I'm new to Stream and not particularly experienced with wire data, but we have a test box receiving a span port (for now) to capture traffic to a certain server, and have been successful in setting up tcp flow captures. We recently reached out to another team to inspect some of their data coming to our Stream test server, however, and noticed that we are seeing hardly any traffic from their server. We only have a single Splunk event per port/protocol their server, so far, and it came in a long while after we started capturing. We have no filters in place at the moment, and are capturing only tcp traffic. To troubleshoot, we ran a tcpdump for traffic from this team's source, where we do see all of their raw traffic as expected, and then did a direct import of that capture file. The result was that we had two Splunk events total, one for each port being used by their application. We ran three separate captures, each limited to a different number of packets: 100, 200, 1000. This produced six events in Splunk, where we assumed there would be perhaps dozens given the traffic they are generating. The issue appears to be with certain(?) persistent connections, but perhaps this is expected behavior? To my knowledge the application sending this traffic is your typical aggregate of clients talking to a database through an application/service. IE: Client hits app, app speaks to db, we capture app to db traffic. This Answers post appears to be reporting the same or similar, but the marked answer is not an actual solution. ... View more

I have some XML data broken down into events that have multiple child attributes that share the same name but are distinctly different fields. What I need to do, for each event, is to separate each unique child section into their own unique fields. This is probably extremely easy to accomplish, but I cannot seem to figure it out. Referencing the sample data below, I need to extract the vendor's information as VendorName, VendorCity, etc and likewise for client and supplier I need ClientName, ClientCity, etc. Auto extraction obviously doesn't work in this case without transforms, and regular expressions are proving to be difficult because the real data has multiple addresses, phone numbers, and/or might lack some of this information. Each XML file (event) has about 100 lines. I'm able to get the information easily if I use spath, but I don't think I can use spath for anything but search time extraction by piping it in with the output and path. That's fine for a search or report here or there, but otherwise I'm piping in about 50 lines. What am I doing wrong? <OrderForm> <ClientOrder PO="00000123"> <Vendor ID="789"> <Name>Paperclips, INC</Name> <Address> <Street>789 Paper St</Street> <City>San Francisco</City> <State>CA</State> <Zip>84989</Zip> </Address> </Vendor> <Supplier ID="224"> <Name>Happy Paper Co.</Name> <Address> <Street>12455 Shipping Ave</Street> <City>Los Angeles</City> <State>CA</State> <Zip>92254</Zip> </Address> </Supplier> <Client ID="4152"> <Name>Dunder Mifflin Infinity</Name> <Address> <Street>1725 Slough Ave</Street> <City>Scranton</City> <State>PA</State> <Zip>18503</Zip> </Address> </Client> </ClientOrder> </OrderForm> ... View more

I'm new to DB Connect and just as inexperienced with SQL, but was tasked with getting some table data in to build a few reports and dashboards. One issue I have is that the table is mostly flat and doesn't have a rising column to tail from. The best column for that would be a 'DateModified' column but it only provides the date and not the time, so if the record is updated twice in a single day I'm not sure how that would be picked up, if at all? The other issue is that some of the data is already laid out in views, which are making lookup tables difficult. Would it be better to just run a scheduled query to outputlookup to a CSV? ... View more