Good afternoon,
I have some syslog data coming into splunk. I am trying to write the props and transforms to add the fieldextractions and want to make sure I am doing it the best way.
Q...
...cross, but in vain. Even the documentation isn't clear enough with examples. I am able to extract the fields in the search (using spath and specifying tags paths), but that is not what I want. I want to h...
Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num . I tested it in the search app and it worked correctly. This is what I got:
props.conf:
[J...
...mport, I'm extracting the hostname from the event using props.conf and transforms.conf
write it to metadata:host.
props.conf:
[collectd]
TIME_PREFIX = ^.+\..+\..+\s.+\s
TRANSFORMS-mask= mask-c...
...As an example when i am writing the query
sourcetype=TARGET_ONE | table "Fname"
its retuning nothing.but field has been extracted.
Do i need modify regex in transform.conf??
can a...
Hello,
I am attempting to figure out a regex for a transforms.conf for a field named Call Reason
Example data looks like this
A - Call plan question
B - Data plan question
C - Cellular t...
Hello, How would I implement inline or Uses TransformFieldextraction (please see screenshot below) for following event (please see sample event below). Any help will be highly appreciated, thank y...
...hen use a different regex for the final uri extract. For example:
[source::/var/log/SomeSourceTypeA-web.log]
KV_MODE=none
REPORT-webservice-extractions-SomeSourceTypeA = SomeSourceTypeA-base-extract...
Hello, I was using Transform type FieldExtraction, I have an issue to select my Delimiter and facing some errors (not extracting fields as expected). Please see below the Raw Event and the p...
I am walking through the Cisco app and I noticed that there are a lot different ways fields are being extracted. It looks like there are many inline extractions and others referencing a transform, a...