Hi, I have a 3 different log files and there are 8 different formats in them. All formats have the same fields in them (cpu,memory etc.) and regex is similar. Hence, based on the system name, I should get its values (level, OS, primary_drive). Below is the sample log: Nov 08 12:55:07 servername: {"cpu_cores":"4","ram_size":"6","system_name":"NAME1","level":"info","OS":"WINDOWS","primary_drive":"C"} Nov 08 12:54:07 servername: {"cpu_cores":"2","ram_size":"6","BIOS_Version":"A12","system_model":"Opti","system_name":"NAME2","level":"info","OS":"WINDOWS","primary_drive":"D"} Nov 08 12:52:07 servername: {"cpu_cores":"4","ram_size":"4","system_name":"NAME3","level":"info","OS":"WINDOWS","primary_drive":""} What I did here is I gave the 2 different regex for 2 log formats in props.conf. Hence I get both these log formats in and other 6 formats are ignored props.conf [source::/source/file name] TRANSFORMS-set = outside,inside transforms.conf [outside] REGEX =. DEST_KEY = queue FORMAT = nullQueue [inside] REGEX = <{\"(?:cpu_cores\")\:\"(?<cpu_cores>.+)\"\,\"(?:ram_size\")\:\"(?<ram_size>.+)\"\,\"(?:system_name\")\:\"(?<system_name>.+)\"\,\"(?:level\")\:\"(?<level>.+)\"\,\"(?:OS\")\:\"(?<OS>.+)\,\"(?:primary_drive\")\:\"(?<primary_drive>\w)> REGEX = {\"(?:cpu_cores\")\:\"(?<cpu_cores>.+)\"\,\"(?:ram_size\")\:\"(?<ram_size>.+)\"\,\"(?:BIOS_Version\")\:\"(?<BIOS_Version>.+)\"\,\"(?:system_model\")\:\"(?<system_model>.+)\"\,\"(?:system_name\")\:\"(?<system_name>.+)\"\,\"(?:level\")\:\"(?<level>.+)\"\,\"(?:OS\")\:\"(?<OS>.+)\,\"(?:primary_drive\")\:\"(?<primary_drive>\w) DEST_KEY = queue FORMAT = indexQueue Also for field extraction, I made the change in props.conf as below, but I get the field extraction for only regex2. The field extraction for regex 1 is not working, hence it's not getting extracted. I am not sure whether same field getting extracted for different patterns might be a problem. Can someone help me, so that I should get field extractions for both regex types? props.conf [my_sourcetype] EXTRACT-fields = <{\"(?:cpu_cores\")\:\"(?<cpu_cores>.+)\"\,\"(?:ram_size\")\:\"(?<ram_size>.+)\"\,\"(?:system_name\")\:\"(?<system_name>.+)\"\,\"(?:level\")\:\"(?<level>.+)\"\,\"(?:OS\")\:\"(?<OS>.+)\,\"(?:primary_drive\")\:\"(?<primary_drive>\w)> EXTRACT-fields = {\"(?:cpu_cores\")\:\"(?<cpu_cores>.+)\"\,\"(?:ram_size\")\:\"(?<ram_size>.+)\"\,\"(?:BIOS_Version\")\:\"(?<BIOS_Version>.+)\"\,\"(?:system_model\")\:\"(?<system_model>.+)\"\,\"(?:system_name\")\:\"(?<system_name>.+)\"\,\"(?:level\")\:\"(?<level>.+)\"\,\"(?:OS\")\:\"(?<OS>.+)\,\"(?:primary_drive\")\:\"(?<primary_drive>\w) ... View more

Hi, I need to index some Windows system event logs of a remote server (using forwarder) into Splunk. My files are as below in the path $home/etc/apps/<myappname>/local on the forwarder inputs.conf [winEventLog://system] disable = 0 whitelist = 41,104 index = wineventlog outputs.conf [tcpout] default = primary_indexers [tcpout:primary_indexers] useACK=true server = splunkservername:9997 I restarted the forwarder. My tcp port 9997 is open, but why are the logs not getting indexed in Splunk. The last log in the splunkd was: 12-15-2015 14:45:37.097 -0500 WARN TcpOutputProc - Raw connection to ip=serverip:9997 timed out 12-15-2015 14:45:37.097 -0500 INFO TcpOutputProc - Ping connection to idx=serverip:9997 timed out. continuing connections 12-15-2015 14:45:37.097 -0500 INFO TcpOutputProc - Ping connection to idx=serverip:9997 timed out. continuing connections ... View more

Hi All, I have created a row highlighting dashboard. Since the new dashboard is not picking my own .js and .css files (tried restarting Splunk, but no luck), I just used the same files available in the row_highlighting example dashboard instead. Now I want to rename the active_realtime_searches field (having value as "1" or "2") as Values_found, but when I used rename command, all the rows are highlighting in only green color. IS there any other way that I can rename the field, so that I can get the perfect highlighting? ... View more

Here is my search query ... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=strftime(_time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0... Here I get the output field names in date format i.e. 09-30-15 10-01-15 . I want to convert this field name into variable so that I can pass the variable to use it for a comparison. ...| streamstats window=2 current=t global=f values(09-30-15) as previous_day values(10-01-15) as current_day by Metrics | eval values_changed= if(previous_day==current_day,"NO","YES") I tried many ways but no luck. ... View more

Hi, I have a search query which fetches the result host server1 server1 _time 2015-09-15 11:48:42 2015-09-16 11:48:42 app_version 2.0.1 2.0.1 RAM_size 6 5 This is the comparison of status of a server for earliest=-1d@d and latest = now. Here I need to highlight the RAM_size since the value differs from previous day. I tried a java script form splunk 6.x dashboard examples. But I am not able to do any trick way. Is there a better way to do this require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return _(['children[1]', 'children[2]']).contains(cell.field); }, render: function($td, cell) { var value = parseFloat(cell.value); if(jQuery(this).children[1].innerHTML == jQuery(this).children[2].innerHTML ) { $td.addClass('range-cell').addClass('range-elevated'); } } }); mvc.Components.get('highlight').getVisualization(function(tableView) { // Add custom cell renderer tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.on('rendered', function() { // Apply class of the cells to the parent row in order to color the whole row tableView.$el.find('td.range-cell').each(function() { $(this).parents('tr').addClass(this.className); }); }); tableView.table.render(); }); }); ... View more

Hi, I have a search based on date. ...search ... earliest=-d@d latest=now | table _time, host, app_version, RAM_size This search actually displays the app_version, RAM_size of a server yesterday and today in a table like below: _time host app_version RAM_size 2015-09-15 11:48:42 server1 2.0.1 6 2015-09-16 11:48:42 server1 2.0.2 5 i.e today the version has been upgraded in that server and the app_version, RAM_size has been changed. Is there a way to display the results in row as I expect below? host server1 server1 _time 2015-09-15 11:48:42 2015-09-16 11:48:42 app_version 2.0.1 2.0.2 RAM_size 6 5 i.e interchanging row and column. ... View more

Aug 31 10:06:32 serverA.com Aug 31 16:06:32 [serverA: HTTPPool02:debug]: sridhar:AUTH:error:Login failed for user sridhar from IP 10.100.150.110. reason "User not authenticated" Aug 31 10:06:32 ServerB.com Aug 31 22:06:32 [ServerB:HTTPPool03:debug]: netsupport:AUTH:error:Login failed for an unknown user from IP 11.200.10.110. reason "User does not exist" Above are the raw data of my search. The sourece=UDP port sourcetype=syslog and index=syslog. I need to create fields "user" and "reason". May i know what regex command can i use and reflect it in my transforms.conf and props.conf files. ... View more