×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
pratik_18
Explorer
Member since: ‎07-07-2021
‎07-15-2021
Community Statistics
Posts 3
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎07-07-2021
Topics I've Started
No posts to display.
View All

Re: Parse Windows Logs from log source AWS Cloudwa...

by in Getting Data In
‎07-15-2021 06:45 AM
‎07-15-2021 06:45 AM
Polishing the config files above. Below conf files worked perfectly for me #props.conf [aws:cloudwatch:s3] TRANSFORMS-field_extraction_aws_windows_logs = parse_windows_logs_prefix,parse_windows_logs_suffix #Transforms.conf [parse_windows_logs_prefix] REGEX = \[(?<LogName>.*?)\]\s+\[(?<Type>.*?)\]\s+\[(?P<EventCode>\d+)]\s+\[(?P<SourceName>.*?)\]\s+\[(?P<ComputerName>.*?)]\s+\[(?P<message>[^.]+.)\s(?P<body>[^]]+.) FORMAT = LogName::"$1" Type::"$2" EventCode::"$3" Sourcename::"$4" ComputerName::"$5" message::"$6" body::"$7" WRITE_META = true [parse_windows_logs_suffix] SOURCE_KEY = field:body REGEX = (?m)^\s*(?<name>[^:]+):[\t ]+(?<value>.*)$ FORMAT = "$1"::"$2" REPEAT_MATCH = true WRITE_META = true ... View more

Re: How do I solve "Listen Claim" issue when getti...

by in Getting Data In
‎07-07-2021 04:23 AM
‎07-07-2021 04:23 AM
can some one help with this issue, I am also facing the same issue while transitioning from the old add-on to new add-on. ... View more

Re: How do I solve "Listen Claim" issue when getti...

by in Getting Data In
‎07-07-2021 04:23 AM
‎07-07-2021 04:23 AM
can some one help with this issue, I am also facing the same issue while transitioning from the old add-on to new add-on. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎07-15-2021 02:18 PM
Karma given to
View All