since one of the username need to be simulate with regex query . I am forced to use regex how can I do it so that I simulate kind of OR condition between main and sub search query index=main suser IN("abc","def") | search  regex suser =”DEF[0-9]" AND EventID IN("323","322")   Thanks       ... View more

I just want to know which filed name makes more sense to use for the segregation of the log type. for example, we have Linux and windows logs. for separation of the log types in the report or alert which filed should be used. "source type" or "event type". and if you define it with a valid reason I would be very glad thanks     ... View more

i can create chart for volume status of C: logicalpartition how can i bring in the some chart also the status of D partition. so that mean i should related to any host C and D partition. how can i do it. index=main sourcetype="Perfmon:Free Disk Space" instance="C:" | chart latest(Value) as Valuex by host |eval PercentFree = 100 - Valuex | eval redCritical = if(PercentFree >= 86,PercentFree ,0) | eval yellowWarning = if(PercentFree > 76 AND PercentFree <=85,PercentFree ,0) | eval greenOK= if(PercentFree < 75,PercentFree ,0) | table host,redCritical,yellowWarning,greenOK ... View more

i have multi line log and i want to split it line by line i do following props.conf configaration: [df] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) MUST_BREAK_AFTER = ([\n]+) i set it in application default directory and also in /opt/splunk/etc/system/local/props.conf it doesnt work log example: Filesystem Type Size Used Avail UsePct MountedOn udev devtmpfs 10M 0 10M 0% /dev /dev/dm-0 ext4 95G 6.5G 84G 8% / /dev/fuse fuse 30M 44K 30M 1% /etc/pve /dev/sdb1 xfs 927G 285G 642G 31% /var/lib/ceph/osd/ceph-3 /dev/sdc1 xfs 927G 292G 635G 32% /var/lib/ceph/osd/ceph-4 /dev/sdd1 xfs 927G 312G 615G 34% /var/lib/ceph/osd/ceph-5 10. :/BACKUP nfs 3.6T 2.9T 756G 80% /mnt/pve/backup ... View more