In an attempt to explain this right... We have set up multiple eventtypes to different occurrences. For example: eventtype=major eventtype=warning major works just fine.. When running a simple search : sourcetype="example" eventtype=warning The matched results return a result that is not 100% of events. So, for example, the search returns 200 events, but when selecting eventtype in the interesting fields column, it shows that that warning only shows up for 90% (180) of the events. The search is still returning events that meet the requirements for the eventtype=warning , but it is not tagging them as such. The goal here is to generate alerts based off of these eventtypes to make it much easier to manage. My concern is if the eventtype field is not applying to all occurrences that an alert may not have triggered. Looking into the events that are not getting the eventtype field, i notice they are rather long, and the portion of the log that would fulfill the requirements for the eventtype field are over 100 lines down in the log. Is there a props.conf or maybe an eventtype.conf setting that can be modified? I'm wondering if it is not looking all the way through the logs to apply the field. Thanks for any help ... View more

We just recently upgraded some of our equipment and decided to move the old equipment into our dev environment to set it up as a separate cluster. What is the best way to route production data over to the dev environment? I am looking for the best option that isn't too demanding on the production environment and won't eat up our license. We were considering looking into setting up Splunk HEC as a possibility. I am just brainstorming ideas currently I am open to all suggestions! Thanks! ... View more

I am trying to build a summary index to pull a week over week comparison of specific applications. The below query works normally, but for efficiency reasons I would like to place this in a summary index. I am having trouble getting the results I want displayed for the comparison in question. My results with sitimechart are using the date and time that the data was ingested into the Summary Index which prevents my comparison method from working. The search results off of the summary index places events in a "NULL" column and does not follow the eval statements. index=1 host=1234 sourcetype=sourcetype application=app earliest=-2w@w latest=@w | eval marker = if (_time < relative_time(now(), "-1w@w"), "last week", "this week") | eval _time = if (marker=="last week", _time + 7*24*60*60, _time) | timechart count by marker cont=FALSE See attached for stats table ... View more