About b4ggio

b4ggio · ‎07-19-2011

I cannot reference the field that has been extracted using the earliest::$Fieldname$, either that or the map command as others have indicated on other posts is not working properly.

b4ggio · ‎07-19-2011

Sorry perhaps my request was quite vauge, I want to automate this to complete for each change request line that I have. Therefore the search time should be as large a space of time as required to complete all changes for a given seach, therefore I need to use the two fields similarly to a transaction that includes startswith endswith.

b4ggio · ‎07-19-2011

I have a log file that contains multiple fields that are time oriented fields. The fields in this instance are the start time and end time of a change request. I would like to use the fields as start and end markers in a transaction to show me all system events that have occurred during the time window. The unique identifier will be the Hostname. Log source with time fields. Date:18/06/2011 10:00:00 Hostname:Foo Start:18/06/2011 15:00:00 End: 18/06/2011 15:00:00 Then I have all the system events. I would like to pull all the system events together that happened in the window above for the hostname.

b4ggio · ‎04-07-2011

I am also keen to see what the data looks like as mentioned by southeringtonp. Have you thought about doing data enrichment using a lookup of some unique data and then using the new field to transact on.

b4ggio · ‎04-07-2011

The Time is configured within the /opt/splunk/etc/apps/<>/local and the file props.conf, you may have to create this file and choose your stanza and date time methods. Its all explained here http://www.splunk.com/base/Documentation/latest/admin/propsconf if you search or scroll to "Timestamp extraction configuration" To teach splunk to recognise the files and to pull the information through in a report you should look at field extraction as you can write a regex that names each field based on the delimeter being a semicolon and the choose the field number. Fortunately Splunk will also do this for you if you use the extract field wizard. Hope this helps.

b4ggio · ‎02-24-2011

Hi Guys, The scenario that I am building is to use a dynamic txt or csv file to refine the search of an index full of syslog. I have index=syslog that contains incoming syslog for 1000 servers, however for this specific scenario I only care about 150 high value hosts. Rather than searching index=syslog HOST1, HOST2 etc etc I would like to call on a CSV or txt file that contains the host names of the high value targets and create a search similar to index=syslog | search host=/opt/splunk/test/host.csv I have been toying with using the transaction command to make this work but it provides undesirable outputs and I believe there should be an easier way...... Python is also an option I just hoped that splunk would have a field lookup option that does not consists of find and replace. Thanks

Posts	6
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎02-24-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Transactions/Stats?

Using a Static list to refine your search

Re: Transactions/Stats?

Re: Transactions/Stats?

Transactions/Stats?

Re: How to build a transaction from multiple, some...

Re: Teach Splunk 4.2 to identify positions in a CS...

Using a Static list to refine your search

Join the Conversation