Hello, I have issues getting expected field value pairs using following props and transformsconfiguration files. Sample events and my configuration files are given below. Any recommendation will b...
...cross, but in vain. Even the documentation isn't clear enough with examples. I am able to extract the fields in the search (using spath and specifying tags paths), but that is not what I want. I want to h...
Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
...pache access log, but with a few more fields at the start of each log line. When I simply clone the access-extractionstransform, make no modifications except for changing the Name field, it kicks b...
Good afternoon,
I have some syslog data coming into splunk. I am trying to write the props and transforms to add the fieldextractions and want to make sure I am doing it the best way.
Q...
...mport, I'm extracting the hostname from the event using props.conf and transforms.conf
write it to metadata:host.
props.conf:
[collectd]
TIME_PREFIX = ^.+\..+\..+\s.+\s
TRANSFORMS-mask= mask-c...
...s always "encore". To cheekily resolve that, I tried to alias on the heavy forwarder the sensor field to source (in the estreamer TA), and also on the search head thusly:
FIELDALIAS-e...
...ORMAT = \"addressLine1\":\"100 Unknown Rd.\" DEST_KEY = _raw Found docs, looking at them now: Configureadvancedextractionswithfieldtransforms - Splunk Documentation Can I get someone point o...
...lace doesn't follow this paradigm. We especially have a lot of DELIMS/FIELDS-based fieldextractions, and I'm not clear on where we stand with these, especially since there's no obvious way to configure...
All,
I run this search -
index=main | makemv PCIDSS delim=","
I'd like to be automatically expanded instead. But I don't see how I would do this in props.conf