I have a setup with two dhcp servers, one Active and one hot-standby server (both running Windows 2012R2)
I have installed the Microsoft Windows DHCP Addon for splunk in my splunk environment and created below inputs.conf file
[monitor://C:\Windows\System32\dhcp] sourcetype = dhcp crcSalt = source alwaysOpenFile = 1 disabled = false whitelist = DhcpSrvLog* index=test-windows
[source::C:\Windows\System32\dhcp\DhcpSrvLog-Sat.log] TRANSFORMS-set= setnull,setparsing
[setnull] REGEX = (?i-s)^.*\bstandby\b.*\R DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX =. DEST_KEY=queue FORMAT=indexQueue
The goal I want to achieve is to not log the lines with "standby"...
I have tried to achieve the goal with above props.conf and transforms.conf, but I feel a bit ignored by my splunk 😉
below a small part of my test log from the passive (standby) server.
24,04/06/19,13:21:09,Database Cleanup Begin,,,,,0,6,,,,,,,,,0 25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0 25,04/06/19,13:21:09,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0 36,04/06/19,13:37:17,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0 36,04/06/19,13:38:45,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0 36,04/06/19,13:41:47,Packet dropped because of Client ID hash mismatch or standby server.,192.168.1.0,,00155DBE312E,,0,6,,,,,,,,,0
I feel i have done as described in the question "How do you exclude all lines with INFO or WARN from being indexed?" but I just can't get it to work.
Any help would be greatly appreciated.
This works but was not what i wanted
[dhcp] TRANSFORMS-dhcp_set= dhcp_set_parsing,dhcp_set_null
1. I do not understand why I can not use *[source::C:\Windows\System32\dhcp\DhcpSrvLog]* instead of [dhcp] ?*
2. Important to have *dhcpsetparsing** before dhcpsetnull as both are applied in the order they are written, correct ?*
[dhcp_set_null] #REGEX = (?i-s)^.*\bstandby\b.*\R REGEX = standby DEST_KEY = queue FORMAT = nullQueue [dhcp_set_parsing] REGEX =. DEST_KEY=queue FORMAT=indexQueue
3. is there a rule i have not found, that the stanzas used has to start with the sourcetype? as I can only make it work if i use the names dhcpsetXXX and not if I use only set_XXX ?
Would very much appreciate if anyone can explain 1,2 and 3, as I have spend far too much time trying to figure this, and still don't understand why all the examples I found was structured as my first attempt.
You are confusing the 2 examples on this page:
This is the difference:
1: When you are keeping only a few logs, you send them all to the nullQueue using
RegEx=. and then pull some of them back using
2: When you are trashing only a few logs, you send some of them to the nullQueue using
RegEx=<match some> and that's it.
What you were doing was sending some of them to the nullQueue but them pulling all of them back out! So your trash can was connected to your front door, accomplishing nothing. To fix it, simply remove all of your