Hi I want to show my logs in the dashboard in a tabular form but the problem is my logs are very large hence while displaying the dashboards the _raw events column are going too far from the page, Means if user wants to check _raw events for any events he'd have to scroll the bar for too long to get to the last line of that row. The whole _raw event is showing in a single line, Is there anyway i can adjust the size of the row or split the lines in the dashboards? So that it'd be easier to read the whole row instead of having to scroll forever to get to the last word of row suppose i have 3 columns:- column1 column2 column3 10:30 PM ABC QWERTYUIOPASDFGH JKLZXCVBNMABCDEFG HIJKLMNOPQRSTUVWXYZ ^this 3rd column's value is too large to fit in the page so i have to scroll to the right to get to the last part "HIJKLMNOPQRSTUVWXYZ" i want it to be like this:- column1 column2 column3 10:30 PM ABC QWERTYUIOPASDFGH JKLZXCVBNMABCDEFG HIJKLMNOPQRSTUVWXYZ so that i don't have to scroll to the right in order to read the last part "HIJKLMNOPQRSTUVWXYZ" ... View more

Hi For whitelist:- I have following logs under my 😧 directory D:/logs/abcUSEFUL.log D:/logs/xyzUSEFUL.log D:/logs/abcWASTE.log D:/logs/xyzWASTE.log I want to forward the log files that contains "USEFUL" in between their names like from the above files only "abcUSEFUL.log" & "xyzUSEFUL.log" should be able to make their way into the indexer rest should be stopped. following is the stanza which i am using for my inputs.conf but it doesn't seem to work [monitor://D:\logs\*.log] disabled = false followTail =0 sourcetype = test whitelist = USEFUL\.log$ For Blacklist:- Suppose If i want to restrict the files which have "WASTE" in between their name then they should not get forwarded without affecting the forwarding of other files under the same directory. Any advice? Thanks 🙂 ... View more

2013-07-09-23.57.30 [SHU1_SCG1_20130913_UJDD] 2013-07-09-23.57.45 [UBH2_SCDXC1_20130913_FDS] 2013-07-09-23.57.56 [HS3_FDR1_20130924_DJUWS] 2013-07-09-23.57.57 [GFD3_FIE1_20130927_AOIS] 2013-07-09-23.58.00 [SHU1_DBXCF1_20130929_KIDD] 2013-07-09-23.58.30 [(null)] 2013-07-09-23.59.12 [(null)] 2013-07-09-23.59.30 [LIFDSDSD1_DFFDFDF1_20131004_IWD] 2013-07-09-23.59.56 [SDJER4_IUEHG1_20131009_SKIW] 2013-08-09-02.58.30 [(null)] 2013-08-09-04.18.40 [OEIFN3_SZXV1_20131013_APOS] 2013-08-09-04.32.50 [OWPOPF2_VJGGG1_20131022_SIWD] Their arrangement is like [Field1_Feild2_Feild3_Field4] and sometimes the whole event is (null) Is there any way from which i can extract all the fields(field1,field2,field3,field4) through a single regex and also the null value(null) if it occurs? Also after extracting all these fields i want to combine them into a single field(Field5) and wanna show them like "Field5=Field1_Field2_Field3_Field4" or just "Field5=(null)" if that's the case Any advice? Thanks 🙂 ... View more

Hi, I have logs some what like this ......[ABC] - [YUP1,AConsole] ......[PQR] - [YUP1,PConsole] ......[ZAD] - [YUP1,DConsole] ......[SID] - [TYU3,2013-08-29,QConsole] ......[POP] - [TYU3,2013-08-30,TConsole] ......[IOL] - [TYU3,2013-09-01,XConsole] ......[DSW] - [GKFO,2013-09-12,iConsole,Payment1] ......[ESD] - [IOSD,2013-09-13,iConsole,Payment2] ......[ABC] - [YUP1,AConsole] ......[RTS] - [YUP1,RConsole] ......[SID] - [TYU3,2013-09-26,QConsole] ......[DSW] - [GKFO,2013-10-29,iConsole,Payment3] ......[EDS] - [EDC1,FConsole] In the square brackets [(Field1),(Field2),(Field3),(Field4)] some of the fields are optional, they come and go in some events. 1st combination [(Field1),(Field3)] 2nd combination [(Field1),(Field2),(Field3)] 3rd combination [(Field1),(Field2),(Field3),(Field4)] This means Field1 & Field3 are always there in the events but Field2 & Field4 are optional, I want to extract all of them. This is the regex which i have come up with, But seems like it is not working for my case rex field=_raw "\] - \[(?< Field1 >[^,]+)(,)?(?< Field2 >[^,]+)?,(?< Field3 >[^,\]]+)(,)?(< Field4 >[^\]]+)?" PS- I have added a space between "<" and ">" because it text box was escaping it. Any help would be really appreciated Thanks 🙂 ... View more

10:32:21,453 INFO [2212] abcdxyz <-| 10:32:21,112 INFO [2212] abcdxyz | 10:32:22,409 INFO [1121] abcdxyz | 10:32:23,003 INFO [1121] abcdxyz | 10:32:23,453 INFO [2212] abcdxyz | | ............ | ............ | ............ | <---this whole block is taken as the 1st event by splunk some HTML codes | ............ | ............ | ............ | <-| 11:09:30,103 INFO [1008] abcdxyz <-| 11:09:30,409 INFO [4560] abcdxyz | 11:10:31,092 INFO [2212] abcdxyz | 11:10:31,470 INFO [2212] abcdxyz | <- this whole block is taken as the 2nd event by splunk | ............ | ............ | ............ | Some HTML codes | ............ | ............ | ............ | <-| 12:09:20,125.....and so on <-| | <- 4th event . . <-. . <- 5th event . <-. I don't know why splunk is not breaking the lines when it finds the timestamp instead of that it is combining few lines as if they are single event though they have different timestamps Is there any way i can split these lines according to the timestamp? FYI- I am using splunk universal forwarder(Windows) and splunk indexer(Linux) Thanks 🙂 ... View more