Hi guys, How to extract one portion of the data model when I have the name of the field. Sample: field: status, with the following values: teste\teste1\teste2;teste\teste3\teste4;teste\teste5\teste6 How do I extract the last value in each line? Thanks ... View more

Hi guys, I'm having a issues with a log data file in the following format (JSON): {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 250, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 100, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 250, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 700, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 240, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 100, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 600, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 950, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 190, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} The Splunk only recognizes the file as a unique line. What do I do ? Rafael Martins ... View more

Hi guys, I'll appreciate your help for my question. Well, I have a data file that has ten fields and I need cut only two and only two fields can be indexed. What do I do ? Thanks! Rafael Martins ... View more

Hy guys, I have files in the format access_combined_wcookie, the last field called "other", has informations that are importants for business and us (IT). How to extract the information this field using the format access_combined_wcookie(known by default by splunk) and use regex directly in the files props.conf e transforms.conf ? Follow one line of the file of the log. 186.241.214.128 - - [28/Nov/2013:02:09:24 +0000] "GET /127.0.0.1/_files/local/defaultTheme/img/image.png HTTP/1.1" 200 3288 "-" "Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0" "-" "other_1234|xxxxxx:xxxxxx|yyyyyy:yyyyyy" ... View more

Hi guys, I did the following configuration in props.conf in the splunk: C:\Program Files\Splunk\etc\system\local [sctmainframe] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false pulldown_type = 1 REPORT-myname = mainframe-extract And in the transforms.conf file too [mainframe-extract] EXTRACT = (?<INSTCLI>\d{3})(?<BANCOCLI>\d{3})(?<AGENCLI>\d{4}) The sourcetype "sctmainframe" appear for me as a new sourcetype into the administrator splunk web, but don't work correctly. What I'm doing of the wrong ? ... View more

Hi guys, I have a file that contains blocks of data that are positionals, they have the size of fields Folloowing sample: For the first field, the position could be the first byte with size of 3 positions and each fields following have a rule specific. 0083410001049703K ARQB4_B8E4_07 000000TESTENT 2513145609235200000000000000 CP000000000000WW How to create a source type for this ? ... View more