Hello All, Let me apologize if this has been clarified before though I cannot seem to find any documentation. I have a file that is updated ever 60 seconds with the current status of vpn users connections including data transfer bytes, username, and for the important part... Initial connection time. Unfortunately when splunk indexes the modification of the lines in this file it uses the users initial connection time as the _time field. I would like to ask if anyone knows a way using the inputs.conf file to set the _time value to the current unix timestamp. Ideally I would expect something along the lines of.... [monitor:///var/log/openvpn*.log] index=os disabled = 0 sourcetype = openvpn interval = 10 _time =now() Thank you all for any help you can provide; SPraus ... View more

Hello everyone; I am trying to call a search command from a search macro. Does anyone have a suggestion. Example: Typical Search String: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" Search Macro: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" $filter$ When I run this it is as if 'ldapsearch' is not executed as the search returns way too quick as compared to the raw search. Thank you in advance; SPraus Edit: Exact "Actual" Macro: | ldapsearch search="(&(objectClass=user)(!(objectClass=computer)))" attrs="cn,sAMAccountName,mail,department,displayName,canonicalName,objectCategory,l,memberOf,pwdLastSet,sAMAccountType,title,givenName,sn,info,comment,userAccountControl,lastLogon" | rex field=memberOf "CN=(?<groups>.*?),OU=" | strcat "Info: " info "::" "Comment: " comment infoComments | makemv delim="::" infoComments | makemv delim=";" duoAliases | makemv delim="/" canonicalName | eval container = mvindex(canonicalName, 1) | search $filter$ And I have tested with just simply the start as I suggested above. ... View more

Hello everyone, After completing an upgrade on all my splunk servers. My two indexers are throwing the following errors during every search... I am unsure but the top error might actually be the same thing on my search head. I have been unable to find any information on what this could be. 3 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors. Expanding ((eventtype=wineventlog_application OR eventtype=wineventlog_system OR eventtype=wineventlog_security) (Type=Warning OR Type=Error) DNS) OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error)) failed due to cycle detected when expanding eventtype=wineventlog-dns [INDEX_SERVER_01] Expanding ((eventtype=wineventlog_application OR eventtype=wineventlog_system OR eventtype=wineventlog_security) (Type=Warning OR Type=Error) DNS) OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error)) failed due to cycle detected when expanding eventtype=wineventlog-dns [INDEX_SERVER_02] Expanding ((eventtype=wineventlog_application OR eventtype=wineventlog_system OR eventtype=wineventlog_security) (Type=Warning OR Type=Error) DNS) OR (eventtype=wineventlog-dns (Type=Warning OR Type=Error)) failed due to cycle detected when expanding eventtype=wineventlog-dns To go along with this I am also now getting 404 errors on all pages from the Windows Infrastructure App (".../en-US/app/splunk_app_windows_infrastructure/") I have tried reinstalling the app several times (both with and without my local changes) to no avail. When I attempt to look at the search string that is provided to get "more information" the search comes back empty. (Example search string: index=_internal host="Index_Server_01]" source=*web_service.log log_level=ERROR requestid=5a7367508d2eb6b60eb8) Thank you all in advance; Stephen M. Praus ... View more