Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yuvalba
yuvalba
Path Finder
Member since:
06-29-2011
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 44 |
| Karma Received | 13 |
| Member Since | 06-29-2011 |
Activity Feed
- Karma Re: How to configure Splunk to not merge Juniper VPN logs in one event? for aholzel. 06-05-2020 12:47 AM
- Karma Re: How to configure props.conf and transforms.conf for multivalue field extraction and strip whitespaces for Juniper SSLVPN logs? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure props.conf and transforms.conf for multivalue field extraction and strip whitespaces for Juniper SSLVPN logs?. 06-05-2020 12:47 AM
- Got Karma for Re: How to configure props.conf and transforms.conf for multivalue field extraction and strip whitespaces for Juniper SSLVPN logs?. 06-05-2020 12:47 AM
- Karma Re: What does the warning message mean in forwarder management ? for mikelanghorst. 06-05-2020 12:46 AM
- Karma Re: Why are null characters ("\x00") appearing in events assigned a sourcetype by a forwarder? for morgancrocker. 06-05-2020 12:46 AM
- Karma Re: TZ offset in props.conf not working for conorglynn. 06-05-2020 12:46 AM
- Karma Re: TZ offset in props.conf not working for conorglynn. 06-05-2020 12:46 AM
- Karma Re: Alt-Click not working selected fields for dfronck. 06-05-2020 12:46 AM
- Karma Re: How do I stop indexer automatically if I reached my data limit? for sdaniels. 06-05-2020 12:46 AM
- Karma Alt key to add NOT no longer works on fields in V6 for ashleyherbert. 06-05-2020 12:46 AM
- Karma What does the warning message mean in forwarder management ? for sunrise. 06-05-2020 12:46 AM
- Karma Why are null characters ("\x00") appearing in events assigned a sourcetype by a forwarder? for lsouzek. 06-05-2020 12:46 AM
- Karma Re: Splunk will not start and is waiting for config lock for yannK. 06-05-2020 12:46 AM
- Karma Time Zone Confusion for tgiles. 06-05-2020 12:46 AM
- Karma Re: Alt-Click not working selected fields for elof. 06-05-2020 12:46 AM
- Karma Re: Alt-Click not working selected fields for sideview. 06-05-2020 12:46 AM
- Karma realtime alerting not happening for ignetops. 06-05-2020 12:46 AM
- Karma Alt-Click not working selected fields for antlefebvre. 06-05-2020 12:46 AM
- Karma Re: Why are null characters ("\x00") appearing in events assigned a sourcetype by a forwarder? for gkanapathy. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-16-2014
08:58 AM
I seem to be having the same issue. Setting TZ via [host::myhost] is not affecting while using the [source::mysource] is working. Were you able to get it to work using a host stanza?
PS. I am using Splunk 5.0.10
... View more
11-02-2014
09:47 AM
2 Karma
Here is my final configuration as suggested:
[junipersa-role-info]
REGEX = Juniper\:\s[^\s]+\s[^\s]+\s-\sive\s-\s\[\d+.\d+.\d+.\d+\]\s[^\(\)\s]+\([\s\d\w]+\)\[([^\]]+)
FORMAT = roles_string::$1
[junipersa-roles-mv]
SOURCE_KEY = roles_string
MV_ADD = true
REGEX = (?<role>[^\s,]+)
Seems to work fine, though I need some further QA 🙂
Thanks for the great and prompt help!
... View more
11-02-2014
09:19 AM
It works! (although I don't fully understand the REGEX syntax - what is the second match group for). And last thing, I prefer to get the result in the role field and not a new field. I will try to do it unless you have a quick solution.
... View more
11-02-2014
08:41 AM
transforms.conf
[junipersa-role-info]
REGEX = Juniper\:\s[^\s]+\s[^\s]+\s-\sive\s-\s\[\d+.\d+.\d+.\d+\]\s[^\(\)\s]+\([\s\d\w]+\)\[([\s\d\w\,]+)\]\s-
FORMAT = role::$1
fields.conf
[role]
TOKENIZER = (\w[^\,]*)
... View more
11-02-2014
08:22 AM
Thanks. Tha'ts a good idea. but now how do I implement it in the configuration?
... View more
11-02-2014
08:01 AM
I need to extract multivalues from a field with the following value format: role1, role2, some role3
The problem is that there are spaces after the commas.
I was able to do it successfully using the following search: | rex mode=sed field=role "s/, /,/g" | makemv delim="," role
How can I implement it on the configuration?
... View more
12-19-2013
09:58 AM
It seems that it's still not fixed also in 6.0.1 😞
At least according to the release notes
... View more
11-09-2013
10:02 AM
1 Karma
What search are you using?
It could be that the messages format from this new host are different and the host name is not prased correctly by Splunk.
Do you see the messages if you search only based on the source:
source=/var/log/messages
... View more
11-08-2013
06:50 AM
1 Karma
I beleive you should have no problem. Check this:
Compatibility between forwarders and indexers
I am using a Splunk 6 indexer/Deployment server and a Splunk 5/6 forwarders with no problem.
... View more
07-29-2013
02:35 PM
2 Karma
Had the same issue with monitor input of local CIFS mount (CentOS 6.4).
Adding the options directio to the mount options resolved it.
... View more
07-29-2013
08:39 AM
Thanks.
I also plan to have standard, but I thought the auto header extraction is nice to use. Usually it will be same format.
I prefer to not log all fields due to index volume limits.
Now I have another problem, the latest file is not detected and left as "iis" and having no fields extracted...
... View more
07-29-2013
08:08 AM
Splunk 5.0.3
I am using the default iis sourcetype for IIS logs, and got iis-2 type created.
I added a new field on the IIS (7.5) server (cs-host) which causes IIS to inserted a new Fields line in the current log file.
The problem is that the change is not detected until a new file is created which created a period of mis-classified data that got the wrong sourcetype (iis-2), later when a new file was created it got the correct new type iis-3
Is this normal behaviour?
Any way to prevent this perdiod of wrong sourcetype detected?
... View more
07-23-2013
01:50 AM
Why can't I edit my post?
Whem I try to edit the title and save, it say "This field is required" under "update summary" although I fill it up.
... View more
07-23-2013
01:47 AM
Found the problem.
The fields objects (transform and report) where by default configured in App context only so did not work on the Search app.
Changing the relevant objects to Global makes it work as expected.
... View more
07-17-2013
02:06 PM
Hi,
I have Splunk for Windows installed and want to check the WindowsUpdate log.
I am receiving the log correctly and have setup sourcetype to be WindowsUpdateLog as needed.
However I don't have any fields extracted.
I tested by applying the transform pid-tid-component_for_windowsupdatelog manually as:
rex "^\S+\s+\S+\s+(?<pid>\S+)\s+(?<tid>\S+)\s+(?<component>\S+)"
And the fields are extracted correctly.
Why aren't they being extracted on regular search? I must be missing something...
Thanks
... View more
- Tags:
- windows
- windowsupdate
06-09-2013
09:43 AM
7 Karma
Any update on this topic since it was asked at Nov '11?
I am also going to deploy Splunk forwarder on many servers and was wondering how to ensure it is being kept up to date with security updates etc?
Why not support the native Linux software management tools?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
