I'm looking for anyone who is ingesting Ganglia data into Splunk. I have a customer interested in doing this but were wondering about other customer doing the same. What has your experience been, use cases. This is a HPC environment. ... View more

I'd like to provide individual users the capability to change colors of their dashboard. Individual A = Blue dashboard Individual B = red dashboard but it is the same dashboard ... View more

Can Splunk receive rsyslog excrypted messages via TCP or should I use a LWF with SSL turned on? ... View more

How do I tell when a user modifies another user and what they modified (ie added a role to the user) ... View more

I am trying to search on the name field by scap-id in the following data. When I search against it Splunk returns one value for the name and throws out the rest. How do I make name a multivalued field. I have included a dataset and my props.conf and transforms.conf. <controls scap-id='CVE-2010-1241'> <control internal-id='8081023'> <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='8081024'> <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1 (French)</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='8091029'> <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>3</passed> <failed>1</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='8091030'> <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1 (French)</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='9081021'> <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='9081022'> <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1 (French)</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='9091019'> <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> <control internal-id='9091020'> <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1 (French)</name> <release-date>Tue, 13 Apr 2010</release-date> <statistics> <scanned>4</scanned> <passed>4</passed> <failed>0</failed> <patched>0</patched> <mean-patch-time-hours>NaN</mean-patch-time-hours> </statistics> <exceptions> <has-exception>false</has-exception> <use-exception>true</use-exception> <exempt-count>0</exempt-count> </exceptions> </control> </controls> props.conf [bigfix] #TIME_PREFIX = <Extended_Timestamp> #MAX_TIMESTAMP_LOOKAHEAD = 200 #MUST_BREAK_AFTER = </controls> #BREAK_ONLY_BEFORE_DATE = false #SHOULD_LINEMERGE = true #LINE_BREAKER = \>\s*(?=\<control\>) BREAK_ONLY_BEFORE = <controls\sscap-id REPORT-bigfix = xml-bigfix transforms.conf [xml-bigfix] MV_ADD = true ... View more