Hi, I have an HFW and indexer in my environment. I'm looking to filter certain events from the log source in HFW based on REGEX while indexing in the indexer.  Please find below the config files. Not sure where I'm going wrong.   props.conf [testing] TRANSFORMS-routing = conGroup   inputs.conf [monitor:///var/logs] disabled = false index = main sourcetype =. testing host = HFW     transforms.conf [conGroup] REGEX = ^(((?!i-)(?!sample)).)*$ DEST_KEY=_TCP_ROUTING FORMAT=test   outputs.conf [tcpout] defaultGroup = nothing   [tcpout:test] server = X.X.X.X:9997   Any help will be. much appreciated. Thanks in advance ... View more

Hi, I'm using the below line, while creating custom command for key value field extraction. My events are in json format. I would like to know the format in which the events are retrieved while the below line is given (string) or type of json_event. json_events = splunk.Intersplunk.readResults(None, None, True) I have also attached the entire script for your reference. I think I'm having problems while loading the json event import json import sys import csv import splunk.Intersplunk (isgetinfo, sys.argv) = splunk.Intersplunk.isGetInfo(sys.argv) json_events = splunk.Intersplunk.readResults(None, None, True) for json_event in json_events: json_data = json.load(json_event) fields = (json_data['Fields']) for f in fields: if not f['values']: json_event[f['Name']] = 'null' elif 'value' not in f['values'][0]: json_event[f['Name']] = 'null' else: json_event[f['Name']] = f['values'][0]['value'] splunk.Intersplunk.outputResults(json_events) Thanks in advance ... View more

Hi, I am trying to extract fields from a JSON input. I don't understand if I am making any mistake in getting the events or in output. Below is my python script: import splunk.Intersplunk json_events = splunk.Intersplunk.readResults(None, None, True) for json_event in json_events: json_data = json.load(json_event) fields = (json_data['Fields']) for f in fields: if not f['values']: json_event[f['Name']] = 'null' elif 'value' not in f['values'][0]: json_event[f['Name']] = 'null' else: json_event[f['Name']] = f['values'][0]['value'] splunk.Intersplunk.outputResults(json_events) and the below snippet is a sample json event. { "Type": "defect", "Fields": [ { "values": [], "Name": "ut2" }, { "values": [ { "value": "SF" } ], "Name": "ut3" }, { "values": [ { "value": "2" } ], "Name": "vs" }, { "values": [ { "value": "N" } ], "Name": "attached" }, { "values": [ { "value": "vh" } ], "Name": "pri" }, ], } I have stored them as dictionary (key, value pairs). I am getting error "External search command 'jsonfields' returned error code 1" any suggestions? Thanks in advance ... View more