I am using Python API call to get Splunk data. I was running to a limit where I was hitting a limit of 50k. I saw this post that talked about making multiple calls to iterate through 50k records at a time. My question is how do I know when to stop? Is there a way I get to figure out exactly how many records it has and then I can make the right number of loops? Thanks ... View more

I have log file that looks like the following: what's the best way to extract each value here. I want to evetually download this as a csv file. I'm okay with the dictionary/json for message still being a dictionary/json. {"source_host":"a.com","method":"new","level":"INFO","message":"value = {\"sessionId\" :\"1\",\"number\":\"2\"}"} I tried using | spath output=_raw path=source_host , but and that worked, but I can't get multiple fields e.g. | spath output=_raw path=source_host|method | spath output=_raw path=source_host,method | spath output=_raw path=* Any thoughts? ... View more

Here is what my log looks like: Date_filed=record_create_ts Grain=D Load_Frq=D Data=18,2014-05-20 Number=3,2,169 Date=2014-05-21,2014-05-22,2014-05-24 When I run the following command on the log ...| table Number Date I get the following: I thought that I would get '3,2,169' instead of just '3'. Does any one know why this is happening? ... View more

In my inputs.conf file, I have an entry for a sourcetype that I want to change. Currently, it monitors the path: /opt/A_*/B/C/Logs/Splunk/*.log . I would also like to monitor the path: /opt/A_*/B/D/Logs/Splunk/*.log . At first I thought that I could do this: /opt/A_*/B/*/Logs/Splunk/*.log , but there is a folder that I do not want to be ingested into splunk under this sourcetype: /opt/A_*/B/E/Logs/Splunk/*.log (There's actually multiple files that I do not want to ingest, some of which have not been created yet). Whats the best way to (only) monitor /opt/A_*/B/C/Logs/Splunk/*.log and /opt/A_*/B/D/Logs/Splunk/*.log ? Thanks ... View more

I have a search that I (temporarily) no longer want to run on one of my dashboards. Because the search includes a TimeRangePicker, Html, Search, SimpleResultsTable, and Redirector I don't want to delete them as I may want to use the search later on. Is there a way that I can prevent these modules from displaying to the user (or even running in the background) without deleting any of the modules? I'm thinking a gate might work, but I'm wondering if there is a better way to do it. Thanks ... View more

I have an interesting lookup table problem. I essentially want to unpivot a lookup table (in other words I have multiple fields in a lookup table, but only 1 field in the table that will be created. Conditions will determine which lookup field populates that table field). In my data I have two fields of the following form: Table.....Status A............delete A............insert B............delete B............insert The look up table is of the following form: Table.....Insert_Status.....Delete_Status A............yes....................no B............yes....................yes If I run this normally as I do a lookup table: lookup $LookupName$ Table as Table OUTPUTNEW Insert_Status as Insert_Status I will get 4 columns that look like the following Table.....Status...........Insert_Status.....Delete_Status A............delete...........yes......................no A............insert............yes......................no B............delete...........yes......................yes B............insert............yes......................yes I want instead to have the output be the following: Table.....Status.....3rd_Column A............delete......no A............insert.......yes B............delete......yes B............insert.......yes There are 2 unattractive ways that I can get to this 3 column end result: 1) Have multiple A and B values for the Table field in the lookup table. 2) Use the lookup table to get the 4 column example and then add a transformation line of code that turns creates a 5th column that is in the proper format and then get rid of the other two columns. I don't like 1, because it will leave a very messy lookup table and I want to keep that as clean as possible as other people will be filling it in. I feel like 2 is a very sloppy way of doing it. I have more than 2 Statuses and this could get really big really quick. I'm wondering if there is some way that I could populate the third column based on the Status column. e.g. if Status is 'delete' then I use the respective 'Delete Status' lookup field and if the Status is 'insert' then I use the respective 'Insert Status' lookup field. I know this is a long post, but hopefully it was clear. Thanks for taking the time to look at this. Splunkster45 ... View more

Once search query allows me to get the total percentage of failed calls in a 24 hour window index= ... | stats count(client_ip) as Calls | appendcols [ search index=... | stats count(IPAddress) AS Fails] | eval "Percent Fails"=Fails/Calls*100 If I put the base searches of each the above two searches into the variables A and B, I get A | stats count(client_ip) as Calls | appendcols [ B | stats count(IPAddress) AS Fails] | eval "Percent Fails"=Fails/Calls*100 I can also create a timeseries for the number of calls and the number of fails by the following A | timechart count span=1h B | timechart count span=1h Is there a way that I can combine the two? I want to be able to get a timeseries of the percentage of failed calls per hour over the last 24 hours. Essentially, this would equate to taking each hour in B and dividing it by the same hour in A. Does anyone have any idea of how to do this? Thanks! ... View more