Hi, Is there an easy way of exporting a list of all my forwarder clients from my deployment server to csv? I just need a list of them without having to search for them via active data in Splunk. Thanks! B ... View more

Hi, I'm trying to omit the leading zeros for all fields in a csv file that comes from a splunk forwarder. Is there any way to do this WITHOUT going through every single field in every single row? My data looks like this: QUANTITY 000040 000051 000149 000004 and I would like it to look like... QUANTITY 40 51 149 4 ... View more

Hi, I'm trying to compare one field "primaryKey" in two sources; "sourceA" and "sourceB". There are other fields for each event, and I need to return results where those other field values don't match for the same primaryKey value in each source... So if I had: sourceA and sourceB each contain 1 event with "primaryKey=1" sourceA's fields are: primaryKey=1, fieldA=apple...and.. sourceB's fields are: primaryKey=1, fieldA=Banana How do I show that fieldA does or does not match for the same "event" (primaryKey=1) in both sources? They both share sourcetype=csv. Would I do this with a transaction on the primaryKey? if so, how? I'm eventually going to have to compare 3 sources (sourceA, sourceB, and sourceC) for up to 21 fields in each source-using primaryKey. Figured I should start with figuring out just one. 🙂 Thanks, Brian ... View more

Hi, I have two separate fields that I'd like to combine into 1 timestamp field. The fields are formatted "YYMMDD" and "HHMMSS" I'd like to combine and eval them to read "mm/dd/yyyy hh:mm:ss". Does anyone have any experience with this? The fields are "TRADE_YYMMDD" and "EXEC_TIME_HHMMSS" ... View more

Hi, I'm trying to compare events from two sources to show where the outliers are (they "should" be the same but we know that there are discrepancies. I can compare "number of rows/events" easily with a "chart count by source" command, but I also want to check the integrity of the field values. Basically, each event has 10 fields (same ten fields in each source). How do I check that they are the same, and return some kind of message/raw event/field value if they are not the same? Thanks. ... View more

Hi, I am trying to send search results to an email address using the sendemail command. If I "hardcode" the to field in my sendemail command, this works great. However the goal is to send the email to a field value from the search itself..so.. source=reallyBadUsers | Table User, Manager, ManagerEmailAddr | sendemail to=$ManagerEmailAddr$ sendresults=true priority=high subject="This guy is really bad" server=x.x.x.x Obviously I've learned that $ManagerEmailAddr$ is not going to work. How can I work around this? The "to" address will be dependent on the ManagerEmailAddr from the search. Thanks, Brian ... View more

Hi, This is probably very basic, but I'm not sure where the actual log file sits for Windows Event Logs. Trying to use a Universal Forwarder on Windows 2008 Server to capture windows event logs. Where would they be on the server? ... View more

Hi, I want to show events that were executed during someone's VPN session. I can create a transaction that pulls from two sources: VPN and changes. VPN contains session times (start_time and end_time). changes contains change_time (all times are in epoch). However I get multiple change_time values per transaction (expected behavior if people make multiple changes). I only want to show the change_time fields that are within start_time and end_time. My search requires data coming in from BOTH sources and the eventcount must be greater than 1 (1 VPN log represents both start_time and end_time). source="changes" OR source="VPN" | eval user=coalesce(ad_id,citrix_user) | transaction user | where eventcount > 1 |where mvcount(source)>1 | Table user, start_time, change_time, end_time, ticket_number If I do | where change_time > start_time | nothing shows up (I think because there are multiple change_time's per transaction) but if I put | where start_time < end_time | this works perfectly. How can I create a transaction that re-uses the VPN log but matches it separately with each change log? source=changes contains change_time, ticket_number, ad_id source=VPN contains start_time, end_time, citrix_user (citrix_user and ad_id hold the same values Thanks, Brian ... View more