I created an app contain most of the required element include macro, lookup, navigator, UI, savedsearches, etc.   however, when I switched to the app first : go to setting -> macro,  then Splunk with gives me internal server error 500, or go to setting -> lookup, Splunk with gives me internal server error 500, or go to setting -> menu -> navigation, Splunk with gives me internal server error 500  if I switch to default search apps first, then go to setting and click the configuration like macro or lookup or menu, then I switch to my project app by drop-down menu,  in this case I can edit the content without getting internal server error 500 The Search head is a 4 members search-head cluster, build on Splunk 8.0.2 Linux on CentOS 7 any clue?? ... View more

Dear All, We have retrieve datas from salesforce with Splunk Add-On for salesforece. However, we missed out some critical fields so we have to | delete all data and reload data from scatches. However, since the same Forwarder is connected to O365 so we cannot reset the reading pointer by splunk clean all. Do you have any recommendation so we could reset the Splunk TA for salesforce and reload the data from begining? ... View more

Hi I installed splunk for Exchange, but I found my internal domain become unknown like Username Mailbox Size (MB) %age Quota Usage 1 mdm-good1@UNKNOWN 4 0.185910000 2 mdm-good2@UNKNOWN 4 0.177800000 3 mdm-good3@UNKNOWN 4 0.17780000 4 ben@UNKNOWN 2 0.082708 5 mailuser@UNKNOWN 2 0.077490 6 administrator@UNKNOWN 1 0.00090064 7 goodadmin@UNKNOWN Anyone can hint me what I did wrong? ... View more

HI I have a problem. I have a NAS that have a mail folder to store Devices' configuration file. Each device will have a separate directory to its configuration. A configuration commit in the device will automatically save a new copy in own folder and each day a copy will automatically generate at specific time, for example, 12:00am. I want to use splunk to figure out change of the configuration I could use diff and head to pull out last 5 configuration and diff on it. but boss want to add an additional comparison whcih compare to the last file one day ago. sourcetype="deviceconfig" host="switch1" latest_time=now | head 5 | diff position1=1 position2=2 | append [ search sourcetype="deviceconfig" host="switch1" latest_time=now | head 5 | diff position1=2 position2=3 ] | append [ search sourcetype="deviceconfig" host="switch1" latest_time=now | head 5 | diff position1=3 position2=4 ] | append [ search sourcetype="deviceconfig" host="switch1" latest_time=now | head 5 | diff position1=4 position2=5 ] | rex "@@\s*(?<para1> [+-]?\d*,\d*\s*[+-]?\d*,\d*)\s*@@" max_match=50 | rex max_match=100 "(?<para2>\n[+-][ a-zA-Z0-9].*)" | rex "hostname\s*(?<host_name>\w*)" | eval count=mvcount(para1)|table _time host count para2 Do anyone know how I could check against the configuration file one day ago ? Or I should say How I can find the last event one day ago? ... View more

Hi Do splunk support AIX 7.1 64bit? recently we have a project they would want to apply FSCHANGE on AIX7.1 64bit. Thank ... View more

HI My splunk failed to parse timestamp of one of the inbound syslog. 10-03-2011 10:55:18.119 +0800 WARN DateParserVerbose - Failed to parse timestamp for event. Context="source::udp:514|host::TSSSYSLOG01|syslog|" Text="172.18.12.21, -, -, N, 2011-10-03, 11:02:45, 1, -, -, ProxyAV_Sec, 172.18.12.25, 1344, 906, 193, 0, ..." I have renamed the sourcetype as proxyav in transforms.conf in props.conf, I added follow [proxyav] SHOULD_LINEMERGE = false # MAX_TIMESTAMP_LOOKAHEAD=60 # TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s # TIME_FORMAT = %Y-%m-%d, %T # TIME_PREFIX = ^[^\,]+\,[^\,]+\,[^\,]+\,[^\,]+\,\s TIME_FORMAT = %Y-%m-%d, %H:%M:%S, KV_MODE = none I did also tried various remarked setting, but no luck to remove the parse error. Could anyone give me a hand? Best Regards ... View more

following best view with courier font 🙂 I need to create a report from QMAIL log.  There will be more then one thread write to the log file so the  Basically they like this, say I have a long event that a incoming mail, delivery to 2 recipients: delivery_id should be pretty sequential but msg_id have very high chance will be reuse immediate once the mail process finished. Since msg_id is highly likely reuse all the time, so I cannot reverse search from delivery status and ressolve msg_id from delivery_id   Start Event -- msg-id -------------- msg-id : msg-size from Sender email gp ??? uid ??? Start Deliverty delivery-id : msg msg-id to local/remote recipient ... Start Deliverty delivery-id : msg msg-id to local/remote recipient ... delivery delivery-id: success/failure/deferred: deilvery-information ... END Event ---- ... ... ... delivery : success/failure/deferred:     so I use transaction to group msg_id event togehter search qmailapplog | transaction msg_id startswith=("new msg") endswith=("end msg")  to group msg_id event together then I have event like the following: 2011-06-03 14:30:32.539477500 new msg 2019703 2011-06-03 14:30:32.539480500 info msg 2019703: bytes 25370 from a@b.com qp 1429 uid 502 2011-06-03 14:30:32.612800500 starting delivery 90228: msg 2019703 to remote b@a.com 2011-06-03 14:30:34.043198500 end msg 2019703 2011-06-03 14:25:57.685624500 new msg 2019703 2011-06-03 14:25:57.685626500 info msg 2019703: bytes 4166 from c@gmail.com qp 1210 uid 511 2011-06-03 14:25:57.750225500 starting delivery 90227: msg 2019703 to remote q@h.com 2011-06-03 14:25:58.028086500 end msg 2019703 2011-06-03 14:25:57.396305500 new msg 2019862 2011-06-03 14:25:57.396307500 info msg 2019862: bytes 4055 from d@gmail.com qp 1198 uid 501 2011-06-03 14:25:57.513558500 starting delivery 90221: msg 2019862 to local a1@b.com 2011-06-03 14:25:57.513563500 starting delivery 90222: msg 2019862 to remote a2@c.com 2011-06-03 14:25:57.513568500 starting delivery 90223: msg 2019862 to local a3@a.com 2011-06-03 14:25:57.513585500 starting delivery 90224: msg 2019862 to remote a4@b.com 2011-06-03 14:25:57.513607500 starting delivery 90225: msg 2019862 to local a5@a.com 2011-06-03 14:25:57.513610500 starting delivery 90226: msg 2019862 to local a6@a.com 2011-06-03 14:25:57.750253500 end msg 2019862 Therefor I will have msg-id - size - sender ---- recipient - delivery-id ------- : ----- : ------- : --------- ------- 2019703 : 25470 : a@b.com : b@a.com : 90228 2019703 : 4166 : c@gmail.com : q@h.com : 90227 2019862 : 4055 : d@gmail.com : a1@b.com : 90221 -------------------------------a2@c.com 90222 -------------------------------a3@c.com 90223 -------------------------------a4@c.com 90224 -------------------------------a5@c.com 90225 -------------------------------a6@c.com 90226 on the other hand, I can have delivery transaction by sourcetype="qmailapplog" | transaction delivery_id| table delivery_id delivery_status, delivery_info then i would have something like 90227 success 123.123.102.30_accepted_message./Remote_host_said:250/ Problem is How i could join them together by delivery-id so I can see the incoming mail and all delivery-id's delivery-result ... View more

Hi Do you have any idea to decode Epoch time and Tai64 encoded time? I have several device their time is as below.. completely have no idea on Tai64. for Epoch, I tried to put following in props.conf [sourcetype] TIME_FORMAT = %s but do not work . Time is Tai64 @400000004de5bcd921686bec tcpserver: status: 0/40 @400000004de5bcd921686034 tcpserver: end 10611 status 256 @400000004de5bcd91d08caec tcpserver: ok 10611 0:192.168.2.33:110 :192.168.1.102::2029 @400000004de5bcd91d08c704 tcpserver: pid 10611 from 192.168.1.102 Time is Epoch 1303380720.401 399 192.168.3.32 TCP_MISS/000 3437 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/4/0/str%3d0001.0A3D0009.4DB002F2.0054%2css%3d4%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:0:3392:192.168.3.32:1:0:18:: PROTOCOL-STAT:a@b.c:<SNT115-W4378F7332227898850E657AE920@phx.gbl>: PROXY-ERROR:: 1303365337.779 410 192.168.3.32 TCP_MISS/000 3313 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/3/0/str%3d0001.0A3D0009.4DAFC6DB.0037%2css%3d3%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:1:3393:192.168.3.32:1:0:13:: PROTOCOL-STAT:a@b.c:<418ea2af3d2ec5aebde87ee2c78309ad@edm04.01webdesign.com.hk>: PROXY-ERROR:: 1303365336.935 404 192.168.3.32 TCP_MISS/000 3308 GET mail:a@b.c - DIRECT/192.168.2.33 multipart/alternative DETECT-STAT:SPAM:FSIGK/SPAM_CT/3/0/str%3d0001.0A3D0009.4DAFC6DA.0054%2css%3d3%2cfgs%3d0:::: ACTION:CHANGE_SUBJECT: PROXY-STAT:smtp:0:3392:192.168.3.32:1:0:16:: PROTOCOL-STAT:a@b.c:<fa4fe4d1cb0c21701daea014a61fdde7@edm04.01webdesign.com.hk>: PROXY-ERROR:: ... View more

I have a splunk universal forwarder , The Perform can only give me the short host name. but at the same time WinEventLog:* can give me correct FQDN, I want to have consistent host name across the environment. any one have some idea? I have set up host=win-dns.domain.org in inputs.conf (both sysetm\lcoal and apps\msicreate\local) ========EVENT SEARCH SAMPLE============ 05/27/2011 15:40:10.833 collection="Network Interface" object="Network Interface" counter="Bytes Received/sec" instance="Intel[R] PRO_1000 MT Network Connection" Value=2424.3003755975237 sourcetype=Perfmon:Network Interface source=Perfmon:Network Interface host=**WIN-DNS1** ... View more