Hi all,
Splunk offers the possibility to customize the way we want data to be segmented in the index files with a regex, like for this timestamp :
segmenters.conf :
[seg_rule]
F...
I tried to segment the log below using \s but it does not work, even after modifying segmenters.conf and props.conf .
2020-05-13 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi...
...earch abc--xyz # works
TERM(abc--xyz) # doesn't work
TERM(abc*) # works
| tstats count by PREFIX(abc) # doesn't work for abc--xyz Both TERM and PREFIX work with other minor segmenters...
I have a field with multiple values that would normally be delimited by a comma:
Field=value1,value2,value3
In Splunk, the Field value will just show "value1".
I want to alter the log mes...
I have a field extraction that gets the message number from the raw message string
.{22}\s0-9
The message string is in the format of
2017-11-15T13:32:53,915 4790018 2999395531021...
Hello, I'm Splunk Newbie. This is a post that I found while looking for improvement of Splunk's search performance, but I'm asking you a question because it's a little confusing. I referred...
...esources are available. See the Troubleshooting Manual for more information.
I did some changes to distsearch.conf file, but the bundle is still over 3 GB in size.
This is the file stanza:
[r...
...nsertion and also field extraction configured for my events, may be there is some correlation.
sample data
configuration files (props,transforms,fields).conf