You can also use Splunk's search language to return the results of a saved search via: | savedsearch <savedsearchname> ... View more

gnovak, I would recommend using the "transaction" command for this. You would need to extract a field (i.e. alert_id) which uniquely identifies your alerts (i.e. rg-da-dysonrep3). Then you would perform you search like so: <my alert events> | transaction alert_id startswith=PROBLEM endswith=ACKNOWLEDGEMENT | stats max(duration) by alert_id Ultimately "transaction" will give you a "duration" field that you can do a number of things with...like calculate average duration by analyst. See also: http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction ... View more

There is an example of this being used in the windows app. Looking at Win 2k8 environment variables I see a system variable of "windir". This leads me to believe it must be a system variable (or perhaps a user variable matching the user running the splunkd service), and is case insensitive. [monitor://$WINDIR\WindowsUpdate.log] sourcetype = WindowsUpdateLog disabled = 1 ... View more

If the windows app has these outputs disabled these properties will override your properties since "windows" is evaluated before "winev". ... View more

I would recommend making CSS changes from within your own app: $SPLUNK_HOME/etc/apps/<appname>/appserver/static/ See also: http://www.splunk.com/base/Documentation/4.2/Developer/UseCSS ... View more

Joetron, I just indexed your sample log above with the TIME_PREFIX and TIME_FORMAT properties above and everything looks good. What specifically didn't work? Be sure to specify these properties on indexer or full forwarder. ... View more

Christian, From your search you are looking to do a token replacement on $head$. To achieve this you need to use a "stringreplace" intention. You can specify "| head $head$" in your search, or use "prefix" in the intention below. <module name="ConvertToIntention"> <param name="settingToConvert">head</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="head"> <param name="fillOnEmpty">False</param> <param name="prefix">head </param> <param name="value">$target$</param> </param> </param> </param> ... View more

Would it be possible to add an anonymized sample event(s) to your use case? ... View more

I think klee means a saved search that alerts via email.?! ... View more

I would highly discourage CHECK_FOR_HEADER and recommend FIELDS/DELIMS ... View more

dpatnam, For TIME_FORMAT be sure to use strptime specifiers like so: TIME_FORMAT = %d%B%Y;%H:%M:%S See also: http://docs.python.org/library/time.html ... View more

This should work as well as long as you don't have different split-by fields. ... View more

This would probably be done easiest w/ the 'append' search command like so: index=summary report=unique_clients | stats sum(Unique_Clients) ... | append[search index=summary report=4xx_errors | stats sum(NumErrors) ...] The only problem I forsee is figuring which rows should have values for which columns. It may be simple enough to ignore null column values for a given row. ... View more

Jason, You may want to open a ticket w/ support related to this. I replicated your configurations locally, and was not able to reproduce the error. Good Luck! ... View more

That's correct. If you export something as 'none', it is only available from within the contained app. Exporting as 'system' will make it available to all visible apps. ... View more

beaumaris, I would recommend setting up a scripted inputs for this in inputs.conf like so: ## inputs.conf [script://$SPLUNK_HOME/etc/apps/<your_app_here>/bin/<your_script>.py] disabled = false ## once per week on wednesday; using cron such that search doesn't execute @ start time interval = 0 0 * * 3 For schedules, you can use an interval specified as # secs between executions, or a chron schedule. I think the approach you are using to generate a .csv and use as a lookup w/in Splunk is the correct one. I don't believe Splunk cache's the .csv data, so contents will be read from disk per invocation. Updates to the .csv should take immediate affect in Splunk. 10k-20k rows should not be a problem. There are considerations for distributed environments as the list will by default be replicated down to the indexers. If the list is interacted w/ via "| lookup" instead of props.conf you can add the csv to distsearch.conf replication blacklist and use "| lookup local=true" which will make the lookup local to your search server. See also: http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf http://www.splunk.com/base/Documentation/latest/Admin/Distsearchconf ... View more

David, As of 4.2.0, you only have the option of exporting content within the app it's contained, or system wide. Per default.meta.spec: # Set access controls on a specific view in this app. [views/index_status] access = read : [ admin ], write : [ admin ] * Allow only admin users to read or modify this view. # Make this view available in all apps. export = system * To make this view available only in this app, set 'export = none' instead. owner = admin * Set admin as the owner of this view. See also: http://www.splunk.com/base/Documentation/4.2/admin/Defaultmetaconf ... View more

Jason, What version of Splunk are you using? I just tried reproducing this successfully in 4.2 like so: ## macros.conf [mymacro] definition = stats dc(sourcetype) as unique_sourcetypes, last(host) as last_host by source ## searches (both worked fine) index=_internal | head 10 | `mymacro` index=_internal | head 10 | `mymacro` | table * Could you possible provide you macro definition? I noticed in the search above you didn't have backticks surrounding your macro...I'm assuming this was just in the example, or something escaped by answers? ... View more

You should be able to do this with a few index-time properties. TIME_PREFIX tells Splunk where to start looking for a time match, and TIME_FORMAT tells Splunk what format to use: ## props.conf [<your_sourcetype>] TIME_PREFIX = ([^,]+), TIME_FORMAT = %a %b %d %Y Additional references if needed: http://www.splunk.com/base/Documentation/latest/Admin/Propsconf http://docs.python.org/library/time.html ... View more

If your interested in evaluating longer periods of time (or multiple hosts) you may want to check out the metrics logs created by Splunk: index=_internal source=*metrics* group=per_host_thruput | stats sum(ev) as count by series | search count>500 You can also specify time constraints in the scheduled search instead of the search syntax itself. ... View more

I am not sure why stats is not satisfying the use case of "trying to remove duplicate values...". I tested this locally and if you have: Event 1: recipient=a;b;c;c Event 2: recipient=x;y;z;a This search: index=_internal | head 1 | eval recipient="a;b;c;c" | append [search index=_internal | head 1 | eval recipient="x;y;z;a"] | eval recipientList=split(recipient, ";") | stats count by recipientList Produces: a 2 b 1 c 2 x 1 y 1 z 1 Which is a consolidate list of email addresses. ... View more

Looks like Sorkin also addressed this in: http://answers.splunk.com/questions/12396/dedup-and-multivalued-fields ... View more