About jones4bob

jones4bob · ‎01-11-2013

If you find it acceptable to not be completely real time, I would recommend setting up log subscriptions and opting to forward them off to splunk via SCP. When you create this log subscription (System Administration->Log subscriptions) Ironport will supply you with a key that you can copy/paste into the .authorized_keys file on your splunk server for the user you want ironport to use to drop off the log files. If you don't need to keep the log files that ironport drops off, since the web access logs are probably the most commonly indexed ones and can be a bit heavy, also consider using batch inputs with a move_policy=sinkhole so that the files that are dropped off get deleted after indexing, which can save you disk space issues in the long run. Ironport can also do regular syslog forwards but not on all of the log files. The CLI audit ones can, but not the most commonly used log files. I have not read the linked doc from sdaniels yet, but wanted to throw a couple pennies in since this is the data I'm most familiar with. Hope you can make use of it.

Lowell · ‎07-21-2011

You can easily host static web content (.html, .css, .js, etc), if that's what your asking about. All you have to do is drop your web files in an application folder under the "appserver" "static" folder, for example: $SPLUNK_HOME/etc/apps/<YOUR_APP>/appserver/static/<my_page.html> You can then access that file via HTTP at the following location: http://<YOUR_SPLUNK_SERVER>:8000/en-US/static/app/<YOUR_APP>/<my_page.html>; I would suggest creating a custom app for this kind of stuff, even if it only contains a few few files. Creating a new "app" isn't a very difficult process. (Of course, you could simply host this file in an existing app, but then you run the risk of your stuff being overwritten during an upgrade.)

swdonline · ‎03-30-2012

Interestingly, in 4.3.1, when I use this for the cli (which works fine in the GUI): table a b c d e I get these results: a d e b c Why would table return fields in a different order from the CLI?

murthychitturi · ‎09-29-2016

HI [source_clean-YYYY-MM-DD] # Remove 'YYYY-MM-DD' or 'YYYY_MM_DD' style date from the filename # catalina.2009-09-17.log --> catalina.log # quartz-xyz.log.2009-07-08 --> quartz-xyz.log # xyz.log.2009-07-15 --> xyz.log # xyz_2010-01-01.log --> xyz.log # info_012345_2010_08_17.txt --> info_012345.txt DEST_KEY = MetaData:Source SOURCE_KEY = MetaData:Source REGEX = source::(.)([-. ]\d{4}([-])\d\d\3\d\d)(|\D.)$ FORMAT = source::$1$4 in the regex what does \3\ represent. does it not supposed to be [-] to find out YYYY-MM-DD

dcroteau · ‎06-02-2010

The coldToFrozenScript (also specified in indexes.conf) runs just before the frozen data is erased. The default script simply writes the name of the directory being erased to the log file $SPLUNK_HOME/var/log/splunk/splunkd_stdout.log. If you want to archive frozen data rather than delete it, you'll need to substitute your own archiving script. To substitute your own script, add the following stanza to $SPLUNK_HOME/etc/system/local/indexes.conf: [] coldToFrozenScript = Note the following: * <index> specifies which index to archive. * <script> specifies the archiving script. o Define the <$script> path relative to $SPLUNK_HOME/bin. The script needs to be located in that directory or a subdirectory. Splunk ships with two archiving scripts that you can modify (or you can create your own): * compressedExport.sh: Export with tsidx files compressed as gz. * flatfileExport.sh: Export as a flat text file (not recommended for current performance and resource issues -- it can take a long time, and use a lot of ram, 2-3GB, while running).

gavind · ‎03-29-2013

Thanks a lot for the link that you've sent. I am now able to send logs to my syslog server.

denisevw · ‎05-19-2014

This does not work on Universal Forwarders, correct?

Posts	9
Solutions	0
Karma Given	6
Karma Received	10
Member Since	‎05-12-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Create a custom web page for the Splunk web server...

Output only specific field values to CLI

Consolidate similarly named log files into a singl...

What about archiving/offline storage?

Can Splunk monitor vmWare vSphere version 4 update...

What Windows Event Codes are generally acceptable ...

Re: Splunk for IronPort

Re: Create a custom web page for the Splunk web se...

Re: Output only specific field values to CLI

Re: Consolidate similarly named log files into a s...

Re: What about archiving/offline storage?

Re: Can Splunk monitor vmWare vSphere version 4 up...

Re: What Windows Event Codes are generally accepta...

Are you a member of the Splunk Community?