Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About klychnikov
klychnikov
Explorer
Member since:
11-06-2012
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 11-06-2012 |
Activity Feed
- Karma Re: Indexing Kaspersky Logs for miteshvohra. 06-05-2020 12:46 AM
- Got Karma for Re: Indexing Kaspersky Logs. 06-05-2020 12:46 AM
- Posted Re: not work transforms on Getting Data In. 12-13-2012 01:24 AM
- Posted Re: not work transforms on Getting Data In. 12-13-2012 01:04 AM
- Posted Re: not work transforms on Getting Data In. 12-13-2012 12:41 AM
- Posted not work transforms on Getting Data In. 12-10-2012 04:40 AM
- Tagged not work transforms on Getting Data In. 12-10-2012 04:40 AM
- Posted Re: xml convert csv on Splunk Search. 12-06-2012 11:39 PM
- Posted Re: xml convert csv on Splunk Search. 12-06-2012 11:37 PM
- Posted xml convert csv on Splunk Search. 12-06-2012 07:47 AM
- Tagged xml convert csv on Splunk Search. 12-06-2012 07:47 AM
- Posted fschange not indicate a folder for the local machine on Getting Data In. 11-15-2012 05:51 AM
- Tagged fschange not indicate a folder for the local machine on Getting Data In. 11-15-2012 05:51 AM
- Posted Re: Indexing Kaspersky Logs on Getting Data In. 11-06-2012 05:23 AM
- Posted Re: Indexing Kaspersky Logs on Getting Data In. 11-06-2012 05:22 AM
- Posted Re: Indexing Kaspersky Logs on Getting Data In. 11-06-2012 04:55 AM
- Posted Re: database Splunk on All Apps and Add-ons. 11-06-2012 04:47 AM
- Posted database Splunk on All Apps and Add-ons. 11-06-2012 04:25 AM
- Tagged database Splunk on All Apps and Add-ons. 11-06-2012 04:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-13-2012
01:24 AM
All events brings in one event. I would like to a breakdown of the items on the events
... View more
12-13-2012
01:04 AM
Frankly this is not the answer. Ask about a particular situation. Enough time has passed, the last on a week.
... View more
12-13-2012
12:41 AM
As I understand it is no support! Ask not for the first question and assistance to the no!
... View more
12-10-2012
04:40 AM
Based on config files(please see below) we transform file from .xml format to .csv.
After the log been converted we see that all the messages written as one large event.
We would like to have one event per csv’s string with the fields from transforms.conf.
> inputs.conf
> [monitor:\\SPLUNK0\C$\test\1]
> index = kasper
> _whitelist = .*\.xml
>
> props.conf [source::...kasper*.xml]
> TRUNCATE = 0
> SEDCMD-1 = s/(?m)(^.*?</Worksheet>)//g ###clean the garbage
> SEDCMD-2 = s/(?m)(<W\w*\s\w*\SN\w*[="]+M\w*.*>$)//g ####clean the garbage
> SEDCMD-3 = s/(?m)(</R\w*>)/\n/g ###transfer the event to a new line
> SEDCMD-4 = s/(?m)(</D\w*>)/;/g ### set separators
> SEDCMD-5 = s/(?m)(<[^>]*>)//g ### delete tags
> sourcetype = csv_kasper
> CHECK_FOR_HEADER = false
> priority = 101
> transforms.conf
> [csv_kasper]
> DELIMS=";"
> FIELDS="Status","V-host","Group","Computer","LastData","description","IP","Alive","Domain","NetBIOS","DomainName","DNS"
>
> Критический;;0_test;BD00;7 ноября 2012 г. 15:17:23;Не установлен Антивирус Касперского. ;10.54.44.68;7 ноября 2012 г. 15:17:23;dom;BD00;bd00;dom;
> Критический;;0_test;BD00;16 ноября 2012 г. 12:01:16;Давно не выполнялся поиск вирусов. ;10.54.45.26;16 ноября 2012 г. 12:01:16;dom;BD00;bd00;dom;
> Критический;;0_test;BEOVA;16 ноября 2012 г. 11:58:35;Давно не выполнялся поиск вирусов. ;10.54.44.70;16 ноября 2012 г. 12:06:28;dom;BEZULOVA;beova;dom;
> Критический;;0_test;BRCH11;16 ноября 2012 г. 11:55:25;Давно не выполнялся поиск вирусов. ;10.54.42.71;16 ноября 2012 г. 11:55:25;dom;BRONICH11;brich11;dom;
... View more
- Tags:
- transforms
12-06-2012
11:39 PM
Статус;Виртуальный Сервер;Группа;Клиентский компьютер;Последнее соединение с Сервером администрирования;Причина добавления в отчет;IP-адрес;Видим в сети;Домен;NetBIOS-имя;Доменное имя;DNS-домен;
Критический;;0_test;BD00;7 ноября 2012 г. 15:17:23;Не установлен Антивирус Касперского. ;10.54.44.68;7 ноября 2012 г. 15:17:23;dom;BD00;bd00;dom;
Критический;;0_test;BD00;16 ноября 2012 г. 12:01:16;Давно не выполнялся поиск вирусов. ;10.54.45.26;16 ноября 2012 г. 12:01:16;dom;BD00;bd00;dom;
Критический;;0_test;BEOVA;16 ноября 2012 г. 11:58:35;Давно не выполнялся поиск вирусов. ;10.54.44.70;16 ноября 2012 г. 12:06:28;dom;BEZULOVA;beova;dom;
Критический;;0_test;BRCH11;16 ноября 2012 г. 11:55:25;Давно не выполнялся поиск вирусов. ;10.54.42.71;16 ноября 2012 г. 11:55:25;dom;BRONICH11;brich11;dom;
... View more
12-06-2012
11:37 PM
Thank you regex works.
Now is not working transforms.
Get 1 event without breaking
... View more
12-06-2012
07:47 AM
I have a xml file which I want to convert to a csv, but do not work regular expressions.
> inputs.conf
> [monitor:\\SPLUNK0\C$\test\1]
> index = kasper
> _whitelist = .*\.xml
>
> props.conf [source::...kasper*.xml]
> TRUNCATE = 0
> SEDCMD-1 = s/(?m)(^.*?</Worksheet>)//g ###clean the garbage
> SEDCMD-2 = s/(?m)(<W\w*\s\w*\SN\w*[="]+M\w*.*>$)//g ####clean the garbage
> SEDCMD-3 = s/(?m)(</R\w*>)/\n/g ###transfer the event to a new line
> SEDCMD-4 = s/(?m)(</D\w*>)/;/g ### set separators
> SEDCMD-5 = s/(?m)(<[^>]*>)//g ### delete tags
> sourcetype = csv_kasper
> transforms.conf
> [csv_kasper]
> DELIMS=";"
> FIELDS="Status","V-host","Group","Computer","LastData","description","IP","Alive","Domain","NetBIOS","DomainName","DNS"
splunkd.log
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-1", string="s/(?m)(^.*?</Worksheet>)//g", errMsg="Failed to initialize sed. Invalid option string: /g"
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-3", string="s/(?m)(</R\w*>)/\n/g", errMsg="Failed to initialize sed. Invalid option string: \n/g"
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-4", string="s/(?m)(</D\w*>)/;/g", errMsg="Failed to initialize sed. Invalid option string: ;/g
... View more
- Tags:
- convert
11-15-2012
05:51 AM
fschange not indicate a folder for the local machine (windows)
inputs.conf
[fschange://C:\testing]
index = test
pollPeriod = 5
signedaudit=true
recurse=true
followLinks=false
hashMaxSize=-1
fullEvent=true
sendEventMaxSize=-1
disabled = false
C:\testing
-----1.txt
-----2.txt
... View more
- Tags:
- fschange
11-06-2012
05:23 AM
Events are stored also in the database. Better to use a database to retrieve the data
... View more
11-06-2012
05:22 AM
1 Karma
События хранятся тоже в базе. Лучше использовать базу данных для получения данных
... View more
11-06-2012
04:47 AM
What are the restrictions on the maximum size of the database?
What is the maximum number of events per second, which can take Splunk? For example, SSIM 8000 events per second.
... View more
11-06-2012
04:25 AM
Not found information about the database which stores data Splunk. Is it possible to use SQL as the database data where the data is stored Splunk?
... View more
- Tags:
- database
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
