Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aferchichi
aferchichi
New Member
Member since:
11-13-2012
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-13-2012 |
Activity Feed
- Posted Why using suppress_text=1 for Windows events logs results in loss of many interesting fields? on Getting Data In. 10-06-2014 01:17 AM
- Tagged Why using suppress_text=1 for Windows events logs results in loss of many interesting fields? on Getting Data In. 10-06-2014 01:17 AM
- Tagged Why using suppress_text=1 for Windows events logs results in loss of many interesting fields? on Getting Data In. 10-06-2014 01:17 AM
- Tagged Why using suppress_text=1 for Windows events logs results in loss of many interesting fields? on Getting Data In. 10-06-2014 01:17 AM
- Tagged Why using suppress_text=1 for Windows events logs results in loss of many interesting fields? on Getting Data In. 10-06-2014 01:17 AM
- Posted Re: REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 06:44 AM
- Posted Re: REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 06:20 AM
- Posted Re: REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 05:28 AM
- Posted Re: REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 04:57 AM
- Posted Re: REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 04:56 AM
- Posted REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
- Tagged REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
- Tagged REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
- Tagged REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
- Tagged REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
- Tagged REGEX in transform.conf using "^" to specify the begining does not work on Splunk Search. 10-17-2013 03:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
10-06-2014
01:17 AM
We have installed a universal forwarder on a DC. In order to reduce the size of the windows logs indexed, we have used the option suppress_text=1 under [WinEvenLog://Security] section in the inputs.conf file on the splunk universal forwarder. However, after setting this option, it happens that many interesting fields have disappeared like the Account_Name, Account_Domain, Logon_Type, etc.
So I have the following questions:
- Are all these fields extracted from the message part?
- What exactly contains the message part?
- What remains exactly when suppress_text=1 option is set?
Thanks for your help
... View more
10-17-2013
06:44 AM
In fact, I think the Host variable extracted has some non viewable characters before the digits (maybe a space), that's why it did not match the "begin with 8" expression ^8.
... View more
10-17-2013
06:20 AM
Thanks again... But here you must have something before the number "8", like a8.4.5.7 and therefore will not match the 8.4.5.7
... View more
10-17-2013
05:28 AM
Thanks but it leads to the same result... Your expression will also match 18.2.3.4 ... Which I dont want. It really seams that splunk is not capable of interpreting the begining of a string "^".
... View more
10-17-2013
04:57 AM
Thanks
but it does not work neither...
Any other suggestions?
Azim
... View more
10-17-2013
04:56 AM
Thanks
but it does not work neither...
Any other suggestions?
Azim
... View more
10-17-2013
03:45 AM
Hi,
I specified the following in transforms.conf
SOURCE_KEY = MetaData:Host
REGEX = ^8\.\d{1,3}\.\d{1,3}\.\d{1,3}$
DEST_KEY = _MetaData:Index
FORMAT = special_index
This should noramlly match host like 8.23.15.12, but it does not work. And if a remove the "^" it will match but it will also match 18.23.15.12 which I do not want. It seems that the "beging with" is not working... Is this a bug? is there a way to circumvent it?
Thanks for your help,
Azim
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
