Using the S.O.S app to view the versions of my splunk installation noticed that one of my indexers is listed as version: Splunk (build ) which is not how the other 11 splunk servers are listed. how can I get the version to properly be reflected ? I checked the $SPLUNK_HOME/etc/splunk.version file and it is the same as the other indexers. does the app use a rest endpoint that i can trigger to see if i get a proper version or the text it shows currently ? ... View more

I am trying to index configuration files for a secure web gateway device (surfing appliance). The configuration can get quite long (1,000 lines) I would like to index the file and split on the sub headings in the file so that the chunks are manageable and easier to extract data from. I have two problems 1) - there is a date in the header of the file (line #3) that causes the indexing to stop on the file after line #2 !- Version: ABC 1.2.3 Proxy Edition !- Serial number: abcde12345 !- Local time: 2013-02-26 04:17:01-00:00UTC !- BEGIN networking 2) - I think i am setting my props properly to split the event based on the occurance of " !- BEGIN " but that isnt working wither (i get a chunk of 257 lines then the events are split by line which is not what i would like). the inputs and props are sent to a windows forwarder to monitor a directory for new files here is the props.conf [abcd_config] DATETIME_CONFIG = CURRENT SHOULD_LINEMERGE = false LEARN_MODEL = false LINE_BREAKER = (!- BEGIN\s) the headings i want to break the event on look like this ... !- BEGIN networking !- BEGIN ssl !- BEGIN authentication etc any thoughts on what I am missing ? ... View more

I have the output of a firewall config, i want to make sure that our naming standard is consistent with the actual function of the network object. I have a table of the name of the object and the subnet and mask. I want to compare the name and name-combo fields to see if they are the same, and show only those that are not the same. example row cluster name name-combo subnet bits match 1 FW1-2 NET69.90.64.0-20 NET69.90.64.0-20 69.90.64.0 20 No Match 2 FW1-2 NET69.90.63.0-8 NET69.90.63.0-20 69.90.64.0 20 No Match here is my search `abc_firewall_rules` eventtype=subnet [search index="abc_rules" eventtype=subnet | dedup cluster | fields + source] | dedup name,cluster | eval name-combo="NET".subnet."-".bits | eval match=if(name-combo=name,"Match","No Match") | table cluster,name,name-combo,subnet,bits,match row 1 should show match and row 2 should show no match.. have tried using | where NOT name=name-combo have tried using | where name!=name-combo all show ro results found but in my sample data there are rows that do not match and should show up.. any ideas ? ... View more

trying to implement the irule supplied by F5, we can get the irule to log to splunk. We are having and issue with the req_elapsed_time field as it is always returning 0 Anyone else using that value and getting something other than 0 for a value? We are trying to use the iRule to determine the response time for surfing via a particular pool and this value appears to be the one we need. ... View more

i've been running around in circles for a few hours now, cant figure this out. I have a dev and prod environment (prod 4.2.5 and dev 4.3) In dev environment i can run a search and use collect to write the events to the summary index splunk_server=a |top host | collect index=summary using the stash file name that is shown i can locate the data with this command index=_internal 254301636_events.stash_new i try the same thing in prod(4.2.5) and I am not able to find the data in the summary index. No errors as far as i can see relating to the index or command. No data anywhere. Is there a difference in the collect command between 4.2.5 and 4.3? What other troubleshooting can be done to help figure this out? ... View more

I am using splunk to compare the output of routes from a list of firewalls. The output contains a listing of routes. I would like to compare the linecount from each pair member to make sure that the routes are added to each firewall properly. I have field called cluster that associates the pair members (host) host1-p,host1 host1-b,host1 I have a few hundred of these files to compare. I would like to build a view that shows the listing of cluster or hosts where the linecount is not the same between cluster members. I will use that to investigate further. I can get the files into splunk and into an index. How can I compare (subtract linecounts and if sum is non-0 show) the latest output for each cluster? This gets me the data to compare index=fw_audits eventtype=routes earliest=-14d | table cluster,host,linecount Any thoughts how to do the compare between cluster members? ... View more

I have a file monitor sending the contents of a file to splunk. I would like to save a search that only displays results from the latest file that splunk imports. how would I do this? I can do it for each file specifically but I would rather have a saved search that selects the latest file (source) by date Must be something simple that I am missing, just cant think of the solution at the moment. ... View more

I am attempting to parse the results from a search using the python sdk. I can successfully run a search against splunk and return the results via xml output. #!c:/Python26/python.exe -u import splunk.client as client import sys, datetime from pprint import pprint HOST = "1.2.3.4" PORT = 8090 USERNAME = "admin" PASSWORD = "aaaaaaaa" service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD) oldtime = datetime.datetime.now() search = 'search index="firewall_rules" table=rule disable=no | dedup name,host |table host,name,rulegroup,appcode,_time | head 2' job = service.jobs.create(search, exec_mode="blocking") #job = service.jobs.create(search) while True: stats = job.read('isDone') if stats['isDone'] == str(1): break content = str(job.results(output_mode='xml')) print "Output: %s" % content Output: <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder> <field>host</field> <field>name</field> <field>rulegroup</field> <field>appcode</field> <field>_time</field> </fieldOrder> </meta> <result offset='0'> <field k='host'> <value><text>FW1</text></value> </field> <field k='name'> <value><text>&apos;Deny All&apos;</text></value> </field> <field k='rulegroup'> <value><text>&apos;&apos;</text></value> </field> <field k='_time'> <value><text>2011-12-03T03:24:02.000-05:00</text></value> </field> </result> <result offset='1'> <field k='host'> <value><text>FW2</text></value> </field> <field k='name'> <value><text>WEB1</text></value> </field> <field k='rulegroup'> <value><text>WEB1</text></value> </field> <field k='appcode'> <value><text>ABC123</text></value> </field> <field k='_time'> <value><text>2011-12-03T03:24:02.000-05:00</text></value> </field> </result> </results> Elapsed Time: 0:00:04.500000 I have attempted to parse the xml output into a structure that I can use to insert into another system (mysql). I have tried xmlminidom and etree without success, is there an easier way to access the values with python? ... View more

I would like start setting baselines for devices that are sending logs to splunk. An example: using splunkd metrics group_by_host chart the last 24 hours using span of 1hr the average eps value by host index=_internal sourcetype=splunkd metrics group="per_host_thruput" series=server1 | timechart span=1h avg(eps) by series on top of that i would like to chart the 7day average value of eps for that same host as a constant on the same chart (-7d@d to -d@d) Initially using the raw data, eventually using summary index for storing the hourly or daily average(eps) to report quickly (using hourly for last 7dx24hr or daily for last 7 days). looking to eventually use this to show if traffic patterns are above normal (trending for last 7d, 30d etc). also reporting for traffic above or below normal for extended period of time. thoughts ? have looked at trendline, streamstats and appending a static value but cant seem to get started on the right path. ... View more

Is there a way to force a link from a dashboard to open in a new window? similar to target=_blank? I would like to use to from the navigation menu (to link to other internal websites that would be useful for reference data) and also from a dashboard to link to device login pages (using the host ip as a parameter to the link ).. use splunk to generate a list of ip addresses for a certain host type and generate a clickable link for them to allow administration from https web page (linking to a new page from the dashboard). is this possible? ... View more