You can look into mvexpand with your JSON array to explode each event into multiples. As an alternative, Cribl allows you to pre-process events in the ingestion pipeline and we include a function called JSON Unroll which allows you to create an event per entry an a JSON array. ... View more

FYI, what you're looking to do is very easy to do in Cribl. You can point already cooked data at us and transform it how you see fit before delivering it out to syslog, or to any other system we support. https://cribl.io/ ... View more

I wondered why that post had popped back up. That approach is unsupported and a bit risky, but glad it's working for you. ... View more

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult. Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving. ... View more

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult. Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving. ... View more

https://cribl.io/ Answers added a ) after the link, smart. No, Add-on for Linux will not help you send data to Elastic. It works well with Splunk though. Splunk Add-Ons are apps designed to help make data gathering for known systems easier. Elastic has their own set of data gatherers they call beats which help in that area. ... View more

What app? This is a use case for my company's product, Cribl (https://cribl.io/). Without knowing what you're asking about though, can't say one way or another. ... View more

As you can see, this type of ingestion time modification of data is tough in Splunk. This SEDCMD approach could work, but getting your configuration right will be a major pain. For what it's worth, not sure if you're amenable to a 3rd party solution, but this is something Cribl (https://cribl.io/) makes easy that's very hard to get right in props/transforms. ... View more

Lookups will run for every event that's sent to them. In Splunk today, products like Enterprise Security use Data Model Acceleration to do lookups once and then bake the results into the accelerated data model. Unfortunately, it's not available in the regular search interface. You could write your own dnslookup custom search command which maintains state somewhere across invocations and throttles the number of DNS lookups. The downside to this is that you're going to get very inconsistent results with some events getting lookups and others not. My recommendation would be to do DNS enrichment at ingestion time. Unfortunately, it's not possible in Splunk, but it is something we do in Cribl (https://cribl.io/). These types of lookups can be done once at ingestion and added as an index time field to the event as its moving. This also has the benefit of having DNS resolution done closer to the time of the originating event rather than days or weeks later. ... View more

It looks like you're using simple mode for modular input rather than xml: http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsStream This is setup in your introspection in the tag: http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsScripts ... View more

Default interval is 60 seconds. Yes, if you want to generate one and only one copy, set the interval up to an impossibly high number. https://github.com/splunk/eventgen/blob/develop/splunk_eventgen/default/eventgen.conf#L22 It should be noted, you may find gogen to be a better experience and it supports the concept of ending after a number of intervals. https://github.com/coccyx/gogen ... View more

As I recall (been a while since I wrote it), Eventgen doesn't have a concept of "ending", it will always keep generating new data. What is your interval and count set to? Eventgen will generate count events every interval. What you're seeing most likely is that it is generating multiple intervals of events. By default, count=0, which means to use the whole file. With that default, what you're seeing is that every interval it'll keep just putting the whole file out. ... View more

As far as I'm aware, this does not exist. If you're looking to route data from the ingestion pipeline to third party systems, this is a use case we support in Cribl (https://www.cribl.io). ... View more

I agree with you whole heartedly. A few friends on mine in the industry are pushing the idea that everything should be an event, encoded in JSON, very wide with lots high cardinality fields. We find that most of the time the person who needs to consume it and the person who writes it are different and so there's a need to sit in the middle and make the logs smarter through transformation and enrichment. You're confirming the need for such a thing. Perhaps Splunk should provide this out of the box, but after years of trying to convince them to do that from the inside we decided to build it on the outside :). ... View more

RegEx is powerful but limited. Can't really comment on what "should be" doable in Splunk itself, only what is. Your other options at Search Time without third party products would be to build a custom search command. This could probably be done in 10 lines of python. The use case you're describing really requires being able to programmatically process the data. ... View more

This is I think out of scope for this forum. This is a broader configuration management question of how do you take something out of your CI/CD pipeline and trigger Splunk configuration changes. There are a number of ways to accomplish this, with Puppet, Chef or SaltStack being probably the more popular. ... View more

Why are you trying to count characters in your regex? This regex seems to do the trick: \s(?{.+})$. In general, I'd try to get your developers to clean up their logging to output just JSON rather than JSON in a log. Another option to prettify the logs at ingestion time. It's a use case we're working on at Cribl (https://www.cribl.io/) if you're interested. ... View more

The company will not comment on futures publicly. For these types of questions, you should your sales rep to speak to someone in product who can answer the question. ... View more

Doing this at search time is pretty difficult with only regex available to you. Doing this at ingestion time is a better approach. Can you use SEDCMD in transforms to clean up the data to extract just the JSON? This is a pretty common use case for a product we are building that helps you work with data in Splunk at ingestion time. We could easily extract the JSON out of the log, parse it, emit a new event with just that data or transform the event to be just the JSON. We'd love to talk to you about our use case. If you're interested, you can fill out the form at https://www.cribl.io/. ... View more

This does not exist in Splunk today. Curious about why you need that information? That's something we could do with a product we're working on, but I'd like to understand your use case a bit better. ... View more

Do you have a sample of the full log, not how Splunk parsed it? We need to see how multiple events look. ... View more

Where is this from? This is pretty printed JSON data, it would be easier to fix the source to send JSON as single line events. ... View more