Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
10,000 results
Sort by:
11-16-2023
10:59 PM
...he extra contents) doesn't work. I also tried to setup a priority using the props.conf "priority" option with no luck. I also tried to use source for the first stanza because source usually has an h...
Labels
- Labels:
-
props.conf
Show results in replies (7)
-
Hi at all, new failed test: I also tried to use transforms.conf instead of SEDCMD in props...
-
...vent-cutting ones). props.conf: [test_sourcetype_to_recast] #Order of transform classes i crucial! Y...
-
...he issue I suppose that's in the precedence on events in the activities listed in the props.conf. C...
-
...his means that props.conf matching on host or source will incorrectly be applied a second time. S...
-
...nderstand, you hint a props.conf like the following: [logstash] # set host TRANSFORMS-sethost = s...
-
Hi @PickleRick , there's still something wrong: I used this props.conf: [logstash] T...
-
OK. Look at this: props.conf: [test_sourcetype_to_recast] #Order of transform classes i c...
10-02-2023
07:09 PM
Hello comrades, After my poor research, I found that only heavy forwarder supports props.conf, but it was like 5 or 6 years old posts. I wonder that UF could now support props.conf? Also how do I u...
Labels
Show results in replies (4)
-
yep, the props.conf on the UF is very very limited. SEDCMD on props.conf is only for HF or i...
-
>>> 1. Document mentioned that I have to create props.conf in /opt/splunk/deployment.apps...
-
Sorry for trouble, As I named myself... 1. Document mentioned that I have to create props.conf i...
-
Hi @BoldKnowsNothin ... the UF, still supports, only very limited props.conf tasks.&n...
07-21-2023
02:27 AM
how can i in the props.conf file tell Splunk to take the second timestamp as opposed to the first
Labels
- Labels:
-
props.conf
-
transforms.conf
11-18-2021
03:07 AM
Not working SEDCMD in my props.conf /opt/splunk/etc/system/local/props.conf [ActiveDirectory] SEDCMD-mask_ms_pwd = s/(ms-Mcs-AdmPwd\s*=)\s*.*/ms-Mcs-AdmPwd=*******/ &n...
Labels
Show results in replies (4)
-
You can deploy a props.conf configuration utilising “SEDCMD” and have it apply to the sourcetype “A...
-
indexer /opt/splunk/etc/system/local/props.conf Yes. I restarted every time I c...
-
Where are you putting the props.conf file? It must be on the indexers and, if you have t...
-
...bsp; props.conf [ActiveDirectory] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-a...
07-07-2019
12:53 PM
what is the expected impact of increasing the value for TRUNCATE, the log reception upper limit setting value that can be defined in the indexer props.conf.
Also, is there any problem cases with T...
06-14-2019
06:24 AM
Hi All,
can anyone help us to figure out magic six for the below sample log?
SHOULD_LINEMERGE=
LINE_BREAKER=
MAX_TIMESTAMP_LOOKAHEAD=
TIME_PREFIX=
TRUNCATE=
TIME_FORMAT=
VersionNum...
- Tags:
- splunk-enterprise
02-08-2023
11:16 AM
...ntire contents of my props.conf file:
[xxx:xxx:audit:xml] MUST_BREAK_AFTER = \</AuditMessage\> KV_MODE = xml LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = t...
- Tags:
- parsing
- props.conf
Labels
- Labels:
-
field extraction
-
fields
-
other
08-17-2024
03:53 PM
Hello,
I have events with epoch time. How can I extract epoch time in human readable format using props.conf. My props.conf file is provided below:
[myprops]
SHUOLD_LINEMERGE=false
L...
- Tags:
- epoch time
Labels
- Labels:
-
other
08-27-2023
08:13 PM
Hello, I have some issues with the TIME_FORMAT field in props.conf file, getting some error messages "Failed to parse timestamp, defaulting to file modtime" . My pprops.conf file and a couple of s...
- Tags:
- timestamp in props
Labels
- Labels:
-
other
01-02-2024
07:17 AM
I've read the documentation for inline field extractions and I don't see what I'm doing wrong here. I've added a props.conf file to my test app with the following: [emm_syslog]
LINE_BREAKER = ([\r\n...
Labels
- Labels:
-
configuration
-
troubleshooting
