About maria1991

maria1991 · ‎08-24-2022

We do not have any monitor stanzas in the inputs.conf our app @somesoni2 . The inputs look like this [ta_vmware_collection_worker://alpha] capabilities = hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event log_level = INFO disabled = 1 interval = 15 index = vmware-vclog [ta_vmware_collection_worker://beta] capabilities = hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event log_level = INFO disabled = 1 interval = 15 index = vmware-vclog [ta_vmware_collection_worker://gamma] capabilities = hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event log_level = INFO disabled = 1 interval = 15 index = vmware-vclog The index parameter is not actually there by default. I have added and tried but no luck. We have another conf file ta_vmware_collection.conf in which we have below parameters under [default] stanza. perf_index = vmware-perf inv_index = vmware-inv taskevent_index = vmware-taskevent The script refers to these entries only to index the data. Even though these indexes are available in the indexes.conf of the addon we pushed(SA-VMWIndex) to our indexer cluster, the data is still going into lastchance index. I have also tried index forcing on each sourcetype in the props with help of transforms. No luck 😞

maria1991 · ‎08-24-2022

@somesoni2@micahkemp Any suggestions please?

maria1991 · ‎08-23-2022

Hi All I have configured Splunk_TA_vmware along with SA_Hydra in our HF to collect data from vcenter. I have also installed VMWIndex add-on on Indexer clusters as suggested in the documentation. However the data is going to lastchance index when I was hoping the VMWIndex add-on would take care of the proper index configuration. Is there any additional configuration I need to do to get the logs into the indexes created by VMWIndex addon. Attaching the indexes.conf file from the addon. Tried adding index=index_name in the inputs.conf of Splunk_TA_vmware addon, but no luck. It is not getting any effect and still going into lastchance index only. Kindly suggest.

maria1991 · ‎01-19-2022

Just adding the keyword asdf worked for me 🙂 Thanks

maria1991 · ‎01-18-2022

Hi All I have a sourcetype in which we have some events with a keyword like asdf. In some events it comes in between and some events at the end. I need to forward all these logs to another sourcetype with props and transforms. [generic_sourcetype_routing_asdf] REGEX = DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::asdf_logs props.conf [current_sourcetype] TRANSFORMS-sourcetype_routing = generic_sourcetype_routing_asdf In the REGEX part I would like to know if only keeping asdf or *asdf * would work. I can't put the regex for complete log format since there are multiple formats. So I need to inform splunk to pass any event with asdf anywhere in it should be forwarded to the new one. Please suggest. Thanks Maria Arokiaraj

maria1991 · ‎12-29-2021

----------------------------------------------------------------- some text ----------------------------------------------------------------- These lines won't have any timestamps, need to complete ignore them from indexing.

maria1991 · ‎12-29-2021

What if I need to remove the line in between the ---- lines as well? Please suggest @Lowell and @dshpritz

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎12-29-2021

Online Status	Offline
Date Last Visited	‎08-25-2022 09:19 AM

Are there any additional Splunk_TA_vmware index co...

Regex needed for sourcetype forcing

Re: Are there any additional Splunk_TA_vmware inde...

Re: Are there any additional Splunk_TA_vmware inde...

Are there any additional Splunk_TA_vmware index co...

Re: Regex needed for sourcetype forcing

Regex needed for sourcetype forcing

Re: using SEDCMD to remove repeated lines

Re: using SEDCMD to remove repeated lines