About Alexandre_Nizou

Alexandre_Nizou · ‎11-22-2010

Did not change a thing, yet when I do a 'index=main source="/etc/syslog-ng/syslog-ng.conf"' I do see 2 different revisions of the file.

Alexandre_Nizou · ‎11-17-2010

Using diff in a search, the interface shows the following message: Pop from empty string The search is the following: index=main source="/etc/syslog-ng/syslog-ng.conf" | diff Source exists in the correct index, and without the diff it will show raw content revisions of said file. What am I doing wrong? Thanks.

Alexandre_Nizou · ‎11-17-2010

My syslog-ng is indeed configured to send logs as tcp flow. Parsing log files are fine, but seems to me that it is more configuration than necessary if the solution to this question could be found. There is nothing vital in changing the sourcetype though, a simple process=xxx in a search would work as well when field is properly extracted.

Alexandre_Nizou · ‎11-15-2010

Does it work on UDP?

Alexandre_Nizou · ‎11-15-2010

Yes, my logs are coming in from TCP. I did not yet find an working answer. Hopefully you will 🙂

Alexandre_Nizou · ‎11-04-2010

Just to make sure I am not wrong on my test procedure, is restarting the splunkd enough to apply changes made to props.conf and transforms.conf? Thanks.

Alexandre_Nizou · ‎11-04-2010

Also tried a simple regex to make sure problem is not about matching... Still no go 😞

Alexandre_Nizou · ‎11-03-2010

Tried removing it but not go. I also removed the sourcetype=syslog from the inputs.conf but now sourcetype is just tcp_raw.

Alexandre_Nizou · ‎11-03-2010

Hi everyone. Quite new to the product, I am struggling a bit. All my logs are coming through syslog on TCP 514 and I am trying to get chance the sourcetype based on the name of the service logged, for example: 2010-11-03T16:54:26+01:00 canary.xxxxxxx.net named 17889 - - queries: info: client 127.0.0.1#57983: query: allsaintsfan-com-bk.mr.outblaze.com IN A + 2010-11-03T16:54:26+01:00 canary.xxxxxxx.net kernel - - - IPv6 addrconf: prefix with wrong length 56 Can anybody point me to the right direction? So far I have: input.conf [tcp://514] connection_host = dns source = syslog-tcp props.conf [source::syslog-tcp] TRANSFORMS-sourcetype = override-sourcetype transforms.conf [override-sourcetype] DEST_KEY = MetaData:Sourcetype REGEX = \d{4}-?\d{2}-?\d{2}\D?\d{2}:\d{2}:\d{2}[+-]?\d{2}:\d{2}\s\S+\s(\S+) FORMAT = sourcetype::$1 Can anybody figure out what's not working in there? Thank you in advance.

Alexandre_Nizou · ‎11-01-2010

If you want to test your regular expressions on the spot, use the online http://www.regexpal.com/. Take your REGEX and copy it in the first box, take the logs you are trying to match and copy them in the second box... et voila!

Posts	10
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎10-29-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

What does "pop from empty list" mean?

Changing sourcetype of incoming TCP syslogs

Re: What does "pop from empty list" mean?

What does "pop from empty list" mean?

Re: Changing sourcetype of incoming TCP syslogs

Re: Changing sourcetype of incoming TCP syslogs

Re: Changing sourcetype of incoming TCP syslogs

Re: Changing sourcetype of incoming TCP syslogs

Re: Changing sourcetype of incoming TCP syslogs

Re: Changing sourcetype of incoming TCP syslogs

Changing sourcetype of incoming TCP syslogs

Re: Regex crash course?

Are you a member of the Splunk Community?