Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About jelli5518
jelli5518
Engager
Member since:
06-07-2018
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-07-2018 |
Activity Feed
- Karma Re: Help extracting hostname with host_regex from path for mayurr98. 06-05-2020 12:50 AM
- Posted Dashboard Export->Export PDF error message on Reporting. 11-20-2019 08:44 AM
- Tagged Dashboard Export->Export PDF error message on Reporting. 11-20-2019 08:44 AM
- Tagged Dashboard Export->Export PDF error message on Reporting. 11-20-2019 08:44 AM
- Posted Re: Help extracting hostname with host_regex from path on Getting Data In. 11-06-2019 09:37 AM
- Posted Re: Help extracting hostname with host_regex from path on Getting Data In. 11-06-2019 09:02 AM
- Posted Help extracting hostname with host_regex from path on Getting Data In. 11-05-2019 01:04 PM
- Tagged Help extracting hostname with host_regex from path on Getting Data In. 11-05-2019 01:04 PM
- Tagged Help extracting hostname with host_regex from path on Getting Data In. 11-05-2019 01:04 PM
- Tagged Help extracting hostname with host_regex from path on Getting Data In. 11-05-2019 01:04 PM
- Posted Re: How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 01:14 PM
- Posted How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 10:03 AM
- Tagged How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 10:03 AM
- Tagged How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 10:03 AM
- Tagged How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 10:03 AM
- Tagged How do I get host_regex to work for my log file names? on Splunk Search. 06-07-2018 10:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-20-2019
08:44 AM
When using the Dashboard Export->Export PDF option, it opens a new window in Firefox and prints the following:
Exception raised while trying to render "Dashboard 1"
list index out of range
The dashboard itself looks fine on the screen and has data in it.
Any ideas why this is happening and what fix is possible?
If I run the query so that it returns a different data set (query over just 1 day for example), then it works ok.
I don't want to use Export->Print because the formatting that outputs into the PDF is different and isn't working as well.
I didn't find max_rows_per_table being used in limits.conf.
Splunk Enterprise 7.1.2
... View more
- Tags:
- splunk-enterprise
11-06-2019
09:37 AM
My log files don't actually have the word "host" in them-- that was just an example. Thanks again!
... View more
11-06-2019
09:02 AM
The first worked!
The second put the path in the hostname.
Seems like I needed to remove the "host" keyboard from the above. I'm using Splunk Enterprise 7.1.2, if that matters.
Thanks!
... View more
11-05-2019
01:04 PM
Log files are list this:
/audit/files/any/path/host1.audittype-secure.timestamp.audit.log.1
/audit/files/hostab.audittype-audit.timestamp.txt
etc...
Example:
/audit/files/path/host123.secure.2019080165784.audit.log.1
I want Splunk to have host as "host1" and "hostab" and "host123", and etc..
I have this in inputs.conf:
[monitor:///audit/files]
host_regex = \/S+([^.]).*
But it isn't working at all.
I'm trying to set hostname to the string between the last / and the first.
... View more
06-07-2018
01:14 PM
Thanks! That worked...but I've found that I also have files called:
/audit/files/20180516009678.fep145.dmz.mil.audit.log.1
/audit/files/20180517095674.view145.dmz.mil.audit.log.1
for this pattern, the suggested host_regex results in a host of "mil" (with both of them going into "mil" host, which is also not good).
... View more
06-07-2018
10:03 AM
Log files are:
/audit/files/20180515041511.scc145.audit.log.1
/audit/files/20180515041511.scc145.audit.log.2
/audit/files/20180515041511.dmzbackend.audit.log.1
etc...
I want splunk to have host as "scc145" and "dmzbackend", and etc..
I have this in inputs.conf:
[monitor:///audit/files]
host_regex = ([^0-9./][A-Za-z0-9-]*[^.audit.log])
Also tried
host_regex = /audit/files/([^0-9./][A-Za-z0-9-]*[^.audit.log])
That regex works just fine on sites like regex101.com. Splunk won't use it correctly. I've tried a ton of variations (for example approaches that don't use the caret) which work fine for regex, but Splunk won't use it.
... View more
