About jeanmatthieu

jeanmatthieu · ‎10-05-2015

@somesoni2, you're awesome Sir! I did exactly what you said: source type override with transforms/props and filtering with sub search + using join to aggregate fields and my queries are flying. Thanks again!

jeanmatthieu · ‎10-01-2015

Thank you for pointing me to the advanced source type override. I should probably implement that first as follow In transforms.conf : [my_car_metadata] REGEX = *.record_type=metadata.* FORMAT = sourcetype::car_metadata DEST_KEY = MetaData:Sourcetype In props.conf: [original_sourcetype] TRANSFORMS-car_metatdata_sourcetype = my_car_metadata Of your two suggestions (creating and using lookup table as a filter and sub search) I would not know which one is the most efficient. Would you be able to illustrate one technique please ? I have seen the ease of CSV lookups before and was hoping for a similar solution with JSON based events. On a side note, naming convention in props.conf looks like a strategy of its own ! Thank again for your prompt help!

jeanmatthieu · ‎10-01-2015

They do indeed -- it would be difficult to post to a different source type as events are received through a tcp port on a heavy forwarder and safely brought to our backend afterwards. Thanks !

jeanmatthieu · ‎10-01-2015

Hey Everyone, I'm trying to extract fields from an event using a somewhat similar foreign key concept/mechanism. For the two events as below: Event#1 { colour=blue, metadata_id=1234-56, record_type=car } Event#2 { material=plastic, country_of_origin=germany metadata_id=1234-56, record_type=metadata } I would like to be able to add to Event#1 the material and country_of_origin fields so I can easily search for all blue cars made in Germany as such: index=cars country_of_origin=germany colour=blue record_type=car Could you kindly suggest how I could build fields using metadata_id as a foreign key in Event#1 that extracts the necessary info from Event #2 ? Thank you! Jean-Matthieu

jeanmatthieu · ‎01-27-2015

Adding stanzas in fields.conf on the indexer help sorting this out [serial_number] INDEXED=true or [default] # Apply to all extra _meta indexed field INDEXED=true Will there be an impact on search time extracted fields performance to add the default stanza as defined above ? Thanks!

jeanmatthieu · ‎01-22-2015

Hi, I have an inputs.conf as below in my UniversalForwarder [monitor::///private/var/log/system.log] _meta = serial_number::"ABC123456" disabled = False index = core sourcetype = osx_syslog Events are pushed nicely and search works well except for one minor issue. To search by serial numbers, I have to do index=core serial_number::ABC123456 or index=core serial_number=*ABC123456* However I wish to be able to search as such index=core serial_number=ABC123456 I would be grateful if you could help me figure out what additional configuration stanzas might be needed and hopefully this can be set on the SplunkForwarder end. Thank you for your help! Jean-Matthieu

jeanmatthieu · ‎01-09-2015

Thanks! Looks like I am set

jeanmatthieu · ‎01-09-2015

Hi! I have recently turned on LDAP authentication on my test server. It's sooooooo awesome 🙂 I can secure an index for a group of users in no time! When I move this to production, I will no longer benefit from vi etc/system/local/authentication.conf privileges and thus I am looking for a solution to modify and further configure role mapping on a live system I cannot ssh/vi into. I would be very grateful if you could point me to any REST API calls or web settings that I miss. Thank you!

jeanmatthieu · ‎10-31-2014

Either setting MAX_TIMESTAMP_LOOKAHEAD = 0 or ensuring timestamp field is always the first field of the JSON document sorted my issue.

jeanmatthieu · ‎10-31-2014

Hi, I'm running Splunk 6.1.4 and I send JSON documents through a TCP port. I have a JSON document as follow and no specific TZ settings in my props.conf { // ... "_time":"2014-11-01T02:17:34.712Z", // ... } Sometimes, the _time field within the document is used as the Time of the event. Other times, _time is transformed to a regular time field and another (random) Time fields is used. Using the above example it is not uncommon to see Time set to 11/01/14 02:17:34.000 but I also encountered the weirdest date such as 10/09/06 12:00:00.000. Any idea what might be up please? Thanks!

jeanmatthieu · ‎10-24-2014

Nice. Thank you. Is there a way to limit what gets transformed into a fields please ? The KV_MODE addition to props.conf created 15000+ fields and I only really need about 20 of these. I use _meta in the default stanza in ./etc/system/local/inputs.conf through the forwarder when pushing computer logs. I would like to create/index the same fields when pushing json from my app through tcp. Thank you for your help!

jeanmatthieu · ‎10-24-2014

Hi! I'm sending a JSON document to a TCP Data Input on my Splunk server. I noticed the magical field _time that allows me to set the time stamp the event occurred on and was hoping I could use _meta to add fields to be indexed automatically. For example, is there a way to extract 'computer' and 'browser' fields from the below JSON automatically ? { "_meta": "computer::MacBook Pro browser::Safari", "_time":"2014-10-24'T'11:59:01'Z'", } Thank you for your help, Jean-Matthieu

Posts	12
Solutions	1
Karma Given	5
Karma Received	4
Member Since	‎05-28-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to associate and create fields between 2 JSON ...

Extra indexed field in _meta require * in search q...

How to configure LDAP role mapping remotely?

JSON _time not always extracted ?

JSON, TCP Input and _meta

Re: How to associate and create fields between 2 J...

Re: How to associate and create fields between 2 J...

Re: How to associate and create fields between 2 J...

How to associate and create fields between 2 JSON ...

Re: Extra indexed field in _meta require * in sear...

Extra indexed field in _meta require * in search q...

Re: How to configure LDAP role mapping remotely?

How to configure LDAP role mapping remotely?

Re: JSON _time not always extracted ?

JSON _time not always extracted ?

Re: JSON, TCP Input and _meta

JSON, TCP Input and _meta