Hi,
I've recently noticed the recommendations the move to search-time versus index-time fieldextractions. I'm trying to get an idea of exactly how much of the configuration that we've got in p...
Hello All
My current environment is as follows :
Syslog/UF (Universal Forwarder) -> HF (Heavy Forwarder) -> Indexers
I am trying to perform an indexed time fieldextraction so that p...
I need help indexing CSV files.
I have read this, http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Propsconf
My props.conf
[test_csv]
INDEXED_EXTRACTIONS = CSV
FIELD...
We use a custom format for our Apache access logs. Long ago, I put together a regex to extract the fields from the custom format. At that time, I set it up as a fieldextraction on the indexer....
I'm using indexedfieldextraction to ingest JSON data over the HTTP Event Collector.
It works great. Except, once the event is > 10k bytes, the fields within the JSON are not indexed a...
...orrectly as JSON. The current fields back I'm getting are these:
I've exhausted everything I know about how the configuration/fieldextraction is determined and I still can't figure it out. I...
...dd_app_env
[add_env_field]
TRANSFORMS-env = add_app_env
fields.conf
[add_app_env]
INDEXED=true
But I do not get my app and env fields and I have no idea how to debug this other than trial and e...
We used the rest receivers simple api to send a body with some fields to index as a urlencoded form. Among these there is a field time field containing a timestamp. We configure the sourcetype as i...
We are trying to index a psv file into Splunk with sourcetype as "psv", but its not extracting fields from the PSV's first row. Can you please provide the config to add fields as psv header/first r...
Hello All, I have faced interesting issue. I have an ingest time extraction. [extract] REGEX = ^([^\r\n]+)$ FORMAT = message::$1 DEST_KEY = _raw Truncation not the case, I set it to zero a...