Hello, I am not sure if this is possible, but I have a file named called php_201000618.txt and inside the logs it contain something like: ----------Time 20:54:17---------- HTTP/1.1 200 OK Date: Sun, 6 Jun 2010 19:33:17 GMT Server: Apache Content-Length: 51 Keep-Alive: timeout=300, max=636 I need to get the date from the filename 20100618 and the time from 20:54:17. Is it possible to split the timestamp recognition precedence into two components? I know it may seem easier to get it from the line "Date: Sun, 6 Jun 2010 19:33:17 GMT", but this line does not exist in all the lines - and the only reliable place is to get the date from the filename as well as the header "----------Time 20:54:17----------" Right now I have a props.conf that shows: TIME_PREFIX = ^----------Time TIME_FORMAT = %H:%M:%S Time extraction is working fine, but I am getting some random dates which I am not sure why this is happening. Thanks for any suggestions. ... View more

Hello guys, I have a sample log that looks like this: DATE, TIME, LOGIN, IP_ADDRESS, USERID, EMPLOYEE_ID, WORKSTATION 2010-04-15 22:08:27 LOGON 10.1.2.221 X555555 55555555 pc30200.company.com 2010-04-15 23:07:05 LOGON 10.1.2.243 X111111 11111111 pc34460.company.com 2010-04-16 23:04:51 LOGON 10.1.2.196 X333333 33333333 pc35555.company.com 2010-04-16 22:49:21 LOGON 10.1.2.243 X222222 22222222 pc34460.company.com 2010-04-17 23:22:13 LOGON 10.1.1.243 X111111 11111111 pc34460.company.com 2010-04-17 23:08:03 LOGON 10.1.1.243 X222222 22222222 pc34460.company.com 2010-04-17 23:35:51 LOGON 10.1.2.160 X662420 33333333 pc31180.company.com 2010-04-17 23:36:14 LOGON 10.1.2.159 X662420 33333333 pc33333.company.com 2010-04-17 23:43:52 LOGON 10.1.2.159 X662420 33333333 pc33333.company.com 2010-04-18 23:35:51 LOGON 10.1.2.160 X662420 33333333 pc31180.company.com 2010-04-18 23:46:14 LOGON 10.1.2.160 X111111 11111111 pc31180.company.com 2010-04-18 23:58:52 LOGON 10.1.2.160 X662420 33333333 pc31180.company.com 2010-04-19 08:43:52 LOGON 10.1.2.160 X662420 88888888 pc31180.company.com I am trying to detect the person who is doing some suspicious behavior on a workstation. They log into a workstation, then log in as someone else within an hour and log back as them self. I can get the first part of the problem with the following command: sourcetype="this_log_file" | transaction maxspan=1h workstation_ip | search linecount >= 3 2010-04-18 23:35:51 LOGON 10.1.2.160 X662420 33333333 pc31180.company.com 2010-04-18 23:46:14 LOGON 10.1.2.160 X111111 11111111 pc31180.company.com 2010-04-18 23:58:52 LOGON 10.1.2.160 X662420 33333333 pc31180.company.com Here is my problem I need to check that the first person logs into the workstation is also the last. I need to be able to grab the first value and last value and substitute this in to the transaction query with startswith and endswith, see below. (unless there is a better way) sourcetype="file_withdata" | transaction maxspan=1h workstation_ip | transaction startswith=(employee_id=33333333) endswith=(employee_id=33333333) employee_id | search linecount >= 3 I am having problems substituting the 33333333 with the values returned from first line of the transaction. Any thoughts? I think this problem is a standard problem when detecting workstation sharing Thanks in advance PS Another question, as well to be able to return this transaction if the second person has not performed a logon for the whole day as well. ... View more

Hello all, I have the latest Windows App (June 16 2010) downloaded from Splunkbase.com running on Splunk 4.1.3 under Windows 7 32-bit. I noticed that the IE 8 browser will frequently complain about Javascript errors - "Errors on this webpage might cause it to work incorrectly". The error message is something like: "Message: Unspecified error Line: 56 Char: 17 Code: 0 URI: http://127.0.0.1:8000/en-US/static/@80534/js/splunk.jquery.csrf_protection.js Seems like Firefox 3.6.6 works better without throwing the results. Not sure if anybody out there can confirm my findings as well. ... View more

Hello guys, I am estimating to receive firewall events of ~200K EPS from 10 core firewalls. My initial thoughts are that if I am to point all 10 firewalls to a single Forwarder, the software performance may not be able to handle such high volume streams. Are there any benchmark figures on the typical performance of a Forwarder, e.g a single forwarder can handle up to 30K EPS, then I will need about 7 Forwarders at the frontend to handle the load before sending them via round-robin fashion to the backend Indexers. Thanks. ... View more