About circleup

TStrauch · ‎10-17-2016

Ok i found a way you can do it. Define your Tranforms. Go to Data --> Sourcetypes --> Select the sourcetype on which you want to add the Transfomrations --> Click edit --> click advanced --> click "new setting" Fill the first Field with "REPORT-yourreportname" and the second with "yourtransformationname" this works. i tested it.

circleup · ‎02-09-2017

Can you clarify how you "set up the class so all [your] servers are included for this app"? When I try to edit apps for my server classes, I don't see this add-on available. And when I go to "Set Up" for the add-on, it just points me to the documentation. I'd prefer to not have to manually install it on every forwarder but rather have them deployed centrally. Thanks!

circleup · ‎08-02-2016

Finally figured it out. Appears the missing piece was I had to manually go to the menu and select "Restart". I falsely assumed that the web UI would automatically handle reloading sourcetypes after they've been edited. That does not appear to be the case. A warning message (e.g. "These changes will not take effect until the server has been restarted" or "Would you like to restart to make these changes take effect?") would be nice.

Posts	8
Solutions	1
Karma Given	6
Karma Received	0
Member Since	‎06-21-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do I add a new field extraction using transfor...

Can't get events to split at desired breaks

Re: How do I add a new field extraction using tran...

Re: Splunk Add-on for Unix and Linux: Is there a w...

Re: Can't get events to split at desired breaks