About lbruhns

lbruhns · ‎12-02-2021

came here for same question

lbruhns · ‎04-09-2021

I have an admin on demand ticket open for this right now, did you ever get resolution?

lbruhns · ‎04-02-2021

info on this seems sparse i have a similar challenge with k8s coing over hec, i'd like to be able to have more htan one index per token but how does it route?

lbruhns · ‎03-09-2021

This Worked great using rex field=@mt max_match=0 "{(?<replacement_fields>[^}]+)" | eval message='@mt' | foreach * [ | eval message=coalesce(replace(message, "{".mvindex(replacement_fields, mvfind(replacement_fields, "<<FIELD>>"))."}", '<<FIELD>>'), message) ] (?<!\{){(?!\{)(?<replacement_fields>[^}]+) this regex managed the escaped brackets now i'll try to somehow make this part of the sourcetype, more likely i'll make a macro. the lookup table solution is not desireable, with the template in the log it gives the developers complete control to change the message to meet their needs without having to have a process for adding or appending templates

lbruhns · ‎03-05-2021

i have application logs which contain a message template in a json field (@mt) to convert other json fields into a human readable message. The content of that field will look like {RequestProtocol} {RequestMethod} {RequestPath} responded {StatusCode}. the text in the {} corresponds to the keys in key value pairs in the rest of the json i made this eval eval message="\"".replace(replace(spath(_raw, "@mt"),"{", "\"."),"}",".\"")."\"" this returns message="".RequestProtocol." ".RequestMethod." ".RequestPath." responded ".StatusCode."" it dispays the key names rather than the values in that same search i have eval test=" ".RequestProtocol." ".RequestMethod." ".RequestPath." responded ".StatusCode."" that returns test=HTTP/1.1 POST /path/to/thing responded 202 this returns the values. how can i create an eval that forms the message from the template? i would love to make this part of the sourcetype

lbruhns · ‎11-06-2020

it does reach to the dep server through the UF installed on it the same one that sends all the OS logs for the server its installed on. I am thinking a script that builds the env file the same way splunk builds the conf files from all the apps into one conf. I was hoping someone in the community had done it if not maybe I'll give it a shot.

lbruhns · ‎11-06-2020

we have a SC4S server for both prod and dev environments and would like to use the deployment server to manage the SC4S Configs like environment files and metadata.csv is this possible?

Posts	7
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎11-06-2020

Online Status	Offline
Date Last Visited	‎04-28-2022 05:36 PM

dynamic eval statement from a template contained i...

Manage SC4S config with Deployment Server

Re: How to raise the alert for sourcetype=netstat

Re: AD FS Audit Logs (ADFS Audit) XML issues

Re: Unable to send data to multiple indexes using ...

Re: dynamic eval statement from a template contain...

dynamic eval statement from a template contained i...

Re: Manage SC4S config with Deployment Server

Manage SC4S config with Deployment Server

Join the Conversation