About carmitstead

carmitstead · ‎10-14-2015

Try removing "daemon." (remove the '.' also). Certain versions of puppet don't contain daemon in the strings. I've had to customize most of the searches.

carmitstead · ‎01-20-2015

Found it. Instead of finding it in my deploymentclient app's serverclass.conf, I found the filterType directives in my $SPLUNK_HOME/etc/system/local/serverclass.conf. They are commented and the errors are gone.

carmitstead · ‎01-20-2015

Thanks for the answer. I don't have it specified anywhere that I know of. But I'll do a thorough check.

carmitstead · ‎01-20-2015

I'm also getting this error message. The filterType directive is not declared at the global or app level at all. Thinking that I have to declare it in each stanza?

carmitstead · ‎12-12-2014

I'd like to create a custom name for a common sourcetype. For instance: inputs.conf [monitor:///my/special/directory] sourcetype = custom_syslog props.conf [custom_syslog] Some configuration to make this custom sourcetype format logs like the syslog sourcetype would be formatted [source::/my/special/directory] sourcetype = custom_syslog Rename does this in the reverse. I could rename my custom field to syslog with 'rename = syslog' in my props.conf, but that wouldn't help me. I want the behavior, but not the name of the default sourcetypes.

Posts	5
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎07-22-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Create aliases for common sourcetypes

Re: Resources 0 and results not found

Re: Forwarder Management Issue

Re: Forwarder Management Issue

Re: Forwarder Management Issue

Create aliases for common sourcetypes