I'm working with following REGEX and event lines: https://regex101.com/r/YsuMHk/1 I plan to use the regex in an inline field extraction, but as you can see from the extracted fields both the "calling_num" value and the dialed_num value can potentially be prepended with spaces. How would I go about removing those leading spaces once the value has already been extracted within an inline field extraction? Thanks, Mike ... View more

I'm trying to do a field extraction for an Avaya call log. With this particular log event, every character, including spaces, are significant. Therefore this entry: #000#000#000031419 102900107 8*902 17145550104 71234 88888 0 0244 71247 0 0000101 #015 The characters (17145550104 71234) are in the characters in positions 33-54 and indicates that a call came in from 1-714-555-0104 and went to the exchange 7-1234. This would be 11 characters for the originating number and 10 characters for the destination number; in this case the first five characters of the destination number are spaces. A similar entry: #000#000#000031419 132500329 #060 713312155555331 50042424 25331 0 0000316 #015 In this case the field 713312155555331 contains the originating number, 7-1331 prepended by 6 spaces and a destination number of 215-555-5331, and is again in the positions 33-54. Any suggestions/tips on how to do this sort of field extraction would be greatly appreciated. Thanks, Mike ... View more

I'm looking over an XML log and in the Splunk viewer there are events with long strings of the following: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' I can't seem to find this string and/or key combination anywhere within the actual raw log files. Any idea why this might be? Thanks, Mike ... View more

I have the following event being sent from a Universal Forwarder (UF) syslog server to a standalone instance of Splunk: 4656Open Object101.3CIFS000x8020000000000000Audit SuccessSecurityc5e81075-f14f-11e3-9b1e-123478563412/cd4c5993-11b0-11e4-92a9-123478563412134.82.79.10S-1-5-21-2136110353-913448559-1712093940-13349falseBUCKNELLleisnhth-aSecurityFile00000000000466;00;015ce358;514e6b60(netspace_departments);/isr/public/www2/bu_only/AICT/images/oversize/IRM195.jpg%%4423 %%1538 2080Read Attributes; Read ACL; The data is obviously in an XML format. I created a subdirectory within $SPLUNK_HOME/etc/deployment-apps/IA-naaudit and in the default dir I have an inputs.conf: [monitor:///var/log/rsyslogs/Netapp/audit_svm_netspace_last.xml] index = netapp sourcetype = audit _TCP_ROUTING = dev_splunk and an outputs.conf [tcpout:dev_splunk] server = sptest:9996 I manually replicated these dirs and files on the UF in /opt/splunkforwarder/etc/apps/ I am now receiving the event data shown above. On the standalone instance I created the dir $SPLUNK_HOME/etc/deployment-apps/TA-naaudit and in the local dir I created props.conf: [netapp] KV_MODE = xml TIME_PREFIX = \ntscripts\< DEST_KEY = queue FORMAT = nullQueue Here is my problem: from the event you can see that it should have the timestamp "2017-03-27T16:18:55.218021000Z". When I do a search on index=netapp this event (along with a gazillion others) it gets the time stamp "3/27/17 12:40:40.000 PM" which is incorrect. Also, I'm trying to drop the events with the user "ntscripts" but they show up in the search as well. Can you tell me where I'm going wrong? Thanks, Mike ... View more

I inherited a Splunk installation and I'm a little confused about the app directories in $SPLUNK_HOME/etc (I'm sure its probably answered in docs.splunk.com, and I've looked but I can't seem to find where this might be documented) (1) I have both a standalone Splunk installation and an installation with a cluster manager. In each installation there is an "apps", "deployment-apps", "master-apps" and "system" directory in $SPLUNK_HOME/etc. When would I use each specific directory? (2) Within "apps", "deployment-apps", and "master-apps", there are directories (that have the standard default/local/metadata subdirectories) called IA-appname and TA-appname where appname is something like "shibboleth" for data forwarded from Shibboleth servers. What goes in the IA dirs and what goes in the TA dirs? (3) Is there a way (either CLI or Web GUI) to determine if the changes I've made or IA/TA subdirectories I've created have been incorporated into the Splunk configuration? Thanks for any help/suggestions/links you can offer. Mike ... View more