"(?<_KEY_1>[^"]*)":"(?<_VAL_1>[^"]*)" how to get this to work where VAL value is not enclosed by quotes, such as this example : networkConnect": {             "localIp": "10.132.137.105",             "localPort": 64248,             "networkProtocol": "kIPv4",             "remoteIp": "63.247.145.75",             "remotePort": 88 ... View more

Hello Frank !!  This logic is working fine using the direct test input on the indexer (Using Add data), but something is different when using the UF. Could you please help me to figure out how they ingest the timestamp from the filename on the UF? ... View more

The underlying code for both is the same so the performance won't be much different.  The difference is when do you want these fields extracted and when don't you.  KV_MODE=xml will be always done for that sourcetype.  xmlkv will only be done when you use it in a search string.  So if you always want all of the fields to be extracted use KV_MODE but if you only want the fields to be occasionally extracted use xmlkv in your search string. If you only want one or two fields from a big xml file, it might be better to extract them using normal regex extraction Another use for xmlkv is when not all of your event is clean xml. KV_MODE would fail and not give you the fields. In a search, you can use an eval or rex to extract and clean the xml portion and then run xmlkv on that.  ... View more

Thank you so much, this helped me out during a google search :). ... View more

@ssadanala1 do you mean token picker or time picker? Could you add more details about your use case? What are the two SPLs that you want to run and what is the condition based on token? Based on the details about your use case seems like you do not need map command. You can use input <change> event handler or an independent search. ... View more

Try this fix: | inputlookup SSE-default-data-inventory-products.csv | outputlookup data_inventory_products_lookup it wipes any manual stuff you have already done, but the next time you try it actually works. Its worth a try. ... View more

Thanks! You 2! ... View more

We are experiencing the same issue. It looks like it is actually dropping the last line that is added. It is only affecting some users. We had the users clear their cache and we cleared the cache on the servers as well. We are using version 3.4.1. In our case the user is trying to edit a .csv so I would assume that it would be an issue for kvlookups as well. ... View more

but this wont give me the TPS right? span here is 1d? ... View more

The values with \x are garbage values coming into splunk which is making logs looks unformated . usage of sed command in props will remove those garbage value and make logs look formatted . Please include below in your props and test it [sourcetype] SEDCMD-null = s/\x82//g ... View more

Hello @w199284 I think the issue here is Splunk try to achieve 90% rebalancing not fully 100%. If you want 100% rebalancing on both the sides, then you can achieve that as well using the below command: splunk edit cluster-config -mode master -rebalance_threshold 1 -auth admin:your_password The below link can help you better: https://docs.splunk.com/Documentation/Splunk/7.2.3/Indexer/Rebalancethecluster ... View more

After some other research, came across https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions (linked from a colleague) that also advocated for search based extraction vs indexed. Going with your suggestion! Thanks! ... View more

Thank you @whrg, @prakash007 for your answers. What i did to solve it: 1. in Windows server, went to Control Panel --> Services. 2. Stop and start "Splunkd Service". ... View more

Hi smdasim! Did you find out the exact reason for the error messages? I've encountered the same issue when trying to send uncooked data from my deployment server to my indexer. It workes fine if sending the data cooked, but when I add "sendCookedData=false" to outputs.conf, the errors appear immediately. ... View more

See if this helps. (index=indexname1 suser=username act=select) OR (index=indexname2 duser=username act=select) | eval user=coalesce(suser, duser) | stats range(_time) by user ... View more

It will probably be more efficient if you drop the | table line or switch to | fields . Try that and compare. ... View more

You can check a few things: 1. Is the hostname getting properly resolved to your splunk search head IP? 2. Is the job result still available? Default ttl of a savedsesrch is 10 minutes. Can you let me know if you are seeing any specific error message on the browser? ... View more

https://answers.splunk.com/answers/217714/why-am-i-getting-error-the-license-signature-is-no.html ... View more

I got it using line breaker helped DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false NO_BINARY_CHECK=true LINE_BREAKER=(\d{2}:\d{2}:\d{2}.\d{3}) ... View more

In the serverclass.conf what is the value for stateonClient parameter ? ... View more

If both _time and yesterday are epoch you would need use a range i.e. _time>=yesterday AND _time<yesterday+86400 . Where yesterday should represent -1d@d or midnight. If yesterday is string time, it should be of format YYYY-mm-dd and you would need to perform strftime(_time,"YYYY-mm-dd") to compare both dates as string time. However, best option would be to fetch only the results from yesterday using base search filter i.e. either Time Picker or earliest=-1d@d latest=-0d@d-1s . Please add more context for us to assist you with your issue, if one of the above does not fit the needs. Possibly ask a new question 😉 ... View more

Can you check your pass4symmkey attribute value.Make sure you are not copied junk character from any text editor. ... View more

posting the xml code will help the community to troubleshoot your problem Happy Splunking !! ... View more

Thanks! This worked for me with one modification. I had to change eval epoch=strptime(_time, "%Y-%m-%d %H:%M:%S,%3N") to: eval epoch=_time Maybe the order of operations matters in some way that I'm missing, but when I interrogate the _time value outside of the table command, it shows as a timestamp. ... View more

example of this is 2001:0000:85A3:0000:0000:7334:0000:0001 | makeresults | eval src_ip="2001:0000:85A3:0000:0000:7334:0000:0001" | eval src_ip=lower(src_ip) | rex mode=sed field=src_ip "s/(:0{4}){2,}/:/g" | rex mode=sed field=src_ip "s/:(0){1,3}/:/g" 2001:0:85a3::7334:0:1 ... View more