I have data eg. as follows :- rectype=031 OMD_StrtTime_002="Wed Jul 20 02:59:59 2011" OMD_Endtime_003="Wed Jul 20 03:59:57 2011" etc Splunk correctly extracts the first datetime as the timestamp for the event (and I assume it identifies the second one as a timestamp ?) I want to search for events where OMD_StrtTime_002 > 'some specified value' and OMD_Endtime_003 < 'some specified value' - what is the syntax for the query ? Can't seem to find an example on Splunkbase that applies or write one that works. ... View more

I want to report the number of events in a given index using a scheduled overnight report and send the PDF output to myself. So in 'Manager>Searches and reports' I define a search :- Search = 'index=tal' # name of index No time range Tick 'Schedule this search' Type = Basic Run every day at 6pm and enter email details for myself including the PDF report option The report doesn't return the expected number of events (> 150M) but instead gives a small total (around 220,000) - it seems to be limited by some threshold value that I don't understand. How do I get the report run for as long as required to tranverse the whole index and send me a report ? (leaving aside for the moment whether it's sensible to do this). Can supply any further info as required. ... View more

I have telephony log data containing multiple record types each with their own set of numerically tagged data fields. Example format showing 2 records :- 001 002 110622080011 003 110622080011 004 022306a25710 030 0000000000 005 0000000427712649 006 0000000000300000 054 00030 055 155 052 000 056 02 094 0 137 0 049 0000000000000006 138 06 144 1 005 002 110622075952 003 110622080011 004 012306a2570f 007 23062ec957 005 0417606265 0080000010401148949 009 00008 010 000 049 006 011 00 012 0 013 0 014 0 015 0 024 0 096 0000000000000000 052 52 050 000 145 0 062 000000000000000000 063 0000010401148949 Each record has 3 digit record type followed by space-separated values. So in example above first record is type 001 with a field type 002 value 110622080011, then field type 003 value 110622080011 and so on thru to field type 144 value 1. Preferably without explicit coding for each record type, I want to index to key/values pairs eg. F_001_002=110622075952 F_001_003=110622080011 etc There are about 30 record types each with up to about 30 field types. Can I do this with transforms.conf ? If I script it (which is fairly simple), what's the best way of ensuring that each source file (in a RO directory) is indexed only once ? ... View more

How does a receiving Splunk know what's being sent - or do I have to refer to the forwarding Splunk to know about the data eg. possible sourcetypes ... View more

It seems I need to use 'xmlkvrecursive' to properly parse XML log files where the tags may contain many attributes. However this parsing is during the search, which is consequently v. slow. How can I parse (using xmlkvrecursive or similar) at index time - then search on the tag or attribute names via the indexes ? Example of current search :- index=test1 sourcetype="mmsgw" | xmlkvrecursive | search ActivityLogRecord_Common-ServerID="mmsgw1.xxx.com" ActivityLogRecord_Common-UserID="999999999@h1.xxx.com" A single data record typically looks like :- ... View more