v5.0.4 indexers I'm trying to get some Apache access logs to index with the correct timestamp, but no matter what I try, I can't get the date/time to be recognized correctly. Example log: www.somesite.com somestuff somemorestuff 192.168.1.1 2014-09-22 08:26:39 CDT 200 200 15416 - HTTP "GET blah" some more stuff I've applied the following in props.conf to the sourcetype: [thisparticular:apacheaccess] MAX_TIMESTAMP_LOOKAHEAD=19 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=false TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=(?:\d{1,3}\.){3}\d{1,3}\s The preview highlights the date and time as being found, but with a bit of a mixed up timestamp: 9/20/01 7:22:39.000 AM I'd prefer having the timestamp first in the raw log (which is still an option for me), but I want to exhaust efforts in trying to get the above to work before making a change to the log format. Am I missing something simple here? ... View more

Just curious if anyone out there has had any experience getting their Office 365 Administrator Audit Logs into Splunk. They are easily downloadable via the ECP, but I'm looking to script something through PowerShell and have it grab the logs automagically. ... View more

I'm trying to set up an alert based on day-over-day vs. last week for a 5m count. For instance, if certain iis events delta over a certain percentage compared to last week's count. I can graph the three (Today, Last_Week, and Difference) using this: index=iis latest=now earliest=-5m sc_status=200 | timechart count as Today | appendcols [search index=iis latest=-10080m earliest=-10085m sc_status=200 | timechart count as Last_Week ] | eval Difference = Today - Last_Week My question is, how do I turn that into a search I can run every 5 minutes that returns only the "Difference" in percentage form so I can set up an alert if it changes more than an acceptable amount? I've tried using stats, but it seems nesting it in a subsearch creates an issue. ... View more