Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gsawyer1
gsawyer1
Engager
Member since:
08-20-2010
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-20-2010 |
Activity Feed
- Karma Re: Regex help with Search time field extractions from syslog source for emiller42. 06-05-2020 12:46 AM
- Posted Re: I am getting search error "HttpListener...sent a 0 byte response after earlier claiming a Content-Length of 641!"? on Splunk Search. 12-11-2015 07:10 AM
- Posted How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? on Splunk Search. 10-07-2015 01:40 PM
- Tagged How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? on Splunk Search. 10-07-2015 01:40 PM
- Tagged How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? on Splunk Search. 10-07-2015 01:40 PM
- Tagged How to create a stacked column chart with count(_time) split by index (_internal, main) for each host? on Splunk Search. 10-07-2015 01:40 PM
- Posted Re: How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table? on Splunk Search. 09-15-2015 07:24 AM
- Posted How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table? on Splunk Search. 09-15-2015 06:59 AM
- Tagged How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table? on Splunk Search. 09-15-2015 06:59 AM
- Tagged How to only extract fields from Windows Security Event Log 4738 that have actual deltas to display in a table? on Splunk Search. 09-15-2015 06:59 AM
- Posted Re: How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-24-2014 06:14 AM
- Posted Re: How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-23-2014 12:28 PM
- Posted Re: How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-23-2014 12:25 PM
- Posted How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-23-2014 09:32 AM
- Tagged How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-23-2014 09:32 AM
- Tagged How to write regex to extract multiple email addresses into one field where each email is followed by an IP address? on Splunk Search. 09-23-2014 09:32 AM
- Posted Re: regex field extraction; same source, variably different fields on Splunk Search. 01-02-2014 01:05 PM
- Posted Re: regex field extraction; same source, variably different fields on Splunk Search. 01-02-2014 01:02 PM
- Posted regex field extraction; same source, variably different fields on Splunk Search. 12-30-2013 12:38 PM
- Tagged regex field extraction; same source, variably different fields on Splunk Search. 12-30-2013 12:38 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-24-2023
09:15 AM
Look at the dates 🙂 You're responding to an almost 8-years old thread regarding a 6.x Splunk version. I wouldn't expect a reasonable response here.
... View more
10-07-2015
02:06 PM
It is easy if you use chart instead stats :
index=_internal OR index=main | chart count over host by index
The key difference is that this turns one set of field values into columns instead of rows.
... View more
09-15-2015
07:57 AM
Well, if the only time you don't want a field indexed is when it just has the "-", then using a SED script to ignore any fields with a value of '-' would be conditional. It would only eliminate the fields when they have a dash, and index them whenever the SED script filter doesn' t match.
Though, keep in mind that my intent on my issue was just to completely not index the fields I didn't want, not just to filter the search results.
... View more
09-24-2014
06:14 AM
This gives me the same issue again. I think I get what you suggested...perform another regex on the "DataPortion" field after it has been extracted. But all this gave me was the same data - the first address and IP address only. I still think I need to make the regex greedy enough to just capture all of the email addresses, from the first one to any others that follow, to the end of the event - although the regex you suggest will help afterwards, once I have the capture, to strip the IP address off of the "DataPortion" field, which I actually won't need.....
... View more
01-02-2014
01:21 PM
[sourcetype::mysource] is not valid. You need to specify either
[mysourcetypename]
or
[source::/pathto/mysource]
... View more
10-17-2013
07:06 AM
5.0.5, actually. Thanks
... View more
10-25-2013
04:33 PM
1 Karma
UPDATE splunk 6.*
Since this version you can actually specify a list or range of eventCodes to exclude at the forwarder level, in inputs.conf. It will reduce the volume at the forwarder level and reduce the network load.
see
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
example:
[WinEventLog:Security]
disabled = 0
blacklist=566,800-850
... View more
11-09-2012
10:12 AM
Null queuing happens at parse time via TRANSFORMS. REPORTs occur too late for null queueing.
Your TRANSFORMS rule will have to use a regex to find the values you've specified (e.g. value1, value2, value3), but without the benefit of "field=" (unless that also appears in the data).
... View more
11-09-2012
07:14 AM
When I used the regex(s) in transforms, I had to put quotes around each comma. Not so when I used the rex command in Search. I also had to change a couple more "\w+" to ".*?" to capture all of the data to their fields.
Either way, thanks to both Rob and emiller42 for their help. It felt good when things started working....
Thanks!! I have a follow-on question I am posting right now, called, "Subsequent transform of an extracted field?" if anyone wants to help....
... View more
01-23-2013
09:09 AM
"what if you are trying to send the Indexer's logs to other indexers, for redundancy?" That's our need; we send our logs to more than one indexer. What other method do you suggest, especially when dealing with Windows Event logs.
... View more
09-28-2010
05:07 AM
Well, to clarify, it is possible and feasible to not use SSL/OpenSSL in Splunk. All you have to do is set useSplunkdSSL to false (and not use it for other web ports). It is going to be used for some internal checks like validating trusted certs in distributed search and encrypting/decrypting hashes, but this doesn't expose OpenSSL to the outside.
... View more
09-02-2010
06:18 PM
The TCP Resets are showing up in the Splunkd.log file on the indexer, for each connection made to it by a forwarder. Also showing up on the splunkd.log file on the forwarder. A connection is opened to the indexer, and then immediately reset by the forwarder.
... View more
08-26-2010
05:18 PM
2 Karma
No you can not, but you can specify a DNS name that might point to a load-balanced/failover set of AD/LDAP servers.
For example, AD domains are often set up such that the AD domain domainname.company.com resolves to list of available DCs for that domain.
... View more
09-08-2010
01:19 PM
Does the account you are running Splunk under have sufficient privileges to access the Windows event logs in question?
... View more
08-24-2010
03:17 PM
So then what is the recommended method for ingesting evtx files from Windows 2008? Also, when I enable and configure the Windows App to monitor my event logs, on both 2003 and 2008 servers, nothing is getting ingested. I verified that my account has full control over the Splunk installation directory. I am now manually entering the Windows stanzas in the inputs.conf file....
... View more
