Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About psyched4splunk
psyched4splunk
Explorer
Member since:
06-20-2019
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 06-20-2019 |
Activity Feed
- Karma Re: Can I dynamically set the default host value using a Universal Forwarder? for gcusello. 06-05-2020 12:50 AM
- Karma Re: Can I dynamically set the default host value using a Universal Forwarder? for gcusello. 06-05-2020 12:50 AM
- Karma Re: How to configure source_type to regex value? for cpetterborg. 06-05-2020 12:50 AM
- Karma Re: How to configure source_type to regex value? for amitm05. 06-05-2020 12:50 AM
- Karma Re: How to configure source_type to regex value? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How to extract sourcetype and index with a regex from the monitor path directory structure? for jnudell_2. 06-05-2020 12:50 AM
- Posted Re: Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 12:29 PM
- Posted Re: Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 10:08 AM
- Posted Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 08:28 AM
- Tagged Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 08:28 AM
- Tagged Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 08:28 AM
- Tagged Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 08:28 AM
- Tagged Can I dynamically set the default host value using a Universal Forwarder? on Getting Data In. 07-16-2019 08:28 AM
- Posted Re: How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 04:11 PM
- Posted Re: How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 04:09 PM
- Posted Re: How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 11:39 AM
- Posted How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 09:45 AM
- Tagged How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 09:45 AM
- Tagged How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 09:45 AM
- Tagged How to extract sourcetype and index with a regex from the monitor path directory structure? on Splunk Search. 06-24-2019 09:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
07-16-2019
12:29 PM
The host that has the UF installed on it.
... View more
07-16-2019
10:08 AM
Yes that's correct.
However a more important part of my question is if setting host_segment and host_regex is dependent on the forwarder?
Can I dynamically set the host on a universal forwarder or no?
I haven't found a clear answer to this question.
I ask because I'm trying to do it on the Universal Forward and it's not working for me as I've included my inputs.conf above.
... View more
07-16-2019
08:28 AM
I'm using host_regex on a Universal Forwarder.
inputs.conf
[monitor:///app/splunkforwarder/logs/containername/*.log]
interval = 1800
host_regex = \/app\/splunkforwarder\/logs\/(.*?)\/*.log
From my understanding this should set container name as the host_regex.
However this isn't working, what am I doing wrong and how can I fix it?
... View more
06-24-2019
04:11 PM
"I'm not sure if you're able to do that"...
Yeah I don't see much documentation on how to do this but I guess I don't understand why this is unattainable?
... View more
06-24-2019
04:09 PM
Yes I found useful and accepted your solution in regards to using a HF. However this is a separate question in which I want to know can I just set the sourcetype and index = regex like below?
I don't see much documentation on how to do this but I guess I don't understand why this is unattainable?
input.conf
#apache or nginx
[monitor:///apps/.../.../.../*.log.*]
sourcetype = ( REGEX = ^source::(?:/[^/]+){1}/([^/]+)/ ): ( REGEX = ^source::(?:/[^/]+){2}/([^/]+)/ )
index = (REGEX = ^source::(?:/[^/]+){0}/([^/]+)/ )
blacklist = \.(zip|gz)$
Your solution here is still referencing a HF and that's not what I'm inquiring about.
... View more
06-24-2019
11:39 AM
Yes, in this case it makes sense to separate the stanza's.However I didn't in my example because I wanted to see if there was a way to not hard code it as you did here.
... View more
06-24-2019
09:45 AM
My end goal is to extract the sourcetype and index with a regex from the monitor path at runtime based on a lookup from the directory structure.
For example in the case of apache
actual monitor path will look like:
/apps/apache/http/access/http-access.log
OR
/apps/nginx/http/access/http-error.log
input.conf
#apache or nginx
[monitor:///apps/.../.../.../*.log.*]
sourcetype = ( REGEX = ^source::(?:/[^/]+){1}/([^/]+)/ ): ( REGEX = ^source::(?:/[^/]+){2}/([^/]+)/ )
index = (REGEX = ^source::(?:/[^/]+){0}/([^/]+)/ )
blacklist = \.(zip|gz)$
Desired output:
Splunk sends all apache access logs from /app/apache/http/access/http-access.log with index=apache and sourcetype = http:access
and splunk also sends all nginx error logs from /apps/nginx/http/error/http-error.log with index=nginx and sourcetype=http:error
... View more
06-21-2019
12:17 PM
My end goal is to extract the sourcetype and index with a regex from the monitor path at runtime based on a lookup from the directory structure.
For example in the case of apache
actual monitor path will look like:
/apps/apache/http/access/http-access.log
OR
/apps/nginx/http/access/http-error.log
input.conf
#apache or nginx
[monitor:///apps/.../.../.../*.log.*]
sourcetype = ( REGEX = ^source::(?:/[^/]+){1}/([^/]+)/ ): ( REGEX = ^source::(?:/[^/]+){2}/([^/]+)/ )
index = (REGEX = ^source::(?:/[^/]+){0}/([^/]+)/ )
blacklist = \.(zip|gz)$
Desired output:
Splunk sends all apache access logs from /app/apache/http/access/http-access.log with index=apache and sourcetype = http:access
and splunk also sends all nginx error logs from /apps/nginx/http/error/http-error.log with index=nginx and sourcetype=http:error
... View more
06-20-2019
03:57 PM
I'm using a Universal Forwarder and want Splunk to return source_type as what's defined for source within the monitor path(/.../).
Please see my configuration files below.
Inputs.conf
#apache
[monitor:///apps/web/test/sfagent/.../*.log.*]
sourcetype = replace_sourcetype_with_segment_5_from_source
blacklist = \.(zip|gz)$
index = web
Transforms.conf
[replace_sourcetype_with_segment_5_from_source]
SOURCE_KEY = MetaData:Source
REGEX = ^source::(?:/[^/]+){4}/([^/]+)/
FORMAT = sourcetype::replace_sourcetype_with_segment_5_from_source
DEST_KEY = MetaData:Sourcetype
Props.conf
[replace_sourcetype_with_segment_5_from_source]
TRANSFORMS-replaceSourcetype = replace_sourcetype_with_segment_5_from_source
After some digging I discovered I can't use transforms.conf on a Universal Forwarder. Is this absolutely true?
If yes, is there a way to get Splunk to grab the source_type from the metadata and display it within the monitor path without using a heavy forwarder?
... View more
