Hello, New to Splunk.  Can Splunk monitor or audit changes to a Netapp file share?  We would like to know about file or folder deletions, moves on those shares, etc.  I have installed and configured the ONTAP add-on and application and have data in. Additionally, I am trying to convert my WinEventLog:Application logs to a metrics index, but want to retain the event data from this sourcetype as well.  Is it possible to have both?  Will this affect my license usage if I am sending the same data to both a metrics index and an event index?   Thank you   ... View more

Hiya, simple question here. I want to change the way a value is represented to me after I index, see the following: 2014-02-21 10:42:57 support-1 root: [ID 702911 daemon.notice] * <WARNING> : target=backed(up I want "backed(up" to be replaced with "backed-up". Any suggestions? ... View more

I want to extract from "Mozilla" to the closed quotes, pulling everything up to and including 27.0", how come my regex (\s.+") goes all the way to the final quote on the other side of the word analytics. I know the regex is poor, I'm just trying to get the concept. "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0" OBSERVED "Web Ads/Analytics" ... View more

To me this should be simple, but I can't get it. When entering host info while adding data I select "regex on path" and enter the regex for my capture group, but it still returns my default host upon search for that particular source. Even if I change my default host name in system/local or search/local inputs.conf, I still get my default host. Also if I select "segment on path" and just try to name it something along the path, I still get my default host. Even if my regex was not sound, some of these other options should work, where is Splunk continually pulling my default host from if I take it out of .conf files entirely? ... View more

Real novice here. I am ingesting a sourcetype into Splunk, and want to filter out any events with the word "FAILED" right after the first IP address.` Below is my props in etc\apps\search\local [sslbcoat1] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom pulldown_type = true TRANSFORMS-null = setnull ` and then here's my transforms where I THOUGHT I was carving out failures and sending them to null: [setnull] REGEX = ^.+(F...).+$ DEST_KEY = queue FORMAT = nullQueue The regex might be wrong, but somehow I don't think that's the big problem. Thanks and any insight would be appreciated. Also every time I try to save props.conf it says I do not have permission to save even though I'm a full admin, I have to fully unlock the directory to save, is there a way to avoid that? Thanks. ... View more

Real novice here. I am ingesting a sourcetype into Splunk, and want to filter out any events with the word "FAILED" right after the first IP address.` Below is my props in etc\apps\search\local [sslbcoat1] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom pulldown_type = true TRANSFORMS-null = setnull ` and then here's my transforms where I THOUGHT I was carving out failures and sending them to null: [geo_us_states] external_type = geo filename = geo_us_states.kmz [geo_countries] external_type = geo filename = geo_countries.kmz [geo_attr_us_states] filename = geo_attr_us_states.csv [geo_attr_countries] filename = geo_attr_countries.csv [setnull] REGEX = ^.+(F...).+$ DEST_KEY = queue FORMAT = nullQueue The regex might be wrong, but somehow I don't think that's the problem. Thanks and any insight would be appreciated. Sample event: 014-04-17 13:50:22 2 10.3.31.70 FAILED - - - - 199.83.168.160 - - - none - - - - none - - 163.252.254.201 SG-SSL-Proxy-Service - 58642 ... View more