Hey all, I have a event log that i have to generate reports off of for the BI team where i work. the problem i keep running into is that the different event types log different set of information all tied to a unique event_id, but i need to have one field of a specific event type tied to all the other events with the same id. example: time event_id Node user status event_type 18534564.56 05178 HIL-DEV01 not_reporting alert 18640234.9 05179 ROV-HOST01 disk_space_low alert 19538754.13 05178 Hal9001 closed in this example i want to assign node HIL-DEV01 across all events with the ID of 05178. I have tried to do this with transactions, but i have found that i lose unique time values for events inside the transaction. is it possible to do this with eval? or does anyone have an idea of what to do? if you need more info just let me know. ... View more

Hey everyone, I am trying to blend field values from subcategory events that are related by a key. I can group them together with a transaction, but when i try to stats the values into a report separated by their subcategory the fields don't stick. let me draw a mock table... Catagory: OrderID: UserID: EmpID: order_placed 10101 abc1234 processing 10101 5678910 shipped 10101 5678910 the regular logs have specific fields, but in the generated report i need individual lines for each catagory of event, but with all the related fields filled so it would look like this: Catagory: OrderID: UserID: EmpID: order_placed 10101 abc1234 5678910 processing 10101 abc1234 5678910 shipped 10101 abc1234 5678910 any help on this? i know i'm missing something here.. ... View more

hey everyone, Our server here generates a filestamp/header at midnight or on resets that start with a line of dashes(----), then enters a line of system and log information (this is useful), then ends with another line of dashes (----). I've been trying to use SEDCMD to delete the dashed lines (including the carriage return) but it doesnt seem to be working. SEDCMD-StripBreaks = s/\n?----*//g I've tried changing the name for the class, tried removing the "\n", double escaping the "\n", all of it just doesn't work. One thing that works is if I try it inline.. | rex mode=sed "s/\n?----*//g" I could use some help getting my head around this.. Update: so I've tried to do this with a different issue I'm having which is repeated spaces, if I use the rex sed mode it works just fine, but the second i add it to props it falls apart. here's the second one I've tried.. SEDCMD-SubSpaces = s/\s\s+/ /g beside this i've tried changing how the SED is applied by giving it a source file instead of the sourcetype and it still doesnt work. here is the working rex for my second SEDCMD. rex mode=sed "s/\s\s+/ /g" again, any help is appreciated! ... View more

Hey everyone, So I have a script that generates status logs for a few network devices that my Splunk forwarder grabs, but every now and again something screws it up and it garbles the entry. The garbled entry is always a smaller linecount, this accounts for roughly 1% of my logs from the script. Is there a way to tell Splunk in the props file to throw away the entry if it's less than 23 lines long? Thanks! ... View more

hey all, so I'm trying to add our camera system logs to splunk but because of the formatting of the status logs it breaks it at the wrong spot. I've tried to specify custom line breakingg rules in the props file but I must be doing something wrong. here is a sample log: Device Status: ctime=1392061339.198785 lcode=1 (NORMAL) mcode=1 (NORMAL) afpks=009830 afius=038551 Device Settings: name=abc10 type=asd ctime=1392041485.026564 imgq=86 fps=10 vca=0 apb=0 ptz=0/0/100/50/0 most=-6 cbbytes=33554432 mibytes=524288 iscount=64 Latest Data: isnm=194206 ssnm=4134514 size=165465 Device Status: ctime=1392061339.198785 lcode=1 (NORMAL) mcode=1 (NORMAL) afpks=009830 afius=038551 Device Settings: name=abc10 type=asd ctime=1392041485.026564 imgq=86 fps=10 vca=0 apb=0 ptz=0/0/100/50/0 most=-6 cbbytes=33554432 mibytes=524288 iscount=64 Latest Data: isnm=194206 ssnm=4134514 size=165465 Device Status: ctime=1392061339.198785 lcode=1 (NORMAL) mcode=1 (NORMAL) afpks=009830 afius=038551 Device Settings: name=abc10 type=asd ctime=1392041485.026564 imgq=86 fps=10 vca=0 apb=0 ptz=0/0/100/50/0 most=-6 cbbytes=33554432 mibytes=524288 splunk keeps trying to break on the "ctime=\d+.\d+" string but a full log runs from the "Device\sStatus:" line to just before the next "Device\sStatus:". so when it breaks on ctime i get twice as many logs with half of the information in each. under the file match condition heading this is the line i added: [source::.../status-data/*/*.status] LINE_BREAKER = (Device\sStatus:) SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = false thanks for the help guys! ... View more

So I've been working on a particularly complicated and convoluted set of log files that require a bit of regex work to be done. weve gotten the field extraction page to grab the right fields, and even test the rex on the data set, first head 10000 and then no head at all, and it works fine. however once we save the extractions we get nothing, no fields ever show up, ever if we tell it to show fields with no related records. any idea what we are missing here? Edit:__ all extractions are in the search app, but are given global permissions. We have restarted or Splunk server several times, a few of the extractions from our transforms file show up but that's it. As for our formatting the field extractor builds them and we will click the test button and it works just fine in the testing window, but it's exactly when we save it that it just disappears. We just updated to Splunk ver6 are we missing some configurations? ... View more