×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jpena323
Explorer
Member since: ‎01-05-2015
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 4
Member Since ‎01-05-2015
Activity Feed
View All

Re: correlate multiple destination fields based on...

by in Splunk Search
‎04-02-2015 12:46 PM
‎04-02-2015 12:46 PM
sourcetype="juniper" reason="policy deny" src_zone="UNTRUST" | lookup geoip clientip as src_ip | stats count as Total_Attempts by dest_port, src_ip, client_country ... View more

Re: How to configure SEDCMD in props.conf?

by in Getting Data In
‎12-28-2018 05:25 AM
‎12-28-2018 05:25 AM
Can this be used in an intermediate forwarder? ... View more

Re: ignore specific parts of a log entry with prop...

by in Getting Data In
‎01-05-2015 03:30 PM
‎01-05-2015 03:30 PM
You can try SEDCMD command to remove unwanted fields/strings. add more similar SEDCMD lines for different fields. E.g. props.conf [YourSourceType] ...Other parts... ........... SEDCMD-removeunwanted1 = s/\s(src-nat-rule-name=\"[^\"]+\")// ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
Karma given to
View All