Using Splunk Enterprise (currently 7.3.x here); I'm not an admin, so cannot see/change "savedsearches.conf". I have over a dozen alerts (with more to come) that I need to copy from our pre-production Splunk search head to production (where I would edit the details). I would expect a simple "export" menu choice somewhere in the Alerts page or on a particular Alert, but there's nothing remotely similar. The Splunk "apps" already exist on both, and differ, so I couldn't ask some admin to just copy it. Given that the search terms, cron schedule, time span, trigger condition, and actions are all separate, it is a major amount of work to copy & paste (with multiple additional clicks).    ... View more

(Note that this entire post is about text being written to logs that Splunk scans, not about queries or query syntax.) I would like to know what syntax (regex?) Splunk uses for its automatic field extraction. The obvious rule is that if the field has embedded spaces or certain other characters, it has to be quoted, with double quotes (never single quotes/apostrophes; I haven't tried UNICODE puncuation very much). For example, I've learned that a "|" terminates a field as far as Splunk auto-extraction is concern, and so any field with a "|" must be quoted. Is there a list of such rules, a regular expression, or code available to inspect? Here's a practical example: the 'weak' form of the HTTP ETags (or If-None-Match) header look like this: Etag: W/"some-identifying-text" Now if I want to log that, I need to be careful not to quote it, because then Splunk will see all these values as having the value "W/". Or, I've found -- by trial and error -- that I can escape quotes by doubling them. E.g., Etag: "W/""some-identifying-text" But it would be far far easier to know rather than guess the syntax rules. Can someone point me towards them? Also, it would be good to know which of the UNICODE quoting characters Splunk inteprets as such -- e.g., it should probably handle the "Ps", "Pe", "Pi", and "Pf" categories as described in http://www.unicode.org/versions/Unicode9.0.0/ch04.pdf, but does it? If not, what characters does it consider to be quoting characters, other than ASCII double-quote (")? ... View more

How can I look for a list of 50+ values without typing in "foo=1 OR foo=29 OR foo=4219...". Obviously without touching files on /opt/splunk/ anything, but as a normal file user. I would like to load this from a file on my machine, a command something like inputcsv or inputlookup which, if I understand correctly, are restricted to looking on the Splunk server. ... View more