Currently I have four different visualizations (bar graphs) that are created using a data set. Each search I run filters for a specific set of conditions on that data, and a visualization is drawn after. My problem is, once I generate the first graph, I would like to run a completely new search on the complete data (without using the filtered data of the last search), filter and generate my second graph and overlay this on top of the first graph. How would I go about doing this? I would like to overlay all four graphs on top of each other. If this isn't possible, then draw everything in a single graph without the overlaying. The important bit is somehow storing the variables from the previous search so that I can use it at the end for a single graph. ... View more

I have a json file with entries in the following form: { "ABC" : "XYZ" , "DEF" : 123 , "GHI" : "456" , ... } There are about 15 or so variables defined in a single json formatted line with multiple lines for a given output. Splunk picks up the output via a python script which essentially prints everything to stdout. The issue I'm having is that, when Splunk ingests the data, some of the fields end up being multivalued where a field has two identical values. I can see this occurring when I click on the "show as raw text" in the splunk search results. Somewhat interesting is that these fields are all fields with numerical values in them. So it's occurring for both "DEF": 123 and "GHI" : "456" types.. Any ideas as to what could be causing this issue? ... View more

I have the following fields within splunk: srcaddr and dstaddr, and I would like to map the number of internal to internal connections. I.e all internal traffic from srcaddr to any dstaddr on the IPs 10.0.0.0/8 and 198.168.0.0/16. How would I filter for and compare these variables? Cheers. ... View more

I have set up a forwarder on my machine to send netflow data from a directory into splunk. The setup is as follows: Directory: /home/user/Documents/netflowstuff file1.json file2.json each json file as multiple entries/lines in the following form: {"source":"XYZ", "srcaddr":"C0A80101".........................................etc} When searching, I use: index=main | rex field=srcaddr "(?i)(?<d1>[0-9A-F]{2})(?<d2>[0-9A-F]{2})(?<d3>[0-9A-F]{2})(?<d4>[0-9A-F]{2})" | eval ip=tostring(tonumber(d1,16))+"."+tostring(tonumber(d2,16))+"."+tostring(tonumber(d3,16))+"."+tostring(tonumber(d4,16)) to convert the IP address from hex to decimal. What I want to do however: is have splunk ingest the IP address in decimal from the start without having to run this search. How do I go about configuring props.conf and transforms.conf to accomplish this? ... View more