Hi, I want to integrate Teamcity with splunk so that I can fetch teamcity database in to splunk. What is the best possible ways by which I can implement it?   Thank you, ... View more

below is few sample of how my source filename look like- source="\\abc.com\storage\Queue\Name1\abcdLogs\sample0008095200531.txt" source="\\abc.com\storage\Queue\Name1\abcdLogs\sample0008096200531.txt" Here Last 6 field before .txt represent Date. i.e. In above case 200531 is 31st May 2020. I want to extract Id which comes before Date and after sample at indextime. and In Id if 0 are at left needs to be excluded(if present) so in above two cases my Id will be 8095 and 8096 Below is my transforms.conf - [Id] SOURCE_KEY = MetaData:Source REGEX = sample0*([0-9A-Za-z]+)\d{6}.*txt FORMAT = Id::$1 WRITE_META = true fields.conf - [Id] INDEXED=true INDEXED_VALUE=source::*<VALUE>* Now when I search for ex. Id="8095" it won't return any results. but when I search Id="*8095" then it does return results. sometime I have to include wild card at start or at end to show results. Why space is getting included at start or at end of Id? My doing anything wrong? Thanks, ... View more

Hi, I am using splunk 8.0.1 on windows OS with Python3. With help of @woodcock answer from https://answers.splunk.com/answers/489475/how-configure-an-alert-to-send-an-email-based-on-f.html I was trying below search- Your Base Search Here | outputlookup MyTempLookup.csv | stats count by EmailContact | map maxsearches=9999 search="|inputlookup MyTempLookup.csv | search EmailContact=$EmailContact$ | sendemail to=\"$EmailContact$\" format=raw subject=myresults sendresults=true" But the search is returning results but it is not sending any mail. and when I checked internal logs below error I observed- ERROR sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action; Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 1421, in <module> results = sendEmail(results, settings, keywords, argvals) File "D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 400, in sendEmail jobResponseHeaders, jobResponseBody = simpleRequest(uriToJob, method='GET', getargs={'output_mode':'json'}, sessionKey=sessionKey) File "D:\Program Files\Splunk\Python-3.7\lib\site-packages\splunk\rest\__init__.py", line 559, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) splunk.AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action Note- If I try using only sendemail command then it is working and I am able to receive email. Is there anything needs to be modified in sendemail.py command for python3. Below sample query I tried but it is not sending any email- index=_internal|stats count by sourcetype|eval EmailContact=if(sourcetype="splunkd","email@id.com","email2@id.com") | outputlookup MyTempLookup.csv| stats values(EmailContact) AS emailToHeader| mvexpand emailToHeader| map search="|inputlookup MyTempLookup.csv | where EmailContact=\"$emailToHeader$\" | fields - EmailContact | sendemail sendresults=true inline=true to=\"$emailToHeader$\" subject=\"Your Subject here: \" message=\"This report alert was generated by \$app\$ Splunk with this search string: \" Any idea what mistake I am doing in above query. Thanks. ... View more

Hi, I have created one index of size 500GB( maxTotalDataSizeMb ) and also included frozen path where data will get stored after 500Gb data gets completed. Now I want to know below- 1. If I Increased size of that index to 1TB then is there any risk involved of data gets deleted? 2. After changing to 1TB If I consider to reduce data size to 800 Gb then remaining 200Gb data will go to frozen path? is there any risk involved/any precaution neeeds to be taken to avoid data loss? 3. If I want to move frozen bucket to be searchable then I copied particular frozen bucket to thawed path and then after data retention those buckets moved to frozen path then will I have duplicate buckets? so I need to move frozen bucket to thawed path instead of copying it? thanks, ... View more

Hi, To explain my scenario I created sample dashboard in xml (see below). Here selection of Group input will Populate from lookup table as per selected sourcetype and now currently I am showing bytes value in pre-selected multiselect filter from lookup as per selection of sourcetype and Group. Now My requirement is - I want to combine two multiselect filter i.e. pre-selected bytes should have values as per Group and sourcetype selection and allow user to select more bytes(if required) by using Select bytes multiselect input query (index="internal" sourcetype="$sourcetype$"|stats count by bytes sourcetype) . for ex.- I selected `sourcetype-splunkdaccess , Group-simple_test then pre select multiselect will get auto populate with values- 5633,5643,167` and on clicking Select bytes multiselect filter it shows few bytes values and I want to shows all those values for selection in pre-selected bytes. so that there will be only one multiselect input. I want to add All Group option in select Group dropdown and on selection of All Group in pre-selected bytes all value should get populate. Please let me know how I can achieve this. I tried to combine two multiselect queries but did not get any success. Thanks. <form script="group.js"> <label>bytesgroup</label> <fieldset submitButton="false"> <input type="dropdown" token="sourcetype" searchWhenChanged="true"> <label>sourcetype</label> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <search> <query>index=_internal|stats count by sourcetype</query> <earliest>$time_slice.earliest$</earliest> <latest>$time_slice.latest$</latest> </search> </input> <input type="dropdown" token="Group" searchWhenChanged="true" id="grp"> <label>select group</label> <fieldForLabel>Group</fieldForLabel> <fieldForValue>Group</fieldForValue> <search> <query>|inputlookup group.csv|search sourcetype="$sourcetype$"|stats count by Group</query> <earliest>$time_slice.earliest$</earliest> <latest>$time_slice.latest$</latest> </search> </input> <input type="multiselect" token="field1" id="idSelectIndex"> <label>pre-selected bytes</label> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>bytes="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>bytes</fieldForLabel> <fieldForValue>bytes</fieldForValue> <search id="idSearchSelectIndex"> <query>|inputlookup group.csv|search sourcetype="$sourcetype$" AND Group="$Group$"|fields bytes</query> <earliest>$time_slice.earliest$</earliest> <latest>$time_slice.latest$</latest> </search> <choice value="*">All</choice> </input> <input type="multiselect" token="selected_bytes"> <label>Select bytes</label> <delimiter> </delimiter> <fieldForLabel>bytes</fieldForLabel> <fieldForValue>bytes</fieldForValue> <search> <query>index="_internal" sourcetype="$sourcetype$"|stats count by bytes sourcetype</query> <earliest>$time_slice.earliest$</earliest> <latest>$time_slice.latest$</latest> </search> </input> <input type="time" token="time_slice"> <label>time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal sourcetype=splunkd_access $field1$|stats count by bytes</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">5</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> group.js code- var deps = [ "splunkjs/ready!" ]; require(deps, function(mvc) { console.log("js is read"); var idSelectIndex = mvc.Components.get('idSelectIndex'); var tokens = mvc.Components.get("default"); var defaultTokenModel = mvc.Components.get("default"); var idSearchSelectIndex = mvc.Components.get("idSearchSelectIndex"); var idSearchSelectIndex_results = idSearchSelectIndex.data("preview"); idSearchSelectIndex_results.on("data", function() { var allValues = []; $.each(idSearchSelectIndex_results.data().rows, function( Vehicle, value ) { // console.log(" Inside Loop to predined vehicle loop field1"); allValues.push(value[0]); }); idSelectIndex.settings.set("default",allValues); var grpp = defaultTokenModel.get("Group"); console.log("Group: ",grpp); }); }); and group.csv lookup- sourcetype,Group,bytes splunkd_access,testing,167 splunkd_access,testing,114 splunkd_access,testing,1700 splunkd_access,simple_test,5633 splunkd_access,simple_test,5643 splunkd_access,simple_test,167 ... View more

Hi, I have one forwarederand one (IDX+SH). I am ingesting few hundreads of .txt files from HWF to one specific index. Now I want to know what log file size actually it has indexed per day vs what license volume it consumed per day for particular index. Can any one help me with spl query? and is it possible to get actual .txt file size from splunk? Thanks, ... View more