...pache access log, but with a few more fields at the start of each log line. When I simply clone the access-extractionstransform, make no modifications except for changing the Name field, it kicks b...
...cross, but in vain. Even the documentation isn't clear enough with examples. I am able to extract the fields in the search (using spath and specifying tags paths), but that is not what I want. I want to h...
...s always "encore". To cheekily resolve that, I tried to alias on the heavy forwarder the sensor field to source (in the estreamer TA), and also on the search head thusly:
FIELDALIAS-e...
Good afternoon,
I have some syslog data coming into splunk. I am trying to write the props and transforms to add the fieldextractions and want to make sure I am doing it the best way.
Q...
Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
...mport, I'm extracting the hostname from the event using props.conf and transforms.conf
write it to metadata:host.
props.conf:
[collectd]
TIME_PREFIX = ^.+\..+\..+\s.+\s
TRANSFORMS-mask= mask-c...
...lace doesn't follow this paradigm. We especially have a lot of DELIMS/FIELDS-based fieldextractions, and I'm not clear on where we stand with these, especially since there's no obvious way to configure...
...EF data for CIM compliance, too.
My problem is the same with all Add-on: neither handle the custom labels/fields as I except:
cn2 = 4
cn2Label = TaskNewState
cs2 = 1093
cs2Label = P...
All,
I run this search -
index=main | makemv PCIDSS delim=","
I'd like to be automatically expanded instead. But I don't see how I would do this in props.conf