×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
nocsolcon
Explorer
Member since: ‎07-18-2018
‎02-18-2026
Community Statistics
Posts 4
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎07-18-2018
Activity Feed
View All

Re: Linux DHCP new regex,New dhcp log format

by in All Apps and Add-ons
‎07-18-2018 04:06 AM
‎07-18-2018 04:06 AM
Sorry, my mistake. I changed it. ... View more

Re: Linux DHCP new regex,New dhcp log format

by in All Apps and Add-ons
‎07-18-2018 03:59 AM
‎07-18-2018 03:59 AM
I've fixed it by changing all the regex in the transforms.conf from: \s(dhcpd)\:\s to: \sdhcpd(\:\s|\[\d+\]:\s) Also we need to change the file: eventtypes.conf from: [dhcpd_event] search = process=dhcpd to: [dhcpd_event] search = dhcpd After this, it is working for the old and new log lines ... View more

Re: Can't seem to get Infoblox DHCP to work

by in All Apps and Add-ons
‎07-18-2018 03:43 AM
‎07-18-2018 03:43 AM
I've fixed it. You have to change all the regex in transform.conf from: \s(dhcpd):\s to: \sdhcpd(:\s|[\d+]:\s) and change the following line in: eventtypes.conf from: [dhcpd_event] search = process=dhcpd to: [dhcpd_event] search = dhcpd ... View more

Linux DHCP new regex,New dhcp log format

by in All Apps and Add-ons
‎07-18-2018 01:43 AM
‎07-18-2018 01:43 AM
We've upgraded our DHCP server to debian 9. Now the dhcp log is written differently then on our old server log lines contains now: dhcpd[1569]: instead of dhcpd: Jul 18 09:12:43 dhcp-server-name dhcpd[1569]: DHCPACK on ip-address to 00:00:00:00:00:00 (modem-type) via ip-address the app: Linux DHCP can not handle this can we change the regex in transform.conf from: \s(dhcpd):\s to: \sdhcpd(:\s|[\d+]:\s) or should we change more? I tested it, but this change to transform.conf does not work ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-18-2026 02:44 AM
Karma given to
View All