...)while DNS logs are only maintained for 1 year ( retention = 1 ).
Everything I have read regarding creating customfieldsatindextime go back to using regex and extracting an existing field i...
...his being said, other documentation at http://www.splunk.com/base/Splexicon:Transform says:
Transforms are always involved in the
setup of customindex-timefield
extractions.
Can s...
I am trying to extract some json data atindextime. I have found the article about using regular expressions to createcustomfields but regex is not well suited to extracting json. I understand t...
...ith any events created by any inputs that use my TA.
I've read the "Createcustomfieldsatindextime" Docs page (http://docs.splunk.com/Documentation/Splunk/latest/Data/Configureindex-time...
Hi All,
We have some indexes that have suddenly stopped indexing the customfields we had configured on our logs.
There were some changes made to create a new deployment app at the time the p...
...owever, for the last 24h (with about 15M events), the timechart commands takes forever. I observed the following behaviour:
This search...
index="myindex"
| fields ip
| timechart span=10m count(_...
...extractor to createfields. SEARCH: index=INDEX sourcetype=INDEX_LOG "call failed: Unable to connect to server '*'"
Field Example: create a field called: "Unable to connect to server" and w...
I have a CSV file that I would like to index one time only. There are two fields (Date, Time) that I want to be able to use as _time so that I can create a correlation of avg/median response times w...
...egexpal.com/ . Is this a scenario where I would need to create a customfieldatindextime?
The search I'd like to run would look for a particular type of request, look up its corresponding u...