About btawiah

btawiah · ‎05-20-2020

was this successful because i am also interested in the approach.

btawiah · ‎02-06-2020

Please any help will be appreciated. We have a lookup test_pci_asset.csv with a field nt_host values of nt_host are host1 host2 Raw log in splunk host fields are host1.abc.com We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host. We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below props.conf [default] LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner transforms.conf [test_pci_asset] batch_index_query = 0 case_sensitive_match = 0 filename = test_pci_asset.csv match_type = WILDCARD(nt_host)

btawiah · ‎04-03-2019

btawiah · ‎04-03-2019

btawiah · ‎04-02-2019

@Vijeta i actually updated the question. I dont have to extract fields because that already exist. I only need to get the difference and output the one from raw logs since that is not in the main table location field.

btawiah · ‎04-02-2019

I have a table(main table).csv with field location. I have raw logs that includes field location main table.csv location_field A B C Raw logs location_field A B Please, I need help with a query that will check raw logs against main table and give a result of C missing search result should return C

btawiah · ‎03-13-2019

Splunkers, please has anyone been successful monitoring JMX on weblogic 12.2.1 using the splunk supported addon for JMX? Have tried everything and the debug logs are not very helpful.

btawiah · ‎03-07-2019

Trying to monitor a file that ends with .splunk but for some reason splunk will not index it. Only when I change the extension to .txt, it ingests. Any reasons why this is happening? Thanks

btawiah · ‎03-04-2019

Thanks for you suggestion. We will consider that. In the past we have done it using one server only but the concern is we want to capture the host names of the servers in splunk as well. In this case its showing only one host name. Maybe the local file monitoring will be best for us at this time.

btawiah · ‎03-01-2019

server 1 server 2 server 3 monitoring location is shared \server[1-3]\logs\serevr.log server[1-3] is able to reach all logs since its share. For example, server 1 will be able to read log files from server 2 and server 3 My current input definitely will index duplicate data since all three servers will be hitting the network storage at a time, which may easily break something: [monitor://\\server1\logs\serevr.log] index=main sourcetype=serverlog [monitor://\\server2\logs\serevr.log] index=main sourcetype=serverlog [monitor://\\server3\logs\serevr.log] index=main sourcetype=serverlog Question: How do I monitor this logs so server 1 will only monitor server 1 logs on the shared drive and server 2 will monitor only server 2 logs and same as server 3? Thank you for your help.

Posts	12
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎06-19-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

using match_type wildcard in lookup not working

How do you compare two results?

weblogic 12.2.1 splunk remote connection JMX moni...

Can I monitor a file with extension .splunk?

In Splunk Enterprise Security, how do you monitor ...

Re: How do you call multiple REST APIs?

using match_type wildcard in lookup not working

Re: How do you compare two results?

Re: How do you compare two results?

Re: How do you compare two results?

How do you compare two results?

weblogic 12.2.1 splunk remote connection JMX moni...

Can I monitor a file with extension .splunk?

Re: In Splunk Enterprise Security, how do you moni...

In Splunk Enterprise Security, how do you monitor ...