No, You can't do that with cli command. But if you want to customized login_content, create web.conf in $SPLUNK_HOME/etc/system/local and edit: [settings] login_content="rofl" ... View more

This is not working in Docker because if a container is not running with --network host, master node will forward internal ip address, not public one -> is not accessible. ... View more

Universal and Heavy Forwarder. ... View more

Recently a college asked me the same thing; how he could handle stack traces in multi-line events. Stack traces usually have the same format - where the following lines are starting with something like "[...] caused by. [..]", so I would write a RegEx which does a BREAK_ONLY_BEFORE. After that , you simply define a) your RegEx and b) an "OR" after your RegEx to do the event breaking after a new line feed (\n), something like this (just an example): ((?=stacktraceline|\n) Just add a stanza with your sourcetype in your transforms.conf: [your_sourcetype] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = ((?=stacktraceline\d)|\n) Skalli edit: typo ... View more

@Rialf1959, please try the following using mvzip() function which should work as far as within multi-valued fields op and value there is one to one relationship. In other words mvcount() of op field should match with value field. <YourBaseSearch> | fields blkio_stats.io_serviced_recursive{}.op blkio_stats.io_serviced_recursive{}.value | eval data=mvzip('blkio_stats.io_serviced_recursive{}.op','blkio_stats.io_serviced_recursive{}.value',";") | table data | mvexpand data | search data="Write*" | eval data=split(data,";") | eval op=mvindex(data,0) | eval value=mvindex(data,1) | table op value Refer to Splunk documentation for various Multi-value evaluation functions: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/MultivalueEvalFunctions ... View more

Does not work. Sample data: https://pastebin.com/9sRs35Z3 EDIT: ofcourse, there is typo in field name. Network vs Networks ... View more

I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F. The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case. Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step. ... View more

I found the reference that confirms our observations here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/eval If the expression references a field name that contains non-alphanumeric characters, it needs to be surrounded by single quotation marks. For example, if the field name is server-1 you specify the field name like this new=count+'server-1'. Because the JSON field you are referencing has a period, you have to use single quotes. This is only true for eval and where. Search seems forgiving if the non-alphanumeric character is a period. Now as to the question about the arrays. Splunk correctly parses these as multivalue fields. The trick is adding curly braces at the end of the field (and double quotes). | table "cpu_stats.cpu_usage.percpu_usage{}" You can use mvexpand() or other multivalue functions now. ... View more

@Rialf1959, I have updated my answer based on this sample data. However, it is confusing with this data as to why you had multi value field evaluation in your question when the information is already available in field Replicas . ... View more

DO NOT use realtime for this. Not only will it not work properly, but it kills your performance. ... View more

What about fields with dot? rex field=WithUnit "^(? \d*.\d*)(? \w*)$" How to round them? Thanks ... View more