Link doesn’t work ... View more

You can keep your raw events by adding an extra list(_raw) as other_events next to list(win_event) . This way, when you detect the last event of the window you will have the remaining events of the window under other_events . In the meanwhile, I will try to see if there is a better way to do this. ... View more

Yes, It will be individual lines. Each of those lines will be the ending of sequence of 6 events where the starting event was a login 4624 and the last one (the current event you see) is the next 4624 login. Do you need all the raw events? I though you only needed the event codes between and the fact that such sequences exist. Both of those are given by the SPL above. If you need the raw events you might want to use a transaction instead of a "where" command. ... View more

Do you still have this issue? ... View more

I assume that want you want to do here is create a sliding window of 6 events and select those windows that start with 4624 and end with 4624. Given that you cannot do this with transaction (if you use the same startswith and endswith it gives all transactions to be single events), I will try to show you how you can do this using streamstats . index=myindex source=/my/folder/raw.log.gz xxx.xxx.xxx.xxx | sort -Time | eval ip="xxx.xxx.xxx.xxx" | streamstats list(win_event) as event_window window=6 by ip | eval window_len=mvcount(event_window) | eval window_first=mvindex(event_window, 0) | eval window_last=mvindex(event_window, 5) | where window_len = 6 AND window_first=4624 AND window_last=4624 ... View more

For Splunk 6.4.x: Here is a list of different option for exporting to a file from the CLI $SPLUNK_HOME/bin/splunk search 'index=main' -output table > tofile.txt $SPLUNK_HOME/bin/splunk search 'index=main | head' -output raw > tofile.txt $SPLUNK_HOME/bin/splunk search 'index=main | head' -output rawdata > tofile.txt $SPLUNK_HOME/bin/splunk search '*' -output csv > tofile.txt $SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json > tofile.txt The default behavior of the CLI search is to export first 100. Use the -maxout 0 option to bypass that limit. $SPLUNK_HOME/bin/splunk search 'index=main id=abs*' -output json -maxout 0 > tofile.txt If you don't specify an output option, the default is to only export _raw . ... View more

The answer is yes. Even in a non distributed environment you can have multiple jobs collecting (writing) to the same index. Each collect will first be writing to a different file (i.e., source). The indexer will be indexing each one of those files in separately. ... View more

You can let Splunk extract all the XML fields automatically by changing the props.conf file in the application of interested (say search). Here is a stanza example: [my_xml_logs_source_type] KV_MODE = xml ... ... View more

As stated by others, the default timestamp format is "%m/%d/%Y:%H:%M:%S", but you can change that! With the current Splunk 6.4 you specify a different formatter using this syntax: ... timeformat="%Y-%m-%d %H:%M:%S" latest="2016-9-22 12:56:11" Latest documentation for search time modifiers can be found here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers ... View more

I don think this works any more ... ... View more

| REST /services/data/indexes | table title, currentDBSizeMB If you want to add the size of the index as well. ... View more

The toughest problem is to know when to reset; that is to know when the car passes by a stop and then you need to start tracking of the next pass. In your example, how do you know that these three values are from the "same time it passed by" and not the first one being "the closest on the first time", the middle one being the "closest on the second time" and the third one to be "the closes on the third time"? ... View more