About richard_g_curry

richard_g_curry · ‎01-08-2015

This is rather old, have you got it figured out? If not ... For your sourcetype, try this: props.conf [your_sourcetype] TRANSFORMS-filter_dorm = filter_dorm transforms.conf [filter_dorm] REGEX = 0.0\s+Dorm DEST_KEY = queue FORMAT = nullQueue

richard_g_curry · ‎01-08-2015

I believe that you will need to do this filtering at your heavy forwarder or wherever the data is getting cooked.

richard_g_curry · ‎01-08-2015

Ayn's regex will work if you add the quotes to it, like this: REGEX = risk_rating=\"([0-6]|7[0-4])\"

richard_g_curry · ‎12-30-2014

Thank you, this has provided just what I needed.

richard_g_curry · ‎12-24-2014

One of my business partners wants to create a search on his Akamai data taking the Rule IDs from the WAS Info field and match those to a lookup table to get the textual reference to the Rule ID code. I am not sure how to match to a lookup table when the field can have multiple values separated by ":"; such as this: xxxx_11111|950901:973333:973335:981173:981242:981318| Separating the different rule IDs is a simple rex, but how do I use that multi-value field to match up against the lookup table to get all the text meanings for those codes?

richard_g_curry · ‎07-28-2014

All but [exchangelog] will use the [default] settings and it will use those defined with its stanza. Cool. And thanks! (8-D) Rick

richard_g_curry · ‎07-28-2014

[default] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = <Data> TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3Q [deviceinfo] NO_BINARY_CHECK = 1 pulldown_type = 1 [errorlog] NO_BINARY_CHECK = 1 pulldown_type = 1 [apachelog] NO_BINARY_CHECK = 1 pulldown_type = 1 [exchangelog] SHOULD_LINEMERGE = False LINE_BREAKER = ([\r\n]+)\d{2}-\d{2}-\d{4}\s+\d{2}: TIME_PREFIX = ^\w+:\s+ TIME_FORMAT = %m-%d-%Y %H:%M:%S,%3N NO_BINARY_CHECK = 1 pulldown_type = 1 [commonlog] NO_BINARY_CHECK = 1 pulldown_type = 1 SEE NEXT COMMENT

richard_g_curry · ‎07-28-2014

I somehow missed the [default] spec option. Then again, I focused on what was in the doc for props.conf ( http://docs.splunk.com/Documentation/Splunk/6.1.2/Admin/Propsconf?r=searchtip ). So using your example, let's assume that the [exchangelog] required different LINE_BREAKER and TIME_FORMAT options, then it would look like this: (SEE NEXT COMMENT)

richard_g_curry · ‎07-28-2014

I am working on a large set of log that Splunk will monitor for a 3rd party app which has nearly 2 dozen logs to be monitored. Many of these logs have similar formatting so my props.conf for the Indexers have a lot of repetition. I know I can use a transforms.conf with props.conf on my Search Heads to share common field extractions but I don't see anything in the doc that specifically says I can do this for LINE_BREAKER or TIME_ formatting parameters. Clearly it is because these settings are not valid in the transforms.conf. Is it possible that this could be setup in a future version of Splunk that these parameters could be shared rather than having them repeated several times on the file? This could be done either by providing equivalent settings in transforms.conf (but that doesn't really make logical sense as you consider what the transforms.conf is meant to do) or by allow for a "global" in the props.conf file. The latter does seem like the more logical possibility. What does the Splunk gurus think?

richard_g_curry · ‎07-10-2014

Thank you for this. I've been asked to use Windows Authentication if at all possible. Security around and access to this database is strongly controlled. There is resistence to using a SQL User Account for this. But, if that is all that will work in this environment, then we need to see if how that is supported and if it will work with DB Connect. I do not have the details on this side of the options but it appears that using a SQL User Account requires getting a dynamic password from a password vault with each access. That won't be easy to use with DB Connect, at least I see it that way.

richard_g_curry · ‎07-10-2014

Interesting. Would you mind sharing your database and inputs conf files that make this work? Naturally edit out "proprietary" stuff and leave the Splunk related info.

richard_g_curry · ‎07-10-2014

You are saying that DB Connect was on your MS SQL Server, right?

richard_g_curry · ‎07-10-2014

Is this possible, to connect DB Connect to a MS SQL database using Windows Authentication when the DB Connect tailing server is running Linux? The article "DB Connect to MSSQL DB as Windows Authentication" states how to do this but is not clear if this is all on a Windows centric environment. I suspect that is assumed. Can Windows Authentication be used between a Linux DB Connect client to a MS SQL database or do we need to use a SQL Server account for this? Thank you for your time on this inquiry. Rick

richard_g_curry · ‎07-10-2014

"Is there a way to combine DB Connect data with Search data?" It does not appear that this was answered -- yes you can. You can use the append command (http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Append) or combine the indexes and sourcetypes of your 'other' data.

richard_g_curry · ‎06-23-2014

Are you running Splunk on Linux? Then try this: cd var/lib/splunk/eucp/tempdb ; ls | xargs -i /var/opt/splunk/bin/splunk rebuild \{\}" If you are running Windows, try this: for /F "usebackq delimes=" %i in (`dir /B %SPLUNK_HOME%\var/lib/splunk\{INDEX_NAME}\thaweddb\temp-*`) do %SPLUNK_HOME%\bin\splunk rebuild %i where "{INDEX_NAME}" is the name of your index that holds the archived data to be restored. NOTE: It has been a long time since I've written a "DOS 'for' command and I do not have a Windows Splunk instance to test this, so if Windows is your environment, this may not be coded exactly as it will need to be to get the job done. The restore procedure and naming convention used follows the guidance of the Splunk doc article Restore archived indexed data. You need to assert the the sequence number of the bucket name (the "_\d+ at the end of each bucket name) is a duplicate of what is in the db or colddb directories; this will be a big problem with Splunk if there are duplicates.

richard_g_curry · ‎05-01-2014

I am not here yet with the F5 app, but hopefully soon we will be deploying it/them. Based on my experience on other work, consider this for your issues: Look in the dashboard code, specifically at the searches, to see what you need to set as your sourcetypes. One way to do that is through transforms. And this may be what the app normally does. So look also in the props.conf and trasnforms.conf file(s) for code that takes in a "global" sourcetype and then uses something unique in each source's log data to identify it as data specific for that part of the app. Is there a reason you cannot install the app(s) in their "normal mode"? Seems you are setting this up to customize it. True? Is there really value to that for you? Consider the long-term effect, particularly if it is someone else coming in behind you and you're long gone. How are they going to maintain this?

Posts	16
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎04-01-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to Match Akamai WAF Info with Lookup Table?

Use transforms.conf to share LINE_BREAKER and TIME...

DB Connect to MS SQL from Linux Server

Re: How to filter out any Meraki access point mess...

Re: How to fix my regex configuration to filter ou...

Re: Filter events before indexing

Re: How to Match Akamai WAF Info with Lookup Table...

How to Match Akamai WAF Info with Lookup Table?

Re: Use transforms.conf to share LINE_BREAKER and ...

Re: Use transforms.conf to share LINE_BREAKER and ...

Re: Use transforms.conf to share LINE_BREAKER and ...

Use transforms.conf to share LINE_BREAKER and TIME...

Re: DB Connect to MS SQL from Linux Server

Re: DB Connect to MS SQL from Linux Server

Re: DB Connect to MS SQL from Linux Server

DB Connect to MS SQL from Linux Server

Re: DB Connect to Remote MSSQL DB as Windows Authe...

Re: thawing out multiple buckets at once?

Re: Splunk for F5 (Access, Network, Security)