Greetings, Quoting from https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Commontimeformatvariables,      Refer to the list of tz database time zones for all permissible time zone values.  My question: Given a search statement such as     strptime(SLA." ".timeZone, "%H:%M %Z")     Does Splunk have any built-in time zone database that might require periodic updates as for instance, when a locale changes its standard to daylight saving dates, or does Splunk simply use the database that's baked into a lower layer of the stack?     ... View more

Given an event indexed from an XML document, with content like the example below, featuring a "properties" tag containing multiple "property" entries, I would like to extract a kv pair for each property. That is, for each property, "key" = the value of the property's "key" attribute and "value" = property's "value" attribute. This is perplexing me, having tried combinations and permutations of xpath and spath. Have also tried extract using a transform that looks like this: [agentinfo.properties] CLEAN_KEYS = 1 FORMAT = $1::$2 REGEX = \ REPEAT_MATCH = true MV_ADD = 1 ... which I would have thought would do the trick. Anybody see what I am missing? Thanks v much in advance. ** <Id>-336517289</Id> <properties> <property value="true" key=".environment.hasApplicationCommandLine"/> <property value="2266747070" key="clock.frequency"/> <property value="UTF-8" key="runtime.codeset"/> <property value="1427518318882" key=".start.date"/> <property value="0" key=".instrumentationState"/> <property value="MarkSweepCompact" key="runtime.garbagecollectors"/> <property value="100000" key=".buffercount"/> </properties> <systemProfileName>profile1</systemProfileName> <timestamp>1427518318882</timestamp> <totalCpuTime>0.0</totalCpuTime> <totalExecutionTime>0.0</totalExecutionTime> ** ... View more

Greetings, I apologize in advance for the long post. Problem abstract: field discovery and extract work great, but searching on extracted fields gives weird results. Input stream: single-line events made up of unordered keyword/value pairs. Each pair has format KEYWORD^VALUE, where "^" is the K=V separator. Pairs are delimited by 0x1F. One example event is below: action_forunit^n/a\x1Faction_type^action_execute\x1Fresource_id^ELFVIEW\x1FappId^ERD\x1Fresource_currency^USD\x1FcorrId^0\x1FtimeStamp^1378492210757\x1FeventType^3000\x1Faction_foruser^InformDeveloper\x1Fhostname^rsomdavecs01\x1Fresource_amount^0.0\x1Faction_forcustomer^n/a\x1Faction_foraccount^n/a\x1Faction_forregion^n/a\x1Faction_forgroup^unknown\x1Fresource_info^n/a\x1Fresult_info^n/a\x1Faudit_level^1\x1Faction_info^Performing doGet() of the MainServlet\x1FcomponentId^ELFView\x1Fresource_name^ELF View Web Application\x1FsessionId^N/A\x1Fresource_idtype^product_code\x1Fresult_type^result_success\x1Fresource_type^resource_product\x1F Note: The sequence "\x1F" above represents a single byte 0x1F, as represented in Splunk search, but have verified actual 0x0f using hex dump. Event breaking and time stamping as follows: default/props.conf [ELFDATA] NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_PREFIX=timeStamp\^ pulldown_type=1 Field extractions as follows: local/props.conf [ELFDATA] REPORT-ELFKV = ELFKV local/transforms.conf [ELFKV] CLEAN_KEYS = 1 FORMAT = $1::$2 MV_ADD = 0 REGEX = ([^\^]+?)\^([^\x1f]+?)[\x1f] For the sample data above, field "appId" is extracted and assigned value “ERD”. But a search using appId="ERD" returns no results. Also, certain wildcard searches ( appId=*, appId=*ERD, appId="E*" ) work, while others ( appId="ERD*", appId="ER*" ) don't. Makes no sense that I can see. Partial workaround by piping search results to a subsequent search, as: <first search> | search appId="ERD" Works (though I wish someobody would tell me why), but fails when a new search is generated, as in auto-drilldown. Like I said, sorry for the length of the post. Brevity was never my strong suit. ... View more