...vent timestamp is correctly set to the date contained in the date fieldof the JSON object.
- Unexpectedly, all extracted fields are multi valued, with exactly two copies of the correct value p...
Hello,
I cannot configuremultivaluefieldextraction. I have a following event. the last 4 lines Time Stamp and Message shall be extracted as separate values togather with value following t...
I am trying to extractfields for OpenDNS logs.
These come in a CSV format:
"2015-01-01 20:39:57","client1","client1,site1","1.1.1.1","2.2.2.2","Allowed","1 (A)","NOERROR","www.google.com....
...B)" latest(Size) as "Capacity (MB)" by ip DeviceID
| sort limit=10 -"Disk Space Available (MB)"
| rename ip as IP DeviceID as "Device ID"
I would like to know if I can write fieldextractions f...
Hi
I don't know what I am doing wrong. I am try to extract a multivaluefield, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
I need to extractmultivalues from a fieldwith the following value format: role1, role2, some role3
The problem is that there are spaces after the commas.
I was able to do it successfully u...
All,
I run this search -
index=main | makemv PCIDSS delim=","
I'd like to be automatically expanded instead. But I don't see how I would do this in props.conf
...ow to register the first fieldextraction in the first line of above statements, but am unsure on how to add the subsequent statements to splunk so they are available to all users as fields when w...
Hi As I see many documents and comments here, Universal forwarder do not break line. with "LINE_BREAKER" in props.conf. It is the role of Indexer. This is what I am understanding. But I t...
Hi,
while data parsing i'm using the delimiter section to parse my data at that time i get the error
when i try to extract the same log using the "Regular" option i get the f...