@DUThibault I hope understand your problem correctly. You have three different sources and need to perform own transforms . After that combine all the three sources and do the common transforms. I hope below thing would be helpful. [inux:collectd:http:json] TRANSFORMS-a = some_transform_1 [inux:collectd:graphite] TRANSFORMS-b = some_transform_2 [collectd] TRANSFORMS-c = some_transform_3 [inux:collectd:http:json] rename = commoncollectd [inux:collectd:graphite] rename = commmoncollectd [collectd] rename = commmoncollectd [commoncollectd] Tranforms-common = some_transforms_common ... View more

@mcollins42 please try below your base search | rex field=_raw "(?P<DateTime>\S+\s+\d+\s+\d+:\d+:\d+)\s+(?P<src_ip>\d+.\d+.\d+.\d+)\s+(?P<src_user>[^(]+)((?P<src_userupn>\S+))|(?P<message>[^|]+)(?P<Result>(|\S+|))" ... View more

@aferone Please try this <form> <label>testCheckbox</label> <fieldset submitButton="false" autoRun="true"> <input type="checkbox" token="YearsAx" searchWhenChanged="true"> <label>Select Years</label> <choice value="2017">2017</choice> <choice value="2018">2018</choice> <delimiter> and </delimiter> </input> </fieldset> <row> <panel> <title>Summary By Program (In Plan) $YearsAx$</title> <event> <search> <query>index=_internal sourcetype=splunkd | head 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> </event> </panel> </row> </form> ... View more

@jdoll1 try this, sourcetype=mysource [ inputlookup mycsv.csv | fields field1,field2,field3,field4,field5 ] | lookup mycsv.csv field1 | eval resultF5=if(field5!=" ", "field5 with value","field5 without value") | table _time,summary, resultF5 ... View more

<form> <label>testRadio</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>0</earliest> <latest></latest> </default> </input> <input type="radio" token="field2"> <label>field2</label> <choice value="addIP">ADD</choice> <choice value="remIP">REMOVE</choice> <change> <condition value="addIP"> <set token="panelA"></set> <unset token="panelB"></unset> </condition> <condition value="remIP"> <set token="panelB"></set> <unset token="panelA"></unset> </condition> </change> </input> </fieldset> <row depends="$panelA$"> <panel> <event> <search> <query>| inputlookup test.csv | append [ | stats count | eval TEST="$vaIP$" (this is the token of the input Text box ] | stats count by TEST | fields - count | outputlookup test.csv </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> </event> </panel> </row> <row depends="$panelB$"> <panel> <event> <search> <query>|inputlookup test.csv | search TEST!="$vaIP$" | stats count by TEST | fields - count | outputlookup test.csv </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> </event> </panel> </row> </form> ... View more

@raviteja029 try this, your search earliest=-7d@d latest=0d@d | eval weeknum="Last 7 days" | append [ search your search earliest=-30d@d latest=0d@d | eval weeknum="Last 30 days" ] | chart count over weeknum by username i hope this helps ... View more

@hkchew try this sourcetype=sourcetypeA | fields ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum | join GroupID [ search sourcetype=sourcetypeB | fields PhoneNum, VAS1, VAS2 ] | search PhoneNum=* | table PhoneNum, GroupID, DeviceUsed, DeviceSerialNum i hope this helps ... View more

@ebeid 1) time frame: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20QUERY 2) outputmode json: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20output_mode=json%20QUERY outputmode xml: search=search%20index%3DINDEXNAME%20index_earliest =-2d%20index_latest =now%20output_mode=xml%20QUERY by default results will be xml check below link, http://docs.splunk.com/Documentation/Splunk/7.0.1/RESTREF/RESTsearch#search.2Fjobs.2Fexport i hope this helps ... View more

@eranday Please try below, | makeresults | eval d1="2017-12-08" | eval d2="2017-12-05" | eval da1=strptime(d1,"%Y-%m-%d") | eval da2=strptime(d2,"%Y-%m-%d") | eval diff=da1-da2 | eval diff=strftime(diff,"%d") ... View more

@meechy85 <input type="radio" token="ip_tok"> <label>Select OS type</label> <choice value="addIP">ADD</choice> ### Query for getting iP <choice value="remIP">REMOVE</choice> <change> <change> <condition value="ADD"> <set token="panelA"><set> <unset token="panelB"></unset> </condition> <condition value="REMOVE"> <set token="panelB"><set> <unset token="panelA"></unset> </condition> </change> </input> <row depends="$panelA$"> <panel> <event> <search> <query>| inputlookup test.csv | append [ | stats count | eval TEST="$vaIP$" (this is the token of the input Text box ] | stats count by TEST | fields - count | outputlookup test.csv </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> </event> </panel> </row> <row depends="$panelB$"> <panel> <event> <search> <query>|inputlookup test.csv | search TEST!="$vaIP$" | stats count by TEST | fields - count | outputlookup test.csv </query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> </event> </panel> </row> ... View more

@subaldhawan Data will be collected under os index. 1) Did you check os index is enabled on all indexers. 2) Login to one of the forwarder and execute below command. It should pulll some results $SPLUNK_HOME/bin/splunk btool list inputs --debug cpu 3) Execute this command $SPLUNK_HOME/bin/splunk list inputstatus ... View more

yeah you can. ... View more

@pavanae try this, index=* | inputlookup ABCD.csv host_name as host OUTPUTNEW ip | stats values(sourcetype) by host ip i hope this helps. ... View more

@Anonymous There are multiple ways you can authenticate users to splunk. Below steps for LDAP authentication for Active directory based configuration. for more details check below links, http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Authenticationconf#authentication.conf.example http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Authorizeconf#authorize.conf.example $SPLUNK_HOME/etc/system/local/authentication.conf Sample Configuration for Active Directory (AD) [authentication] authSettings = AD authType = LDAP [AD] SSLEnabled = 1 bindDN = ldap_bind@splunksupport.kom bindDNpassword = ldap_bind_user_password groupBaseDN = CN=Groups,DC=splunksupport,DC=kom groupBaseFilter = groupMappingAttribute = dn groupMemberAttribute = member groupNameAttribute = cn host = ADbogus.splunksupport.kom port = 636 realNameAttribute = cn userBaseDN = CN=Users,DC=splunksupport,DC=kom userBaseFilter = userNameAttribute = sAMAccountName timelimit = 15 network_timeout = 20 anonymous_referrals = 0 [roleMap_AD] admin = SplunkAdmins power = SplunkPowerUsers user = SplunkUsers new_user = adgroupnewuser;adgroupnewuser1 ### AD group name $SPLUNK_HOME/etc/system/local/authorize.conf [role_new_user] rtsearch = enabled importRoles = user srchFilter = host=foo srchIndexesAllowed = * srchIndexesDefault = mail;main srchJobsQuota = 8 rtSrchJobsQuota = 8 srchDiskQuota = 500 I hope this helps ... View more

@ludoz13 try this, UF : inputs : [monitor://c:\tmp\logs.csv] sourcetype = fileshared props: [fileshared] KV_MODE=none INDEXED_EXTRACTIONS=csv INDEXER : props: [fileshared] TRANSFORMS-routing=syslogRouting transfoms: [syslogRouting] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=syslogGroup outputs: [tcpout:syslogGroup] server = loghost.example.com:514 For further details, please check the below link, http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Forwarding/Routeandfilterdatad ... View more

@kdimaria <form> <label>test_drilldown_new_page</label> <fieldset submitButton="true"> <input type="time" token="ttok" searchWhenChanged="true"> <label>select a time range</label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>$ttok.earliest$</earliest> <latest>$ttok.latest$</latest> </search> <option name="count">15</option> <option name="displayRowNumbers">false</option> <option name="showPager">true</option> <drilldown target="blank"> <link> <![CDATA[ /app/testapp/search?q=search index=_internal sourcetype=$row.sourcetype$ earliest=$earliest$ latest=$latest$ ]]> </link> </drilldown> </table> </panel> </row> </form> ... View more

@anil_ec21 try this | makeresults | eval Application_ID="1;2" | eval Application_Name="A:B:C;D:E:F" | eval Application_ID=split(Application_ID,";") | eval Application_Name = split(Application_Name,";") | eval test=mvzip(Application_ID,Application_Name) | mvexpand test | fields test | rex field=test max_match=0 "(?P<v2>\d+),(?P<v2>\S+)" | eval v2=split(v2,":") | mvexpand v2 | rename v1 as Application_ID, v2 as Application_Name | table Application_ID Application_Name ... View more

@kdimaria check this below link. Able to succeed with drilldown popup by using below example https://www.hurricanelabs.com/splunk-tutorials/splunk-custom-modal-view-creation-part-1-revealing-a-path-toward-enhanced-visibility-and-functionality https://www.hurricanelabs.com/splunk-tutorials/splunk-custom-modal-view-creation-part-2-adding-the-functionality https://www.hurricanelabs.com/splunk-tutorials/splunk-custom-modal-view-creation-part-3-concluding-with-the-final-touches ... View more

Try this strptime(end_time,”%Y/%m/%d %H:%M:%S, %3N”) and do the same thing for begin_time ... View more

@tkwaller Try this, props.conf [sourcetype] TIME_FORMAT = %Y-%m-%d %H:%M:%S,%f TRUNCATE = 100000 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true REPORT-json = report-json-kv transforms.conf [report-json-kv] CLEAN_KEYS = 0 FORMAT = $1::$3 MV_ADD = 1 REGEX = \"(\w+)\":.(\"|)([a-z0-9-.A-Z:]+) SOURCE_KEY = _raw ... View more