About SalimRahmani

SalimRahmani · ‎07-18-2014

Thank you guys for your awesome replies! Though I have small questions. I tried the expression and it worked. I mean when I say it worked it created a new field called firstdate however it is: a NUMBER??!!! (weird!) The second thing is that I've done the same thing for the last which is kinda the SAME thing but it didn't work at all! Any insight ?! :$ Thanks!!!

SalimRahmani · ‎07-17-2014

Hi, After setting up a listen on UDP port (514) for syslog using inputs.conf, I tried to change the sourcetype from syslog (set in inputs.conf) to syslog_nf. Thus, i used the first method props.conf [source::udp:514] sourcetype = syslog_nf this doesn't change anything! However, when I do: [syslog] rename = syslog_nf the change happens! Does anyone have any idea about this?

SalimRahmani · ‎07-17-2014

Sorry buddy, I found the problem. It was a referencing problem between props.conf and transforms.conf ! Yeah sometimes I'm dumb haha! though I appreciate your help!

SalimRahmani · ‎07-17-2014

Hello, I'm receiving syslog data stream on UDP port 514. The event is: Jul 17 15:32:00 salim-VPCEB1E1E SplunkNetflowApp.py[20084]: af= 2 first= 2010-04-15 05:44:19 last= 1970-01-01 00:00:00 proto= udp srcip= 10.0.1.6 srcport= 2104 dstip= 10.0.4.6 dstport= 456 srcas= 2 dstas= 3 input= 3 output= 5 flags= 0 tos= 80 dscp= 20 packets= 1 bytes= 64 Using the configuration files, I could extract the fields. However, first and last are extracted as Strings though they are DateTime types. Please does Splunk enable you to extract these as dates so that you can use them in search? Thanks in advance,

SalimRahmani · ‎07-17-2014

actually can you tell me which log file to look in ?!

SalimRahmani · ‎07-17-2014

Hello, I'm creating an add-on that sets a data source and fields extractions. First, I modify inputs.conf to set the UDP port. Then, using props.conf and tranforms.conf, I perform the field extractions. When I check on the web platform, (Manage -> Fields -> select the app) I can clearly see the list of fields. However, running the search none of the fields has been extracted. Please note that I've restarted the splunk instance to apply changes, double checked the name of the config files. Plus, everything was working perfectly yesterday. Please is there anyone who can help,

SalimRahmani · ‎07-16-2014

Thank you so much Ayn! It was the firewall actually.

SalimRahmani · ‎07-16-2014

Hi guys, Thank you so much for your answers! Actually, it was my firewall that Splunk couldn't index. So I created a new rule in the inboud firewall. Now it works perfectly! Thanks again!

SalimRahmani · ‎07-15-2014

Hello, I've written a script in python that forwards Syslog to a remote server. For testing, it's just my second laptop. On this second one, I've checked using tftp and wireshark tools to see whether the syslog is received or not. It is! However, when I configure splunk to receive the syslog data by listening to a UDP port (default 514 or sometimes i changed it) I have nothing indexed though I receive no error. I'd be grateful if you could help me! Thanks in advance,

SalimRahmani · ‎07-13-2014

Thank you my friend I really appreciate your help! I will try it right now. Thanks again and have a nice day!

SalimRahmani · ‎07-12-2014

Hello, I need to create a technology add-on, before so, i started reading the documentation (this: article) they asking me to locate a zip folder called "TA-Template.zip" but I didn't find it. It seems that it's important to get started and i'm running out of time. I'd really appreciate if you can help me. Thanks in advance,

Posts	11
Solutions	1
Karma Given	5
Karma Received	5
Member Since	‎07-12-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to rename sourcetype in props.conf?

Can you extract date fields to use them in a searc...

Problem with fields extractions using configuratio...

Why isn't syslog data being indexed by Splunk conf...

TA-Template.zip not found

Re: Can you extract date fields to use them in a s...