I am trying to use a filed in calculatedfields from props.conf to replace space in one of my field values but not getting any results in Splunk 6.2.
Below is EVAL stanza from props.conf -
E...
...ransform. I follow the same naming conventions for other normal field extractions with transforms and it works well.
props.conf
[sourcetype]
REPORT-IP = REPORT-IP
transforms.conf
[REPORT-IP]
F...
I have a field called File_Name that I've generate by trimming the filepath off of my source from a local data input.
The files are either XML or txt files but the names all follow the same f...
...o properly use props.conf and transforms.conf my only (or best) approach?
What if I want to retain the unique details “just-in-case” and don’t want it removed prior to indexing?
Apologies if m...
Hi,
I have this in my props.conf
[emailAlerts2]
EVAL-Application = if(match(_raw,"\<EcomLogEntry\>\nDate:\s+\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d-0400"),"MyApp",Application)
But I'm b...
Hi Guys, Would you know why does the Selected fields are missing after i enable this specific Calculatedfields ? And when i delete that calculatedfield the the default selected fields are s...
Hi
I have a .csv file without header but with fixed fields which i would like to send to my Splunk server with the universal forwarder on the according Linux host.
I understand that i need to configure...
Hi As I see many documents and comments here, Universal forwarder do not break line. with "LINE_BREAKER" in props.conf. It is the role of Indexer. This is what I am understanding. But I t...
...ttps://wiki.splunk.com/Community:HowIndexingWorks. But this doesn't tell where to configure inputs.conf exactly.
One more thing below configurations are already added in props.conf on universal f...