×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
catty
Engager
Member since: ‎08-21-2011
‎06-05-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎08-21-2011
Activity Feed
View All

Re: Sourcetype cannot work with RENAME

by in Splunk Search
‎10-03-2011 09:16 PM
‎10-03-2011 09:16 PM
that work great help..! thank you very much.. FIXED! ... View more

Sourcetype cannot work with RENAME

by in Splunk Search
‎10-03-2011 08:28 PM
‎10-03-2011 08:28 PM
I trying to rename sourcetype for this regex but won't work but when i remove the rename = httpd-access its work? [access] rename = httpd-access EXTRACT-ip = [(?P [^]]+) EXTRACT-host = (?i)^[^,]*,\d+\s+(?P [^ ]+) i using splunk Uforwarder [monitor:///opt/log/*] sourcetype = access ... View more

Re: Add tag in splunk display for jboss class

by in Knowledge Management
‎09-27-2011 02:52 AM
‎09-27-2011 02:52 AM
yes you right Ayn. Thank you very much for your help, very helpful. This is my regex [(?P [^]]+) FIXED. ... View more

Re: Add tag in splunk display for jboss class

by in Knowledge Management
‎09-26-2011 04:48 AM
‎09-26-2011 04:48 AM
Thank you very much for your reply I already try to use Example values like this: [org.jboss.ejb3.interceptors.aop.InterceptorsFactory] [com.testo.xchange.action.FolderSelector] [org.jasig.cas.client.validation.Cas10TicketValidationFilter] but the result is: The generated regex was unable to match all examples. this is the sample log file: 2011-09-26 14:38:50,642 WARN org.jboss.ejb3.interceptors.aop.InterceptorsFactory EJBTHREE-1246: Do not use InterceptorsFactory with a ManagedObjectAdvisor, InterceptorRegistry should be used via the bean container 2011-09-26 14:38:50,333 INFO com.testo.xchange.action.FolderSelector set folder page to : maknyus_banget 2011-09-26 14:37:54,428 WARN org.jboss.ejb3.interceptors.aop.InterceptorsFactory EJBTHREE-1246: Do not use InterceptorsFactory with a ManagedObjectAdvisor, InterceptorRegistry should be used via the bean container 2011-09-26 14:35:35,332 INFO org.jasig.cas.client.validation.Cas10TicketValidationFilter Property [serverName] loaded from FilterConfig.getInitParameter with value [http://192.168.9.19:8080] can you give me some sample to make select just insert the bracket or by colomn four for my case? ... View more

Add tag in splunk display for jboss class

by in Knowledge Management
‎09-26-2011 03:03 AM
‎09-26-2011 03:03 AM
Can we add another tag display in splunk layout? like : host=server.me.local | sourcetype=jboss_serverlog_apps | source=/opt/log/server.log | jbossclass=[this the adding tag] my goal is, if i have some log like this[jboss log]: 2011-09-26 12:35:25,588 WARN org.jboss.resource.connectionmanager.TxConnectionManager Connection error occured: we can select text where is insert the bracket "[]" into some tag. then the tag will displayed in splunk tag, after the source tag. so the result like this: host=server.me.local | sourcetype=jboss_serverlog_apps | source=/opt/log/server.log | jbossclass=org.jboss.resource.connectionmanager.TxConnectionManager Its possible? greatly appreciate every reply. Thank yours for help. Best regards, Catty M. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All