i.e. Settings > Data Inputs > Files & Directories ?  Any other recommended options ? ... View more

I am working with JSON data type events and am trying to extract the username (user1, user2) from the pathspec data structure in my events (sample below) : "pathspec": {"__type__": "PathSpec", "location": "/media/APA_windows/Users/user1/AppData/Local/Microsoft/Windows/UsrClass.dat", "type_indicator": "OS"} "pathspec": {"__type__": "PathSpec", "location": "/media/APA_windows/Users/user2/AppData/Local/Microsoft/Windows/UsrClass.dat", "type_indicator": "OS"} I am using the below SPL to split up pathspec.location into a multi value field and then use mvindex :    ..... | makemv delim="/" pathspec.location | eval user_name = mvindex(pathspec.location, 3)   However when I table out the user_name field it does not show any results. Not sure why this is not working. Any suggestions would be helpful  Desired output from the user_name field would be    user1 user2 . . . . .           ... View more

Hi  I'm a beginner at Splunk and am running into a problem with lookups. I have indexed IIS data in one sourcetype called 'iis' and uploaded a lookup csv called 'cve-ip'  which is defined already. Trying to corelate and find matches for the 'src_ip' column in the 'cve-ip' file with the 'c-ip' field in the 'iis' source type. Here is the SPL lookup I am running :  sourcetype=iis | lookup cve-ip src_ip AS c_ip  This SPL is returning all events in the 'iis' sourcetype and not only those which match the values in the 'src_ip' column in the 'cve-ip' file. I would like some help figuring out why this is happening and returning all events as opposed to just matching events. Happy to provide any details as needed ... View more