...pache access log, but with a few more fields at the start of each log line. When I simply clone the access-extractionstransform, make no modifications except for changing the Name field, it kicks b...
...cross, but in vain. Even the documentation isn't clear enough with examples. I am able to extract the fields in the search (using spath and specifying tags paths), but that is not what I want. I want to h...
Good afternoon,
I have some syslog data coming into splunk. I am trying to write the props and transforms to add the fieldextractions and want to make sure I am doing it the best way.
Q...
...mport, I'm extracting the hostname from the event using props.conf and transforms.conf
write it to metadata:host.
props.conf:
[collectd]
TIME_PREFIX = ^.+\..+\..+\s.+\s
TRANSFORMS-mask= mask-c...
Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
...s always "encore". To cheekily resolve that, I tried to alias on the heavy forwarder the sensor field to source (in the estreamer TA), and also on the search head thusly:
FIELDALIAS-e...
...lace doesn't follow this paradigm. We especially have a lot of DELIMS/FIELDS-based fieldextractions, and I'm not clear on where we stand with these, especially since there's no obvious way to configure...
All,
I run this search -
index=main | makemv PCIDSS delim=","
I'd like to be automatically expanded instead. But I don't see how I would do this in props.conf
...o those other inputs and correctly apply fieldextractions, transforms, etc? Currently the log events are just one big fieldwith a timestamp when they come from AWS