Hi,
I've recently noticed the recommendations the move to search-time versus index-time fieldextractions. I'm trying to get an idea of exactly how much of the configuration that we've got in p...
Hello All
My current environment is as follows :
Syslog/UF (Universal Forwarder) -> HF (Heavy Forwarder) -> Indexers
I am trying to perform an indexed time fieldextraction so that p...
I need help indexing CSV files.
I have read this, http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Propsconf
My props.conf
[test_csv]
INDEXED_EXTRACTIONS = CSV
FIELD...
I'm using indexedfieldextraction to ingest JSON data over the HTTP Event Collector.
It works great. Except, once the event is > 10k bytes, the fields within the JSON are not indexed a...
We use a custom format for our Apache access logs. Long ago, I put together a regex to extract the fields from the custom format. At that time, I set it up as a fieldextraction on the indexer....
...orrectly as JSON. The current fields back I'm getting are these:
I've exhausted everything I know about how the configuration/fieldextraction is determined and I still can't figure it out. I...
We are trying to index a psv file into Splunk with sourcetype as "psv", but its not extracting fields from the PSV's first row. Can you please provide the config to add fields as psv header/first r...
...dd_app_env
[add_env_field]
TRANSFORMS-env = add_app_env
fields.conf
[add_app_env]
INDEXED=true
But I do not get my app and env fields and I have no idea how to debug this other than trial and e...
...ource type to feed a forwarder, which is all working fine.
One thing that surprised me a bit, is that without any configuration every k=v pair is automatically being extracted as a field. e.g. t...
Hello,
i want to extract a field on index-time extraction on search head (i know it's not the best idea), but I'm have some strange issues with it.
A new field should be indexed through c...