I am forwarding events from a group of servers to an Indexer by way of a Splunk light forwarder. I have forwarding turned on the Indexer to send these events to a syslog server, however when the syslog server receives the forwarded Splunk data from the Indexer its shows the host as the indexer name not the original host Light Forwarders (eventdata) -> Indexer -> Syslog What is the quickest way to rewrite the source host name in the syslog so that it correctly show the original host? ... View more

I have a dashboard consisting of several panels one of which is a table. The output of the search is a table |sort -_time. As new events are coming it it is not placing them at the right position in the sort order but at the bottom, or sometimes in the middle even though the time of the event is the latest. I tried it with and without the sort and get the same behavior. If I click the sort arrow on the _time field it re-sorts and they are in the right order but then it breaks again as new events come in. Anyone else see this behavior and fix it? Anyone explain why this is happening? ... View more

We are replacing our existing logging system with Splunk, but we still have the need to load some of these log events ~15 million/day into SQL Server using SSIS. Has anyone done this and how did they do it? I see either an outputcsv based search or a possible web service call, but what have people done that works? ... View more

I have a transaction that is tied together based on IP address in a web server log. The IP is c_ip and the search would look something like the below - index=iis sourcetype=iis-w3c (cs_method=POST cs_uri_stem=/page1) OR (cs_uri_stem=/page2) | transaction c_ip maxspan=12s startswith="cs_method=POST cs_uri_stem=/pagea" endswith="cs_method=GET cs_uri_stem=/pageb" | search linecount>1 duration="1" There is a field that exists in each log entry called time_taken. I would like to create a value called TotalTime= time_taken of PageA + time_taken of PageB of the defined transaction. How do I do this? Basically how to I get the value of a field that exists in each log entry inside a transaction when they both have the same name? Thanks ... View more

I am trying to get the total number of web server pages that match a given F5 load balancer iRule condition. Specifically, I have One source that contains the irules with a field called VERB (i.e. F5 starts_with OR contains) and the URI (i.e. /mydirectory1/ OR /mydirectory2/mypage.aspx, etc.) I want to take the values in the URI with a starts_with verb and 'join' them together with the web servers log field cs_uri_stem. The issue I think that I am running into is that the starts_with verb would really mean the search should be cs_uri_stem = VERB with an * wildcard at the end. Help!!!! ... View more

I want to be able to push down a single application which contains an inputs.conf to monitor files on a Oracle RAC system. There are three nodes and each system should just read its own file, however the issue is they are on a shared filesystem. Each node is active in this type of cluster. The application would look something like - [monitor:///temp/log/abc1/alert_abc1.log] ... [monitor:///temp/log/abc2/alert_abc2.log] ... [monitor:///temp/log/abc3/alert_abc3.log] .... Ideally I would want to have a whitelist = specific hostname on each stanza, similar to the syntax in serverclass.conf. It would look something like [monitor:///temp/log/abc1/alert_abc1.log] whitelist.0 = node1* ... [monitor:///temp/log/abc2/alert_abc2.log whitelist.0 = node2* ... [monitor:///temp/log/abc3/alert_abc3.log] whitelist.0= node3* .... I realize I could push three separate apps, but that will become a maintenance nightmare down the road. Thanks for any ideas. ... View more

I thought that Splunk would read compressed files and load them, however it is telling me the rar file is a binary. I have a directory loader in Splunk set up with type IIS-2. Can Splunk load the rar files with IIS logs inside them? ... View more

Having trouble with the below regex generated from the field extractor application \w+:\\w+\\w+\(?P \w+\\w+) When added to the search as below index=utility sourcetype="componentcheck"|rex field=FILENAME \w+:\\w+\\w+\(?P \w+\\w+) and example input of d:\A\B\C\D\E\F.dll (there are back slashes between each letter) I get an two of the same errors - Error in 'rex' command: Encountered the following error while compiling the regex '\w+:\w+\w+(?P \w+\w+)': Regex: unmatched parentheses What am I doing wrong? ... View more

A scheduled dashboard creation runs and creates a update in the RSS field, but two things do not work. The URL is incorrect. It shows up as admin_search_X1NjaGVkdWxlZFZpZXdfX2RlYWxlcnRyYWNrX2RhaWx5X3N5c3RlbXNfcmVwb3J0_at_1302210720_7ed552209288256e">http://www.dtsplunk1.com:8000/app/search/@go?sid=scheduler_admin_search_X1NjaGVkdWxlZFZpZXdfX2RlYWxlcnRyYWNrX2RhaWx5X3N5c3RlbXNfcmVwb3J0_at_1302210720_7ed552209288256e The server name is dtsplunk1, however the www should not be there and it should contain a different internal FQDN. Where is it getting this URL from? If I change it to the right URL, I get a search screen with the search of noop (no OP) I guess. How do I fix #1 and what can I do about #2 since it is not showing the report that it should? Thanks Chris ... View more

Is there a way to increase the number of maximum threads that the backfill script will use to a value higher than 16? ... View more

We have a CSV file that we import into splunk daily. We have at least one line that is too long and is possibly corrupted. How can I find out the maximum line length of a raw event in the CSV. That is to say, the length of the full line, not the length of the individual fields in the CSV. ... View more