I'm getting the following error when splunk is attempting to start up Operation "read_pid" failed in /opt/splunk/src/libzero/conf-mutator-locking.c:339, conf_mutator_lock(); Operation not permitted I've checked all of the permissions and what not and everything looks to be in order. I however do not have a src path in my main splunk directory. I also just installed the update to 8.0 as well to ensure that all was right in the world. But I was getting this error on the 7.3 that I upgraded from. Thank you all for your help with this. ... View more

So I have HomeAssistant installed and I'm sending all of the events off to my splunk server. I recently had my attic insulation increased and I'm having fun charting the differences in the house temp of pre and post install. So I have this search which returns my house temp index="homeassistant" sourcetype="homeassistant_event" "attributes.friendly_name"="Whole House Thermostat" | spath | search domain=sensor | rename value as "House Temp" And then my outside temp index="homeassistant" sourcetype="homeassistant_event" "attributes.friendly_name"="Dark Sky Temperature" | spath | search entity_id=dark_sky_temperature | rename value as "Outside Temp" I have to use the spath in order to have it parse the json fields. WIthout the spath it just parses the attributes as fields and not the rest of it. Here is what a typical event looks like { [-] attributes: { [-] attribution: Powered by Dark Sky friendly_name: Dark Sky Temperature icon: mdi:thermometer unit_of_measurement: °F } domain: sensor entity_id: dark_sky_temperature host: HASS time: 2019-04-13 17:54:26.698402+00:00 value: 31.7 } So as you can see the value field gets reused I'm sure that this is a super simple solution to come up with but for the like of me I'm having a heck of a time figuring it out. All I want to do is a timechart with both the values reflected on the chart. I tried using subsearch and appendcols but I don't think that either they apply to my situation or they're the right thing for my situation. Thank you all for your help with this in advance and if you need more examples of my data let me know. EDIT: Here is what the Thermostat data looks like { [-] attributes: { [-] current_temperature: 70 fan_list: [ [+] ] fan_mode: Auto Low fan_state: Idle friendly_name: Heating max_temp: 95 min_temp: 45 node_id: 70 operating_state: Idle operation_list: [ [+] ] operation_mode: heat supported_features: 193 temperature: 68 value_id: 72057595217625106 value_index: 1 value_instance: 1 } domain: climate entity_id: honeywell_unknown_type0011_id0003_heating_1 host: HASS time: 2019-04-13 19:15:58.113817+00:00 value: 1 } ... View more

So here is my search index=someindex sourcetype=somesourcetype source="someloglocation*" eventtype="nix_kernel_attached" "\"outcome\":\"success\"" | multikv | mvexpand _raw | rex field=_raw "\"userId\":\"(?<userinfo>[^\"]+)\"" | eval eventtype=mvindex(eventtype,1) | eval LoginType=case(eventtype == "nix_kernel_attached", "WebUI") | search userinfo=userid* "\"message\":\"login\"" eventtype=nix_kernel_attached LoginType=* | join type=inner max=0 userinfo [search index=someindex sourcetype=somesourcetype source="someloglocation/*" eventtype="nix-all-logs" "\"outcome\":\"success\"" | multikv | mvexpand _raw | rex field=_raw "\"userId\":\"(?<userinfo>[^\"]+)\"" | eval eventtype=mvindex(eventtype,0) | eval LoginType=case(eventtype=="nix-all-logs", "CLI") | search userinfo=someuserid* "\"message\":\"login\"" eventtype=nix_kernel_attached LoginType=*] I need to display the UserID and the LoginType in a table so that we can show how the user came in. I've been messing with this for a while, one of the problems is that some of these events have an eventtype with 2 different values for the same event. Hence the mvindex command to yank out the one that doesn't pertain to that particular search If there is a better method when working with mvindex I am all ears for it. Problem is if a user logs in with the cli tools it shows up in both eventtypes but if they login with the UI then it only registers with one eventtype as you can tell from what my search is doing. By the way this join is "working" in that it does return results but I don't trust the results because of the eventtype thing. It also looks like its bringing back duplicates which sure I can eliminate with a dedup but I'm hoping there is a more sane method to this madness. Oh I also don't have access to the backends so I can't make any changes to the way the data is being indexed. Thank you all for your help with this very much. ... View more

So I have this data Aug 22 09:13:46 someservername <118>1 2018-08-22T09:13:46.743+00:00 ip.address LOGSTASH - - - {"timestamp":1534929226738,"process_id":62,"source":"OpsCodi:0","event_type":"SECURITY_MGMT_REGISTRY","data2":{"srctype":"ops_console"},"user":"U654321","target":"some.server.of.ours","message":"Add User [U123456] ","log_level":"INFO"} I don't have a way to modify the field extractions or anything so I'm at the mercy of splunk. No admin rights so I've been working on some serious splunk fu with my search. index=index sourcetype=sourcetype source="source//*.log" | multikv | mvexpand _raw | search URGP_0="User [*]*" | regex URGP_0=(\[(\w+)\]) | table URGP_0 So all I want to see is just U123456 and I intend to pipe this into a table in my dashboard once I have the regex working properly. I am no master with regex but I've plugged it into various checkers online and they all show that it should be working but splunk just continues to show me the full field value which looks like this User [U123456] ","log_level":"INFO"} Yes its a terrible field but well prior to me putting in the mvexpand there were no fields detected so now I at least have something to work with. Also if possible how to extract this user info from it as well "user":"U654321" Thank you for your help with this. ... View more

I'm in the process of building out a new dashboard that will have 3 input selects. 1. Datetime 2. Input1 3. Input2 Input1 is dependent on Datetime and input2 is dependent on input1. I'm using search strings to set all 3 inputs but I need to have it setup populate the drop downs for input1 and 2. This way everything in the dashboard will only return results for the values that are in the drop downs. I know I can do an earliest latest in my search but I'd rather have input1 derive its data from the datetime selector. I don't see an option in the time selector values to tie it back to a token like when you add a search to a panel. We're currently on Splunk 7.0.3 Thank you for your assistance. ... View more