About idekuld - Splunk Community

Activity Feed

Got Karma for remove source type. ‎06-05-2020 12:46 AM
Posted Re: remove source type on Getting Data In. ‎04-18-2012 03:47 AM
Posted Re: remove source type on Getting Data In. ‎04-18-2012 02:29 AM
Posted Re: remove source type on Getting Data In. ‎04-18-2012 01:22 AM
Posted Re: remove source type on Getting Data In. ‎04-18-2012 12:26 AM
Posted remove source type on Getting Data In. ‎04-17-2012 11:45 PM
Tagged remove source type on Getting Data In. ‎04-17-2012 11:45 PM
Tagged remove source type on Getting Data In. ‎04-17-2012 11:45 PM
Tagged remove source type on Getting Data In. ‎04-17-2012 11:45 PM

Topics I've Started

Subject

Karma

Author

Latest Post

remove source type

1

by

"The preview feature, is a good feature" this will be a good feature when you solve the problem that the user not get what he except. (better documentation, teaching video, or something) Im new with splunk. Now it looks that what you get as web gui to configure is useless. I added the /var/log/samba/audit.log so many times. In the preview i see that everything is fine, but when is want to search in this file i get 0 result. After i run the command: /splunk add monitor /var/log/ i was to able to search in the log files. But /var/log/samba/audit.log was not in the list of files that can be searched. I must move this file to /var/log/audit.log, only after this was i able to find something in this file.

ok. I try to "add data" on the splunk web management page the /var/log/samba/audit.log file what is created by syslog to monitor. I added the file and nothing happend. i cant search in the file. Then i try to add a directory with the add data, on the web page. But I cant add any directory. Yes great feature......... You cant add a directory on the wb site, you can add it on th CLI. .... awesome.... And the last other great feature, when the audit.log is in the /var/log/samba/ directory then splunk dont care this file, you must place this file to /var/log/. What do you think about this?

i try: index=audit.log | delete 0 line deleted. Okay maybe this error is comming from another problem: i cant add to monitor and index a directory, for example /var/log/ i add /var/log/samba/audit.log file to the data inputs. But it looks like the file is added but when i try to search i found nothing. Just when the file is not added to the data inputs and no index is generated.

when i add data to Splunk then i can set a "source type"(new source type and apply an existing source type). After i created a lot of source type, i want to delete them because there are too many.

How is this possible? ./splunk help commands This page shows you the syntax and summary of the Splunk CLI commands. Splunk CLI command syntax: ./splunk [command] [object] [-parameter <value>]... * Some commands don't require an object or parameters. * Some commands have a default parameter that can be specified by its value alone. Commands and objects: * A command is an action that you can perform. * An object is something you perform an action on. Supported commands and objects: [command] [objects] add [exec|forward-server|index|licenser-pools|licenses|monitor|oneshot| saved-search|search-server|tcp|udp|user] anonymize source clean [all|eventdata|globaldata|userdata] create app diag NONE disable [app|boot-start|deploy-client|deploy-server|discoverable| dist-search|index|listen|local-index|webserver|web-ssl] display [app|boot-start|deploy-client|deploy-server|discoverable| dist-search|index|jobs|listen|local-index] edit [app|exec|forward-server|index|licenser-localslave|licenses| licenser-groups| monitor|saved-search|search-server|tcp|udp|user] enable [app|deploy-client|deploy-server|discoverable|dist-search| index|listen|local-index|boot-start|webserver|web-ssl] export,import [eventdata|userdata] find logs help NONE list [deploy-clients|exec|forward-server|index|licenser-groups| licenser-localslave|licenser-messages|licenser-pools|licenser-slaves| licenser-stacks|licenses|jobs|monitor|saved-search|search-server| source|sourcetype|tcp|udp|user] login,logout NONE package app refresh deploy-clients reload [auth|deploy-server] remove [app|exec|forward-server|jobs|licenser-pools|licenses|monitor| saved-search|search-server|source|sourcetype|tcp|udp|user] search NONE set [datastore-dir|deploy-poll|default-hostname|default-index| minfreemb|servername|server-type|splunkd-port|web-port] show [config|datastore-dir|deploy-poll|default-hostname|default-index| jobs|minfreemb|servername|splunkd-port|web-port] spool NONE start,stop,restart [monitor|splunkd|splunkweb] status [monitor|splunkd|splunkweb] Syntax: None Objects: None Required Parameters: None Optional Parameters: None Examples: None Type "help [command]" to get help with parameters for a specific command. Complete documentation is available online at: http://docs.splunk.com/Documentation root@sphs1i-fileaudit01:/opt/splunk/bin# ./splunk remove sourcetype audit.log Command error: The subcommand 'sourcetype' is not valid for command 'remove'. root@sphs1i-fileaudit01:/opt/splunk/bin# ./splunk remove sourcetype Command error: The subcommand 'sourcetype' is not valid for command 'remove'.

Karma from

User

Karma Count

1