My props and transforms.conf work fine and I am able to see the fields on the GUI of search heads ( We are running splunk 4.2 in agent-->full forwarders-->Indexers-->search heads setup)..when I run a search they show field1 occured "x%" TIMES in the seach..But as soon as I click on the field It returns no rows ...When I use a wild card in the search It does return the data Example Index=abc will return dept_name="some_dept" exists in 10 % of the results and dept_name="finance" exists 2 % of time etc ..when I click the field dept_name="some_dept" and search becomes like index=abc dept_name="some_dept" the search returns zero rows when I do index=abc dept_name=some* then I see all the data ...There are no other fields that get satisfied in some* regex except "some_dept" ... View more

I need to monitor/splunk multiple files in a directory "/app/products/xxxx/yyy/logs/" This directory has files like aaa-queries.log.yyyymmdd AND aaa-engineInfo.log.yyyymmdd . The issue I have is thesefiles will stay unzipped for 3 days ..so today I will have following 3 files for onelog aaa-queries.log.20111128 aaa-queries.log.20111127 aaa-queries.log.20111126 My inputs.conf and props.conf entries on app/ agent box are as follows [monitor:///app/products/xxx/yyy/logs/] index=xxxx disabled = false followTail = 1 blacklist = .(gz|zip|bkz|arch|etc)$ [root@ local]# more props.conf [source::.../aaa-queries.log.d+] sourcetype = queries_log [source::.../aaa-engineInfo.log.d+] sourcetype = engineInfo_log Becasue I get multiple logs i.e all 3 logs for each source as a part of my source regex ..My sourcetype is not being set properly i.e Is shows as "suggestions-queries.log-too_small" etc . I think because my sourcetype is not set properly I am not able to do field extractions on my search head servers . Is there a way to uniqely set sourcetype in this case . Zipping the old file / changing application is not a option as the logs are huge and other app components need those files to stay for 3 days . ... View more

What I am trying to achive is to ignore any carriage returns , new lines ,special symbols and Break the log into lines/ events when It sees regex "-----#-----" . I tried the g on following entries in my props.conf on full forwarder ..I am running splunk 4.2.2 on redhat . Props.conf entries that I tried are : [work_request] TZ = US/Eastern TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_EVENTS=1 SHOULD_LINEMERGE = false LINE_BREAKER = (?m)([-]{5,}#[-]{5,}) LINE_BREAKER = (\-----#-----*) LINE_BREAKER_LOOKBEHIND = 1000 #BREAK_ONLY_AFTER = -----#-----* #BREAK_ONLY_AFTER = ([\r]*[-----#-----]{1}[\r]*) #BREAK_ONLY_AFTER = ([\r\n]+[-----#-----]{1}[\r\n]+)** sample log : 1 Not Yet Requested ROCC Phone [code]Dear Ops, xxxx would like to set registry lock on about 550 domains, they are asking how long it will take to proceed this. the customer had asked this twice now, could you please investigate? Thank you. [/code] Normal 0 1 WREQ0002372 yyyyyy 0 Bulk update for 550 domain name Open Work Request sfdc 2011-10-14 05:10:14 global 00d676a30a0a3c4e01fcd527a37bbca9 4 kaddada 2011-10-14 14:27:01 ROCC 2011-10-14 14:27:01 2011-10-14 05:10:16 CORE SRS Verification T-00002893: Bulk update for 550 domain name Request for Information Low 1 2011-10-14 14:27:00 Proceed to Next Task Cancel all future Tasks -----#----- 1 Not Yet Requested ROCC Phone [code] Dear OPS, Please find the attached file which has list of domanis, which need to be put on Registry Lock.| Below are Registrar Details Registrar Name:| xxxxxxxx INTERNET NAMES WORLDWIDE GURID: 22 NCC ID: 33 Please note : Registrar is requesting this to be done ASAP. Regards asvvvvr [/code] Normal 0 1 WREQ0002373 Nitin Asher 0 Registry Lock Open Work Request sfdc 2011-10-14 06:17:33 global 0114162f0a0a3c4e01124621ff497c0c 4 kaddada 2011-10-14 14:26:35 ROCC 2011-10-14 14:26:35 2011-10-14 06:17:35 CORE SRS Verification T-00002894: Registry Lock Request for Information Low 1 2011-10-14 14:26:34 Proceed to Next Task Cancel all future Tasks -----#----- 1 Not Yet Requested SYMC Colo User CORP.MTV1 Phone Details: Hi^M We are changing the IP address for authconnect-mtv.verisign.net to 216.168.241.251. The details as follows^M ^M ... View more

I have a splunk 4.2.2 installation where I am doing the following search and plotting the results . Search works some times and other times I get the following error . Query: index="emc_stats" | timechart span=5m avg(read_IO),avg(WIO),avg(RKB),avg(WKB),avg(RH_pct),avg(WH_pct),avg(RS_pct),avg(WS_pct),avg(WPT) by sid_dg Error PARSER: Applying intentions failed plot: Cannot split when specifying more than one field. Any help is appriciated! ... View more