I have installed and configured DBX on my mac laptop to test and get familiar with the application. The install went ok, but when I try to create an identity or connection I get the below message. <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Not Found</msg> </messages> </response> The JVM is working and I am using the admin user which the manual is saying should have all the permissions required. Also I ran the rest queries below (In the trouble shooting section of the db connect doc.) and they are all working (output a "Running" status). curl -k -u admin:password https://localhost:/servicesNS/nobody/splunk_app_db_connect/db_connect/dbxproxy/taskserver curl -k http://localhost:9998/api/taskserver curl --noproxy localhost -k http://localhost:9998/api/taskserver Can somebody assist me please. ... View more

I'm trying to configure splunk to ingest two application logfiles, not the event logs the actual application logfile (text). Its my first time ingesting windows forwarder logs (I'm a linux man really), but I did read that it can be done in the inputs.conf so I tried the below: [monitor://D:\lfbank\wincsl\logs\wincsl-service.log] disabled = 0 index = wincsl souurcetype = lfab_wincsl1 [monitor://D:\inetpub\logs\logfiles\W3SVC*] disabled = 0 index = wincsl souurcetype = lfab_wincsl2 I do have an outputs.conf configured, but am still seeing no data. ... View more

I'm trying to compare 2 results from different time periods using the below search, but am getting a zero result where I should be seeing 2 events. I've recreated the search as below into something that we can all see. I am using one existing field (sourcetype) and eval to create another (output) to do the math and output to a result field. index=_internal earliest=-4d@d latest=-3d@d splunkd_stderr [ search index=_internal earliest=-3d@d latest=-2d@d splunkd_stderr | eval output=sourcetype] | eval result=sourcetype-output | stats count(result) ... View more

I'm trying to drop some failed messages from an imported txt file, but they continue to be in the sourcetype. The regex works using regexe101.com, and it looks ok in the splunk docs, but they wont be dropped. Can somebody check my syntax please. Below is copies of the transforms.conf and props.conf. [splunk@linux1 local]$ cat props.conf [sslah] LINE_BREAKER = \d(4)-\d(2)-\d(2)\s\d(2):\d(2):\d(2) TIME_FORMAT = %Y-%m-%d %H:%M:%S TIME_PREFIX = ^ SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 19 TRUNCATE = 2000 TRANSFORMS-null = setsslah [splunk@linux1 local]$ cat transforms.conf [setsslah] REGEX = \d+.\d+.\d+.\d+\sFAILED DEST_KEY = queue FORMAT = nullQueue ... View more

We are trying to carry out a field extraction in a log that contains xml output. We have worked out the regex to get the data we need:- <id[^>]*>([LAR]+)(.*?)<\/id> But splunk will not let us complete the extraction by adding the naming section. We tried the below but the then extraction stops working. <id[^>]*>([LAR]+)(.*?)<\/id>(?P<tradeId>) Question is what is the regex syntax to add the name of the field extraction to the full regex command. ... View more

I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex ^(?:[^:\n]*:){4}\s+(?P[^|]+), but am seeing additional values. The output should be all uppercase, but I'm still getting some lowercase values after using the [A-Z] in the regex. I've also tried to pin point the outputs using the below but still get the additions. ^(?:[^:\n])\s state\s:\s(?P[^|]+) What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - ()[]{}| The output should be - ROUTE_START But I'm also seeing things like - I'm trying to configure a field extraction but am getting some strange incisions in the output. I'm running the below regex ^(?:[^:\n]*:){4}\s+(?P[^|]+), but am seeing additional values. The oput put should be all uppercase, but I'm still getting some lowercase values after using the [A-Z] in the regex. I've also tried to pin point the outputs using the below but still get the additions. ^(?:[^:\n])\s state\s:\s(?P[^|]+) What I'm trying to configure is a field extraction of an uppercase word, but I need to ignore - ()[]{}| The out put should be - ROUTER But I'm also seeing this like - [Order{ Thanks ... View more

I have created a new dashboard and configured the base search, but only one of the 3 panels (Web Server Error Summary) is populating the data. If I run the searches independently of the dashboard they work, but when loading the dashboard only one works. Could you please take a look at the below XML and point me in the right direction. Web Analytics Base Search <query>sourcetype=access_* status=* action=view OR action=purchase</query> <earliest>@y</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <panel> <title>Top Products</title> <table> <search base="baseSearch"> <query> | top limit=5 productName | rename productName AS "Product" | rename count AS "Purchased"</query> </search> </table> </panel> <panel> <title>Unique Visitors</title> <table> <search base="baseSearch"> <query> | dedup clientip | stats count | rename count as "Unique Visitors"</query> </search> </table> </panel> <panel> <title>Web Server Error Summary</title> <table> <search base="baseSearch"> <query>search status>=400 | top limit=5 status by host | sort -count</query> </search> </table> </panel> Thanks Al ... View more