Hi! I have some different sourcetypes defined by me where I'm extracting some of the fields with stanzas in transforms.conf at search time (I'm using REPORT in props.conf). Here is one example of a stanza I'm using: REGEX=(?im)[\r\n]+([^\r\n]*name)\: ([^\r\n]+) FORMAT=$1::$2 MV_ADD=true This extracts the fields I want, but since I extract the field name like this, the field name may be in uppercase, lowercase or a combination. Creating new stanzas for each field is not an option since I have a lot of fields and most of my stanzas are of the form shown above, where I just define the ending of the field name, to be able to extract most of them. I wonder if there is any way to "force" the field names to lowercase? ... View more

Hi, I have events of the form ---- name ---- Drive: C: Free Space: 894.1 GB Total Space: 953.1 GB Drive: D: Free Space: 89.1 GB Total Space: 113.1 GB My events contain multiple drives with different names, which may have more attributes below "Total Space". There may also be drives without the space-attributes. I'm currently extracting Drive, Free_Space and Total_Space as three multivalued fields. My problem is that since each event have many drives, I need to know which values of Free_space and Total_Space that corresponds to which drive. I don't want to create separate events of the different drives.. I don't know how I should solve this, so if anyone have any suggestions please tell me! 🙂 ... View more

Hi all, I'm trying to set the timestamp for events from my source. My paths look like this: C:\Users\angeliga\Filer\336033\gelica_2013-03-06_13-48-45\Server\file_to_index.txt I have read some answers on this subject here at splunk-base and on some other places. The suggestions that I've come across are to copy datetime.xml and modify it (from this splunk-base answer), or to do it in transforms.conf (from this splunk-base answer) But I can't get it to work! It seems to me that the easiest way would be to use transforms.conf, but I can't figure out how to set the field correctly.. I've also followed the exmples on how to modify datetime.xml, but when it looks like below, I get no events of that my_src_type! To figure out if I did something wrong when editing datetime.xml, I tried to just copy (no editing) it into my local folder and then set DATETIME_CONFIG = /etc/system/local/datetime.xml but it doesn't matter, I still get no events of my_src_type... [my_src_type] DATETIME_CONFIG = /etc/system/local/datetime.xml other sourcetype stuff... I would also be able to extract the date, but I'm thinking that it would be the same approach? I hope someone can help me with this, it is very frustrating that I'm not able to make it work. ... View more

Hi, I'm a new Splunk user and I'm trying to define a new source type. My log file looks like: ----------- Name1 ----------- Info1.1: one info1.2: two ----------- Name2 ----------- Info2.1: one Info2.1: two two Info2.3: Three etc.. I want to have a sourcetype that breaks my file before every name, but the real names aren't as nicely formatted as the ones in my example, they often consist of multiple words and sometimes some special character as well. I manage to break before each --------- but then the names and the info gets separated. I also tried setting the LINE_BREAKER but then the pattern matching my regex is removed. I tried some different regexes, similar to (-{2,50}[^:]+-{2,50}[^:]+:) and (?<=--)([^-:]+)(?=--) but they don't work. It seems like the newlines aren't recognized correctly..? Does anyone have any idea of what I'm doing wrong? Thanks! ... View more