What you're looking for is Event Renderers. You might wish to take a look at this previous thread:       http://answers.splunk.com/questions/7378/modifying-css-to-colorize-table-rows-in-dashboard-panel-with-event-renderer-conf In its simplest form, the three steps are: Create eventtypes in eventtypes.conf for each set of events to be colorized. Create matching entries in event_renderers.conf for each of the eventtypes that you created. This maps each eventtype to a CSS class. Create your CSS classes in appserver/static/application.css for each of your new CSS classes. (You can also use a per-view CSS file by defining "stylesheet=xxx.css" in the XML for that view) For example (adapted from the OSSEC app): eventtypes.conf: [ossec_high_severity] search = eventtype=ossec (severity>8) event_renderers.conf: [er_ossec_high_severity] eventtype = ossec_high_severity css_class = OssecHighSeverity appserver/static/application.css: /* Red-line border for high-severity events */ .splEvent-OssecHighSeverity table { border: solid red 1px; } If you want to do more than basic formatting, then you can also customize the HTML template and/or JavaScript code for those events (link). Here's another good CSS-only example, from a recent blog post:      http://blogs.splunk.com/2010/10/26/colorize-your-world-or-at-least-your-splunk-results/ ... View more

Instead of stats list , use stats values to get the distinct list: index="main" " My Search String" | stats values(c_ip) by cs_username To limit to cases where there is more than one distinct value: index="main" " My Search String" | stats dc(c_ip) as distinctCount values(c_ip) by cs_username | where distinctCount>1 ... View more

By default, Splunk is going to look at the CRC values of the beginning and end of the file. If your file does not change much, this may not be enough. Assuming the filename is always the same, the simplest solution is to look solely at the timestamp instead. In props.conf: [source:///path/to/yoursourcefile] CHECK_METHOD = modtime This will cause Splunk to re-index the file every time the modification timestamp changes, rather than looking at the content. If the filename changes, the crcSalt option in inputs.conf is another possibility. You can also look at this link if you want to dig deeper into the root cause - there are some debugging options that can be turned on to provide more information:      http://www.splunk.com/wiki/Community:Troubleshooting_Monitor_Inputs ... View more

Use eval with if : ... | eval inbytes=if(dir=inb, client_bytes, server_bytes) | eval outbytes=if(dir=outb, client_bytes, server_bytes) | stats sum(inbytes) sum(outbytes) See also, functions for eval and where ... View more

Sure, this is pretty easy to do. Create a CSV-based lookup table with two columns, e.g.: query, ignored "some.domain.x","true" "some.domain.y","true" ... When you call the lookup, any values for query not in your CSV list will have an empty value for ignored . So, your search becomes: sourcetype="dns" query_type="A" | lookup domainsToIgnore query OUTPUT ignored | search NOT ignored=true If you need more more general information on how to create the lookup table, take a look at: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources ... View more

As long as only one or the other is present, use coalesce : | eval accountID=coalesce(accountID, AccountID) | stats dc(accountID) Another possibility would be to use rex . If, for example IDs are numeric: | rex field=_raw "(?i)AccountID=(?<accountID>\d+)" The rex approach is better if you need to deal with the possibility of multiple matches in one event. ... View more

You can set an explicit time format in props.conf and leave the timezone offset out. Take a look at:      http://www.splunk.com/base/Documentation/latest/Admin/Configuretimestamprecognition and look specifically at the TIME_FORMAT option. ... View more

You can match on everything, then override it for the subset you want to keep. Take a look at: http://www.splunk.com/base/Documentation/4.1.5/Admin/Routeandfilterdata#Keep_specific_events_and_discard_the_rest transforms.conf: [stellent_setnull] REGEX = IdcServerThread DEST_KEY = queue FORMAT = nullQueue [stellent_keep] REGEX = IdcServerThread[\d\-\s]+Configuring DEST_KEY = queue FORMAT = indexQueue props.conf [source::.../*stub/etc/log] sourcetype = stellent_log TRANSFORMS-stellent = stellent_setnull, stellent_keep The indexer will set all matching events to nullQueue, but then reset the "verbose" ones back to indexQueue. ... View more

This will be difficult via the normal search language, but easy via Python. It is complicated by the variable number of key/value pairs. Consider implementing a custom search command. ... View more

Assuming your alternate timestamp is already being extracted into a field named EventTime , then you can use eval to replace the original value of the _time field: | eval _time=EventTime If you don't have a field extraction set up, you can also use rex to extract the alternate timestamp from _raw into _time . Be aware that your timestamp needs to be a valid Unix epoch time to work. If your data shows the time in text format, you'll need to convert it first. The exact parameters will vary based on the format. For a date of the form 2010-10-26 14:50:58, you would need: | eval _time=strptime(EventTime, "%Y-%m-%d %H:%M:%S") If you are always going to want this timestamp instead of the one that Splunk is extracting automatically, take a look at http://www.splunk.com/base/Documentation/4.1.5/Admin/ConfigurePositionalTimestampExtraction for information on how to modify Splunk's default timestamp recognition. ... View more