How to automate the updating of the .csv file on all Splunk search heads using Shell script; the latest file will be available at git repo. The file will need to be pulled on Splunk deployment server from the git repo and re synced to the search head. The script will need to check for the file version and only re sync it if the version is newer than the last commit. ... View more

Hi, I have a string date format that shows up when I do a search; what I did was did a field extraction and named that string as Date, and create a table and sort -Date to show the latest date, but apparently it doesn't work since it acts as a text. Please advice. Date formats are as below: May 31 22:06:20 2017 May 29 22:06:20 2017 June 28 22:06:20 2017 June 27 22:06:20 2017 ... View more

I want to make a table that shows ACTION, DATABASE USER, PRIVILEGE, CLIENT USER and DBID; I want the value between ' '. My field extraction and rex fails. Please advice. Sat May 20 23:59:45 2017 LENGTH : '426' ACTION :[278] 'select sofar, context, start_time from v$session_longops where (start_time > nvl(:1, sysdate-100) or start_time = nvl(:2, sysdate+100)) and sid = :3 and serial# = :4 and opname like 'RMAN:%' order by start_time desc, context desc' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'bing' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '000000000' ... View more

I want to make a field extraction by the name of Action to show this whole text ,'update ggsourceadmin.monitor set ORACLE_TIME = CURRENT_TIMESTAMP WHERE TABLE_PK = 1',; how should I extract? ... View more