topic Re: Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work in Splunk Search

Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work

tkashem — Thu, 30 Apr 2015 04:33:00 GMT

I am using a virtual index that points to AWS ELB logs in S3 bucket to run Splunk query. I have set this up using Hunk app in Splunk which uses an EMR cluster in Amazon to run the queries.

It seems Time capturing regex defined in virtual index never works. I see plenty of the following error in server logs.

04-30-2015 04:09:49.282 WARN  ERP.elb_log_provider -  VixTimeSpecifier - Could not match time regex="/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/*" against path="/AWSLogs//elasticloadbalancing/us-east-1/2015/04/18/_elasticloadbalancing_us-east-1__20150418T0055Z_.log"

Can anyone help me find out what's going on here?
Thanks in advance!

Re: Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work

rdagan_splunk — Wed, 06 May 2015 15:55:19 GMT

What is the indexes.conf file looks like (hunk/etc/apps/search/local/indexes.conf)?

Re: Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work

tkashem — Fri, 07 Aug 2015 20:22:05 GMT

Sorry for the delay - here is relevant parts of indexes.conf file -

vix.description = prod-elb
vix.input.1.accept = \.log$
vix.input.1.path = s3://foo/AWSLogs/...
vix.provider = development-cluster
vix.input.1.et.format = yyyyMMdd
vix.input.1.et.offset = 0
vix.input.1.et.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/
vix.input.1.lt.format = yyyyMMdd
vix.input.1.lt.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/
vix.input.1.lt.offset = 0

Re: Time capturing regex for virtual index that points to AWS ELB logs in s3 bucket does not work

rdagan_splunk — Fri, 07 Aug 2015 22:55:02 GMT

It looks like the regex requires a . before the Star (.*)
And vix.input.1.lt.offset = 86400