About hchen11

hchen11 · ‎11-02-2020

finally I used REGEX = (\S+)=([^=]*)(?:\h+|$)

hchen11 · ‎10-30-2020

Hi @gcusello , I did not consider this issue carefully before: whether we need to extract at index time. Could you provide more details about how should I make a decision? About resources, we had around 20 index servers and 3 search servers. About users and searches, around 3 users will use the search and do 100 searches daily and averagely. Furthermore, not all fields exist in every event. Our discussion is pretty meaningful for me, hope I can get more suggestion from you.

hchen11 · ‎10-30-2020

Hi @gcusello, we don't want to impact performance when searching, and that's the main reason we want to do extraction at index time. We have around 50 fields in logs, is it too many or not?

hchen11 · ‎10-30-2020

Hi @gcusello , Yes, what I mean is extracting fields at index time. What should I do if I want to use it at index time? Should I just change REPORT-* to TRANSFORMS-* and source these configs in indexer server?

hchen11 · ‎10-30-2020

Hi @gcusello , I would like to use REGEX in transforms.conf but not in Splunk Web UI. Another question, should I use index-search in index server (search head)?

hchen11 · ‎10-29-2020

Hi, I have log like following rid=iqwenoasd service=CP scopes=add-w,oot-s fields=birthdate,emails,identifier issuer=AWS CA TE empty= my expected key-value pairs are like this rid=iqwenoasd service=CP scopes=add-w,oot-s fields=birthdate,emails,identifier issuer=AWS CA TE empyt=null since there are some special cases in it (value has space character, value is empty), how can I use REGEX in search servers to achieve that? it seems using ([^=]+)=(.+) doesn't work in transforms.conf [cp_logs_report] REGEX = ([^=]+)=(.+) FORMAT = $1::$2 in props.conf [my_sourcetype] REPORT-cp-logs-ext = cp_logs_report

Posts	7
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎10-28-2020

Online Status	Offline
Date Last Visited	‎11-02-2020 08:17 PM

how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

how to handle this kind of log using REGEX

Are you a member of the Splunk Community?

how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

Re: how to handle this kind of log using REGEX

how to handle this kind of log using REGEX