SplunkTalk – #48 – You’ve been boned

An episode about BBQ? A risqué’ title? Nawwwww! While today’s episode does cover a bit of Splunk lore regarding a certain “bone” that has made its way around Splunk’s offices for a number of years–today’s questions center around creating a repeating REGEX that will extract fields out of a multiline event as they appear a variable number of times. (WOW — All that in one breath!!). Wilde has a question for Maverick about how to calculate accumulating statistics in search results using streamstats and eventstats. We’ve also learned that Splunker Vincent Bumgarner coded up a JDBC database query data input available on SplunkBase that will let you scrape info out of a database and eat it with Splunk! Wilde has discovered that “splunk add oneshot” now has a “rename-source” option. Check it out baby!!

Episodes are recorded live every Friday at 11AM Central Time – Email us at to ask questions and have them answered on air!

Enjoy Listening!

Michael Wilde

Posted by