I modified the regex a little so that it will take less steps to find the match. This is the regex: ^"[\d\/\s\:]+-\s+(?<name>[\w\s]+) https://regex101.com/r/70N4wf/3 ... View more

If you're using latest version of splunk (6.6.x & 7.x.x), there is an option to set this from web under "Settings >> Server settings (under system) >> Search preferences". ... View more

Hi @saadi381, That is the syslog header added by syslog server for every event. If you want to extract the second timestamp (Oct 19 02:02:23), configure the props.conf as below: [sourcetype] TIME_PREFIX = j01ftc\s TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 If you want to completely remove the syslog header from events then, configure the props.conf as below: [sourcetype] SEDCMD-dropSyslogHeader = s/(^[\w\s\:]+j01ftc\s)//g TIME_PREFIX = ^ TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 15 I would suggest using 1st props.conf as it is much simpler. HTH! ... View more

I don't think changing props.conf will help. If we think this through, you were using v4.8.4 for which sourcetype is WinEventLog://<application>|<System>|<Security> then, the latest version for which all sources (app, sys, sec) are assigned one sourcetype WinEventLog then rolled back to v4.8.4. So, you're having a mixture of old and new sourcetypes for the events. My suggestion is continue searching on source="WinEventLog:Security" in searches or reports or locate and modify savedseaches.conf (all your searches and reports and alerts are saved in this file) to include * in sourcetype name inside searches. Note: You might not find savedsearches.conf for some add-ons. ... View more

The regex will not work if you do not specify a name for your name capturing group (?<>) . Have a look at both the links below and you will see the difference. Working regex: https://regex101.com/r/kLoHpn/1 Non-working regex: https://regex101.com/r/8bg9sI/1 ... View more

Ah, got it. Thanks for the clarification. Have a look at "maciep's" answer in the below link and see if it something that will meet your requirement. If you've already tried that approach, then pls let me know what are the issues you're facing. https://answers.splunk.com/answers/607304/sending-perfmon-data-to-metrics-index.html ... View more

@shubhambhagat02, Renjith.nair's solution should work according to the sample you provided. I slightly modified the regex so that it will take less steps to find the match. Add this to your search: your search | rex field=_raw "imqdb(?<MY_NUMBER>\d+)" | table MY_NUMBER ... View more

Hi there, are you using the app built by splunk1 to collect perfmon data from windows? Also, have a look at splunk docs on perfmon2 to get some more insights. HTH! ... View more

Try this: your base search | rex field=_raw "(?<src>\d+\.\d+\.\d+\.\d+).+\]\s\"(?<http_method>\w+)\s(?<uri_path>\S+)\s(?<uri_query>\S+)\"\s(?<status>\d+)\s(?<bytes>[\d-]+)" Updated regex https://regex101.com/r/CpQ56P/2 ... View more

Can you provide some sample events and let us know your expected output. ... View more

Hi, Can you try below search. This search extracts the ip address in ${http.headers.ClientSide} field with new field name ClientSide index="axway" source="group-6_instance-9.log" | rex field=_raw "ClientSide\}\:\s(?<ClientSide>[\d\.]+)" | table ClinetSide ... View more

Hi, assuming file name field is extracted, you can group events by "filename" field using transaction command. Have a look at docs and see if it meets your requirement. ... View more

Hi, You can assign a sourcetype name to whatever name you'd like. Can you see if below inputs.conf works for you, [monitor:///pathToLogs/*/fixedPath/logForSourcetype1*.log] host_segment = 2 sourcetype = logForSourcetype1 index = your_index [monitor:///pathToLogs/*/fixedPath/logForSourcetype2*.log] host_segment = 2 sourcetype = logForSourcetype2 index = your_index ... View more

That is because there is - in plugin name and regex is not asked to match it. I updated regex in my answer above. Try it out. On a side note: I added (?i) - case insensitive flag for is unaccounted for string because in the example above you had lowercase and in the question above, you had uppercase. Adjust regex as required. ... View more

Have a look at your input status to see if UF is reading the file, use this rest api http://<your_UF_hostname>:8089/services/admin/inputstatus . Additionally, what does your outputs.conf say? ... View more

Both ways works. Easiest is to create a new props.conf and copy the configs over, save and restart splunk. ... View more

Try this props.conf: [web_config] LINE_BREAKER = ([\r\n]+)\s?\<section\sname\= SHOULD_LINEMERGE = false KV_MODE = xml DATETIME_CONFIG = NONE # "NONE" will leave the event time set to whatever time was selected by the input layer, since there is no timestamp in the events Note: It is difficult to ingest only some part of the data in file. I am not saying it is impossible but if having few extra lines doesn't hurt you, then ingest the whole file. Place this on both UF and your standalone server and restart splunk. Let me know how it goes. ... View more

If "DISABLE" is the keyword that need to be ignored, then specify this before the hour field. Like, index=idx END NOT "DISABLE" | where hour>00 . If this is not what you're looking for, then please provide sample events which has these keywords. ... View more

If the configurations are effecting index-time (the way splunk index data) operations, then restart is required. If configurations are effecting search-time operations, then you can perform debug refresh as suggested by @harsmarvania57. Please refer to this doc for more details. ... View more

Ah, gotcha. Can you provide sample data so that I can give you basic props.conf structure. If your file looks similar to below web.config (.NET) file, then this is how your inputs.conf and props.conf should be. If you can explain a little more about your architecture, then I can tell you what all places should these configurations go. inputs.conf: ## Non-windows [monitor:///path_to_file/web.config] index=myidx sourcetype=web_config ## Windows [monitor://C:\path\to\file\web.config] index=myidx sourcetype=web_config props.conf: [web_config] LINE_BREAKER = ([\r\n]+)\<\?xml\sversion\= SHOULD_LINEMERGE = false KV_MODE = xml Sample data: <?xml version="1.0"?> <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"> <appSettings/> <connectionStrings/> <system.web> <compilation debug="false"/> <authentication mode="Windows"/> <customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm"> <error statusCode="403" redirect="NoAccess.htm"/> <error statusCode="404" redirect="FileNotFound.htm"/> </customErrors> </system.web> </configuration> ... View more

I guess, you should add all indexers to the Splunk enterprise instance which hosts your MC. You can do it via the server which contains the Monitoring Console UI Main Splunk -> Settings -> Distributed search » Search peers and add/authenticate your indexers which are missing Then in the MC, Settings -> Distributed -> Apply Changes (Ensure all the indexers are in the list below and roles are correct) Refer to this doc for more details on how to activate distributed search. ... View more

I am little confused, Do you want to break events at <audit> tag? This will give you many single line events like <audit> <cve>CVE-1</cve> </audit> , <audit> <cve>CVE-2</cve> </audit> . OR do you want to extract values of <cve> between audit tags? Please explain further if I misinterpreted your question. ... View more