...vent timestamp is correctly set to the date contained in the date fieldof the JSON object.
- Unexpectedly, all extracted fields are multi valued, with exactly two copies of the correct value p...
Hello,
I cannot configuremultivaluefieldextraction. I have a following event. the last 4 lines Time Stamp and Message shall be extracted as separate values togather with value following t...
I am trying to extractfields for OpenDNS logs.
These come in a CSV format:
"2015-01-01 20:39:57","client1","client1,site1","1.1.1.1","2.2.2.2","Allowed","1 (A)","NOERROR","www.google.com....
...B)" latest(Size) as "Capacity (MB)" by ip DeviceID
| sort limit=10 -"Disk Space Available (MB)"
| rename ip as IP DeviceID as "Device ID"
I would like to know if I can write fieldextractions f...
Hi
I don't know what I am doing wrong. I am try to extract a multivaluefield, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
All,
I run this search -
index=main | makemv PCIDSS delim=","
I'd like to be automatically expanded instead. But I don't see how I would do this in props.conf
...o register the first fieldextraction in the first line of above statements, but am unsure on how to add the subsequent statements to splunk so they are available to all users as fields when writing q...
...s a multivaluefieldwith the value duplicated. When I try the same search using the Duo app instead of "Searching and reporting", the fields are extracted only once as expected, not duplicated. For e...
Hi As I see many documents and comments here, Universal forwarder do not break line. with "LINE_BREAKER" in props.conf. It is the role of Indexer. This is what I am understanding. But I t...