About ipteam

ipteam · ‎01-23-2023

Hello Jamie, Works, thanks a lot!

ipteam · ‎01-23-2023

Yes, would be great, but this filed is not equal to the generated time of the log. Unfortunatly it's a custom one. Also interested in the regex what splits _time filed to day,hour.. and so on.

ipteam · ‎01-23-2023

Hello Guys, I'd like to create a search based on business hours, and like to use a field with value like this: "2023/01/20 08:52:58" The bold number would be interesting, and like to search with multiple values. example 08-18h [08,09,10,11,12,13,14,15,16,17,18] How could I find a regex to extract theese numbers? thanks a lot!

ipteam · ‎07-11-2018

Thank you guys. As i see splunk has no native support for this scenario....

ipteam · ‎03-29-2018

Use _syslog_routing in inputs.conf : _SYSLOG_ROUTING = server1, server2 and outputs.conf [syslog:server1] server = x.x.x.x:port type=tcp [syslog:server2] server = x.x.x.x:port type=tcp

ipteam · ‎03-29-2018

You can try index=* to see which indexes you have any log. After that use index=selected_one

ipteam · ‎03-29-2018

There was not any problem about inputs, but in props.conf. BTW i have found the solution. I made a custom sourcetype (radacct) which i can handle in props.conf, no need to recursive search in directories.

ipteam · ‎03-28-2018

Thaks for reply. Half of the problem already solved, now i parse the log correctly after including the stanza to props.conf. The next question would about the props.conf configuration. I have a recursive file monitoring stanza in inputs.conf which continually reads the raddact log from different files in different directories. recursive=true in inputs.conf helped to monitor all the files, but i cannot transform the whole directory via props.conf. As i see i only can add a file or a directory but not recursively to the whole structure. Here are the config : inptuts.conf.: [monitor:///var/log/freeradius/radacct] recursive = true sourcetype = syslog props.conf.: [source::/var/log/freeradius/radacct/] SHOULD_LINEMERGE = true REPORT-vievents = vievents_extractions BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat)

ipteam · ‎03-27-2018

Hello, I'd like to monitor raddact files. I have the following config in inputs.conf.: [monitor:///var/log/freeradius/radacct] recursive = true sourcetype = syslog The main problem is about line-breaking. I'd like to the whole event, but I get one event per line. How can i configure props.conf to see the whole event? It is possible recursive on the whole directory as well ? Thanks,

Posts	9
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-02-2017

Online Status	Offline
Date Last Visited	‎02-24-2023 10:24 AM

How to use multiple numbers in search?

monitoring freeradius raddact files

Re: use multiple numbers at search

Re: use multiple numbers at search

How to use multiple numbers in search?

Re: syslog redundancy

Re: How to send Windows events to indexer and als...

Re: How do I view events in an index?

Re: monitoring freeradius raddact files

Re: monitoring freeradius raddact files

monitoring freeradius raddact files

Join the Conversation