I sent the data to a HF and ther i made config in props.conf. This worked fine. Thanks Bye ... View more

Hi nittala_surya, I sent the data to a HF and ther i made config in props.conf. This worked fine. Thanks Bye ... View more

hi nittala_surya I tried again (with TIME_PREFX) but it didn't change. Bye ... View more

Hi nittala_surya, I tried but it didn't change. It looks to me that props.conf in not used by UniversalForwarder. in mi UniversalForwarder installation in the path %SPLUNK_HOME%\etc\system\local I have: inputs.conf [monitor://C:\xxxx] disabled = false index = yyyyyyy sourcetype = mysourcetype crcSalt = whitelist = (?i).\xxxx\.\.*.(txt|csv|log) props.conf [mysourcetype] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE=false pulldown_type = 1 TIME_FORMAT = %d/%m/%Y %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 Thanks Gianluca ... View more

hi thambisetti, I didn't define a transform because, according to splunk the log is already written in key='value'. It should extract the value automatically. It is an option that I can consider to write a transform if I don't find a solution. Thanks Kind regards Gianluca ... View more

hi nittala_surya, my props.conf is **[invest-be-inout-crg] BREAK_ONLY_BEFORE=\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3} NO_BINARY_CHECK = 1 SHOULD_LINEMERGE=false TRUNCATE=0 pulldown_type = 1 TRANSFORMS-filter_logs = extract_fields-invest-be-inout,extract_fields_Source_Wel** in my search query I set sourcetype = invest-be-inout-crg so I think the truncate is in the correct place. Is there a way to check in the UI? btw I will try TRUNCATE=20000 and I will see if this will solve the problem Thanks regards Gianluca ... View more

Hi thambisetty, if I make a query "search xxxx | fields richiesta" I see the field truncated even if the raw data is complete If I make a similar query "search xxxx |eval len=len(_raw) | eval len_rich=len(richiesta) | table richiesta len len_rich" It looks to me the field is truncated when the raw has a length > 10000. It is always truncated when length is > 10000, it is never truncated when the length is less then 10000. Bye ... View more

Hi kmorris, in my props.conf I have already TRUNCATE=0. According to the documentation splunk should never truncate. Kind Regards Gianluca ... View more

Mi field richiesta in the log file is: .... richiesta='"<?xml version="1.0" encoding="utf-16"?><MemoConsulenzaRequest xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;&lt;ZSRVEXT&gt;&lt;Username xmlns="http://www.cadit.it/MW/MWGSSRE"&gt;ut27537&lt;/Username&gt;&lt;/ZSRVEXT&gt;&lt;/MemoConsulenzaRequest&lt;"' ..... if I query richiesta at search time I obtain only the first part of richiesta "<?xml version="1.0" ... View more

hy nittala_surya, thank you for your reply. What I am not able to understand is why the field richiesta contains only a part of the xml. The spath command is very interesting Kind regards ... View more

Hi everybody, I adopted this solution. I created a token using change/condition. In this scenario I changed the default value form "*" to blanck. The input in the xml dashboard definition is: <input type="text"> <label>User</label> <initialValue></initialValue> <change> <condition value=""> <set token="userToken"></set> </condition> <condition> <set token="userToken">User=$value$</set> </condition> </change> </input> the query is: index=xxx $userToken$ what happens is: 1) if User is empty/blank the query is index=xxx 2) if User has a value the query is index=xxx User=value ... View more

Thank you for the reply. It works if I leave * in all the inputs. If I set User to ut1234 I want only two lines as response of the query (the row 1 and 3). Thank you ... View more

UPDATE: the solution I adopted is the one shown over. To solve I added the fields.conf in the search head in the "local" folder of my app ... View more

Hello, I try to explain better. I want an index-time field called "Sp". My inputs.conf is: [monitor:///log/logServer/file.log] disabled = false index = test01 sourcetype = file-test My props.conf is: [file-test] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE=false pulldown_type = 1 TRANSFORMS-filter_logs = extract_fields-test My transforms.conf is: [extract_fields-test] REGEX = (?\d+-\d+-\d+\s+\d+:\d+:\d+,\d+)\s+(?\w{5})(?\w{1})_ FORMAT = Ts::"$1" Sp::"$2" Tsp::"$3" WRITE_META = true My log File is: 09-05-2018 10:12:15,123 ABC12I_AAA 09-05-2018 10:12:15,123 ABC12I_BBB 09-05-2018 10:12:15,123 ABC12O_CCC Index time extration creates the Key "Sp" (for the 3 events) but I am not able to search using Sp=ABC12 without wildcards. I want to create an index-time field called Sp and I want to be able to search the field without wildcards Thanks ... View more