I'm struggling to convert a duration in format HH:MM:SS.NNNNNNN to seconds in a concise manner. For example, 01:03:01.8231963 should convert to 97381.8231963 seconds. The convert function dur2sec supports the format [D+]HH:MM:SS while the mstime function supports the format [MM:]SS.SSS however there isn't a single function to support my format. I've come up with the following solution where cputime is the field I am trying to convert, however, it feels like there should be a simpler way. | rex field=cputime "(?<cputime_s>\d+\:\d+\:\d+)(?<cputime_ms>\.\d+)" | convert dur2sec(cputime_s) | eval cputime_s=cputime_s+tonumber(cputime_ms) ... View more

Splunk appears to be calling "Win32_Product" WMI function that triggers a consistency check of installed applications causing numberous 1035 event codes to be generated in the event log (approximately 100 every 10 minutes). It appears to correlate nicely with perfmon queries. eventtype="wineventlog_windows" sourcetype="WinEventLog:*" EventCode=1035 SourceName=MsiInstaller I can confirm that, through PowerShell, executing "Get-WmiObject Win32_Product" does indeed trigger the 1035 events/ I've looked through our configs and have verified that we are not running a Win32_Product WMI query explicitly and I verified that running the Splunk command 'splunk-wmi' does not trigger the generation of 1035 events. Not all machines exhibit this problem and we have not been able to determine a pattern on why some are affected and others are not. Software Windows Server 2012 Splunk Universal Forwarder 6.2.2 More information in Microsoft KB article: Event log message indicates that the Windows Installer reconfigured all installed applications: https://support.microsoft.com/en-us/kb/974524 ... View more

We are scraping IIS advanced logs using Splunk Universal Forwarder and Indexers on v6.2.2. We've discovered that a small percentage of our logs are being parsed mid-line causing them to have incorrect field extractions. For example, in Splunk the lines are parsed as: ro\MainWS.asmx" 200 "AU01" - 0 3015 900 - 1234:5678:abcd::8e98:6635 - "au01" POST 1201 - - inWS.asmx app=fire(3408) "E:\inetpub\MainWS.asmx" 200 "AP01" - 0 5460 6505 - 1234:5678:abcd::8e98:683a - "ap01" POST 124 - - nary/mainws.asmx - "E:\inetpub\binary\mainws.asmx" 200 "CGYETRMAP01" - 0 2587 5980 - 169.152.5.219 - "ap01" POST 1981 - - I've verified in the original source files that the lines are properly formatted. I did find many instances of these warnings however I cannot determine why they are occurring. 05-25-2015 00:09:24.806 -0600 WARN DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event (Mon May 25 00:09:24 2015). Our inputs.conf is [monitor://C:\inetpub\logs\AdvancedLogs] index = windows sourcetype=iis disabled = 0 whitelist = \.log$ ... View more

I'm trying to produce a report that shows the difference between new and missing IDs from one day to the next day over a period of time. I've looked into this answer but I'm not sure how to apply it to my problem. The base query sourcetype=client | bucket _time span=1d | stats values(deviceId) by _time gives me a set of distinct device IDs. How do I get a set of distinct device IDs from the previous day so that I can get a count of the IDs that are new and removed so that I can get a report such as this? Date | Total | New | Removed ---------------------------- x 5 0 1 x+1 6 2 1 x+2 9 3 0 ... View more