There are definitely more secure ways of storing passwords, which they should be using. in the meantime, here's how to "securely" (at least on your own box, not through some internet service) base64 your password: $ ./bin/splunk cmd python >>> import base64 >>> base64.b64encode('enterMyPWhere') 'base64encpwhere==' Don't forget to leave off the quotes when pasting back in to the conf file! ... View more

I found this to work well: statsing by _time and your split-by field. It is more efficient as you are not potentially reversing hundreds of thousands of events: index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | bucket _time span=1h | stats sum(MB) as MB by st | streamstats sum(MB) as MB by st | timechart span=1h last(MB) as MB by st is a nice cumulative graph of indexing today by sourcetype. And over a day it creates 25 rows, which is a lot easier to reverse than 800,000 original log lines... ... View more

This will be a lot more efficient if you do a stats table first, statsing by _time and the value you're interested in. Plus, you won't need a reverse anymore, because the stats table will be ordered by time: search ... | bucket _time span=1d | stats sum(value) as value | accum value as totalvalue | timechart last(totalvalue) span=1d - use the same bucketing of _time as the span in timechart and splunk has even less work to do in the timechart. ... View more

curl will need to use a splunk username/password to log on. The Splunk user must have a role with the capability "edit_tcp" ... View more

You can use the REST api to send an event to Splunk: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTinput#receivers.2Fsimple There's even an example with curl. It looks like wget doesn't support sending multipart/form-data to upload a file. ... View more

I got this to work today by using the library in the app: ln -s /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/libcpc++-libc6.1-2.so.3 /lib/libcpc++-libc6.1-2.so.3 See my recent answer for other libraries necessary on ubuntu/debian: http://answers.splunk.com/answers/82392/checkpoint-opsec-lea-client-script/107439 ... View more

You're probably running Ubuntu/Debian 64-bit. The app requires 32-bit libraries, but the Splunk docs only tell you how to get them on Red Hat based systems. Try these to get the libraries below. Then you have to symlink a crusty old library (which thankfully the TA supplies) into /lib just to get the thing to run! apt-get install libc6:i386 libpam0g:i386 ln -s /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/libcpc++-libc6.1-2.so.3 /lib/libcpc++-libc6.1-2.so.3 Evidently this has been causing issues for over 12 years, if that makes you feel any better. Thanks for the crap binary, checkpoint. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk3960 ... View more

Yes, that looks closest to a "zerofill" function, or "format" function or something. I don't think I filed an ER. ... View more

More importantly, this "multiline mode" means that ^ and $ match the beginning and end (respectively) of each line, not the beginning and end of the entire string. This is important in multiline events, in case you want to find an item at the beginning of a line somewhere in your event. ... View more

How about this - keeps it simple. Use eval to tack on as many zeroes as you'll ever need, then rex to get the last x amount of digits. Regular ... | eval myint="000000".myint | rex field=myint "(?<myint>\d{6})$" Hex ... | eval myhex="00000000".myhex | rex field=myhex "(?<myhex>[0-9A-Fa-f]{8})$" ... View more

Nor are appends supported in realtime, though they don't error out. Consider this search: index=_internal | stats count by host | append [inputlookup allHosts] | stats max(count) as count by host Non-RT, it shows all hosts in allHosts, even if they don't have any events. Changed to RT, it becomes a shorter list of only hosts that have events. ... View more

Evidently that's not completely true, as you get an error "This command is not supported in a real-time search" when you try to run an | inputlookup in a real time search. Also, appends don't work, and don't give errors. index=_internal | stats count by host | append [inputlookup allhosts] | stats max(count) as count by host works as expected on a non-RT search but doesn't show any values in the lookup that are not in the main seach when changed to RT. ... View more

Well, joins or appends work when it's not a realtime search. The whole point was a realtime status dsahboard though. I just tested index=_internal | stats count by host | append [inputlookup allHosts] | stats max(count) as count by host and found that it works properly (showing hosts as blank if they are in the lookup but not in the events) if run non-RT, but only shows hosts in the events if changed to RT. ... View more

Unless they have fixed type=outer to mean full outer join (not left outer join) then you'll still run into problems where an app is in the listing but has no status (perhaps because it's down) - there will be no line for it. ... View more

Yes, this is possible, and very useful for Perfmon with its counter= value= format. Try this: | eval {counter}=value This naturally only works when you have a small number of values of counter where you can explicitly state them in a stats, or perhaps use fields beforehand to narrow down the number of available fields for a stats * http://answers.splunk.com/answers/103700/how-do-i-create-a-field-whose-name-is-the-value-of-another-field-like-backticks-or-eval-in-other-languages ... View more

Note that Splunk can be a Master and a deploy client though - allowing you to control one or more masters' master-apps folders from a central location if needed. ... View more

Well, that mentions they're different, I want to know how they're different, why one (NOT) added some unnecessary terms to litsearch that broke one of my searches when the other (!=) did not. ... View more

It appears milliseconds are dropped by the command that creates the summary index file - I'm going to file a bug. Case 123267 ... View more

There is no requirement for the License Master to be on the same instance as the cluster master. I worked on a customer site yesterday where the Search Head was the License Master. ... View more