index=myindex | eval originaltime=strptime(eventTime, "%b %d, %Y %H:%M:%S %p") Some sample values of eventTime parameter are Dec 04, 2014 12:31:57 PM Dec 04, 2014 12:31:58 PM Dec 04, 2014 12:31:50 PM Why is %p not recognizing PM? The value of originaltime is always AM. E.g: if the eventTIme is 1:30 PM today, then the originaltime gets the epoch time for 1:30 AM today. Somehow %p is not recognizing %p. Any suggestions?? Splunk verion: 6.1.3 ... View more

How to change event field values into field name? Event log sample1: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ id, code, message 1, 1111, "one" 3, 12345, "three" Event log sample2: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~` id, keyname, keyvalue 1, name , john 1, place, richmond 1, activity, login 1, environment, mobile 2, name , bob 2, lastname, bill 3, name, charle 3, location, newyork 3, activity, transaction 4 name, Danny 4 lastname, Huber 5, name, eugene Both event have common field called "id". I will join both data searches using join command. e.g: index=abc code=111 | join id [search index=blah ] But my requirement is, for the above search when the code is 111, i need get the table in following format id, code, message, name, place, activity, environment 1 , 1111, "one", john, richmond, login, mobile Please note that, the values of keyname and keyvalue are become field-name and its values respectively. Please let me know how to do this? ... View more

Hi All I want to move the spath from search query to the auto extraction configuration ie in props.conf and transforms.conf. Is this possible? index=myindex | rex max_match=0 "(? {[^}]+})" | mvexpand json_field |spath input=json_field spath breaks KV from complex JSON too. Hence I want use spath, but in configuration files instead of search query. ... View more

First time I'm going to use OSSEC App. http://apps.splunk.com/app/300/ . I didn't find the CLEAN STEPS for configuring the App to get data from Splunk forwarder installed on the ossec logs source machine (It may not be OSSEC server itself. This is syslog aggregator). I have installed the splunk forwarder on syslog aggregator machine. Configured forwarder outputs.conf to send to indexer. I can see the _internal logs of forwarder in Indexer/SH machine. So the communication is setup. Install OSSEC App on Indexer/SH. What are the next steps to configure the Splunk forwarder to send the data from log path say path1 to Indexer/SH? I'm not finding 1. clear steps to make to working like step-1, step-2, step-3....step-n 2. There doesn't seems to be TA (add-on) app for installing on forwarder? Kindly let me know if anyone has prepared the steps to configuration to make OSSEC work. ... View more

Topic: collect not storing the extracted fields into new index and what is way to save all extracted fields into new index Description : Currently I'm experimenting the below task in test environment with stand alone splunk instance. Once tested, I have to move to production. The original log data has partial JSON data which is sent over syslog. So the format is " _time server-name ipaddress INFO .... { < > } What I need ????? Search query extracting JSON key-values and loading the values is very slow and can't be accepted. Hence, I want to extract all key-values pairs and store into a new index. So that I can write my queries on my new index which should be having plain log format with name-value pairs. QUESTION-1: Does my new index should be summary index or regular index? QUESTION-2: How to save all the extracted field-values into new index? . . . Since if the log contain partial data, generally Splunk takes lots of time to extract key-values from JSON with 'spath' command. Hence, I decided to create a schedule search for every 5min and write the name/value pair into new summary index using 'collect' command. Below is the sample query where the original log is indexed into index web_analytics. In this query I'm extracting the key-values pairs from JSON value index=web_analytics | rex max_match=10 "(? {[^}]+})" | mvexpand json_field | spath input=json_field | rename active_features{} as A_Features, actions{} as A_Actions | collect index=si_web_analytics QUESTION-3: After the above schedule search exectued, I'm still seeing the same JSON log even in si_web_analytics. The collect command has not stored the extracted key-values from JSON. QUESTION-4: In a distributed search, where does si_web_analytics needs to be created? on search head or indexer? Thanks in advance. ... View more