Hi all, I'm having trouble getting an external file lookup to work in the Search app. I've setup a number of these previously and have had no issues but this one is failing and I can't seem to work out why. The props.conf and transforms.conf seem OK as if I add some dummy data I get the results I'm looking for but with the live data it's failing. I have a feeling it's because of the "/" characters in the initial lookup. Below is a sample of the lookup file :- port,device GigabitEthernet1/0/1,Server1 GigabitEthernet1/0/2,Server2 GigabitEthernet1/0/3,Server3 GigabitEthernet1/0/4,Server4 GigabitEthernet1/0/5,Server5 GigabitEthernet1/0/6,Server6 GigabitEthernet1/0/7,Server7 Can anyone confirm and let me know if there's any way I can work around this? Thanks, Martin ... View more

Hi guys, I've been trying to get a new index built to import some IIS logs and in the process of importing and deleting content to get the formats right, I've tripped over the 500MBytes per day limit of the Free License. Trouble is, I'm hoping to back fill the final version index with some historical data but of course I'm already over the daily limit. From what I've read, the daily limit counts as one violation per day if the daily indexed volume remains at midnight. So I guess my question is, as a one off, if I continue with the backfill (bearing in mind my Splunk box is also continuing to recieve it's normal syslog traffic of around 45Mbytes per day too), will I just count as a single violation even if I'm over by a couple of hundred meg? Moving forward, the IIS boxes are generating about 90Mbyes per day between them, so I would normally be well under the 500 MBytes limit. Thanks and best regards. ... View more

![alt text][1]Hi all, I'm looking to create a new index on my Splunk server to pull in the log files from our APC networked UPS's. We already grab the event data by syslog but also want to grab the environmental data, stuff like the current mains voltage and, more importantly, the internal temperature. There doesn't seem to be any way to get this by syslog so my option seems to be to export the data using the log rotate function and then use Splunk to monitor the ftp location for files. The problem coems when I try to import it. The format of the file is essentially a header including colum names, then a following section including tabbed data, again with columns (see below) Network Management Card AOS v3.7.3 Smart-UPS & Matrix-UPS APP v3.7.2 Date Time Name Contact Location System IP 05/28/2012 09:13:27 BIEUP001 Martin Pugh BH0C 10.2.201.1 Smart-UPS 1500 RM Date Time Vmin Vmax Vout %Wout Freq %Cap Vbat TupsC 05/19/2012 16:13:50 249.1 252.0 221.7 17.5 50.00 100.0 27.67 26.1 05/19/2012 16:23:50 249.1 250.5 221.7 17.5 50.00 100.0 27.67 25.6 When I start creating the new index and ask Splunk to look at the file, it manages to identify the time and date fields but then I see no way to match up the remaining columns to their colum headers. Is there a way to somehow get Splunk to match a colum to a field name? Thanks and best regards, Martin ... View more