See related post: http://answers.splunk.com/answers/104317/enterprise-security-240-and-splunk-6-dont-work-together-how-long ... View more

Thanks for the great post, Josh. I think this should be added as part of the official documentation. Before today, my understanding was that it would just grab any new records at the end of log and would be just as reliable as starting at the beginning of the log. This is my new understanding for the follow tail event loss potential: followtail=1 + (log file roll or new log file) + (high volume log or high load on host or forwarder restart) = possible event loss near head of the log I hope Splunk will update the followtail code or options to correct scenarios where events could be lost. Possibly an an option for auto-disable once all inputs have been scanned once or somehow compare splunkd startup time to event time in the log being indexed? Thanks, Rob ... View more

In the splunk console, goto Manager --> Fields --> Fields --> Field extractions Click New Fill in the form for a new field extraction (you can use the examples I will provide below) Destination app: search Name: Enter a descriptive name for the field you are extracting here Apply to: host named: * Type: Inline Extraction/Transform: Enter your regex for field extraction here Click Save Note: If you are familiar with Splunk, you can tweak the Apply to filter to your liking. You will now see additional fields available on the left whenever a search matches the regex pattern you entered and can start using these in graphs and reports. Below are templates for step 3 to help get you started. These are working for me with WebLogic 10.3 logs. Destination app: search Name: BEA Info Apply to: host named: * Type: Inline Extraction/Transform: T>\s<(?P<BEA_LOG_LEVEL>\w*)>\s<(?P<BEA_MSG_TYPE>\w*)>\s<(?P<BEA_MACHINE>\w*)>\s<(?P<BEA_SERVER>\w*)> Destination app: search Name: BEA Code Apply to: host named: * Type: Inline Extraction/Transform: <(?P<BEA_CODE>BEA-\d\d\d\d\d\d)> Destination app: search Name: BEA Server State Apply to: host named: * Type: Inline Extraction/Transform: (?P<BEA_SERVER_STATE>\w*)> Destination app: search Name: Java Lang Apply to: host named: * Type: Inline Extraction/Transform: java\.lang\.(?P<JAVA_LANG>\w*) Destination app: search Name: Oracle Code Apply to: host named: * Type: Inline Extraction/Transform: (?P<ORACLE_CODE>ORA-\d\d\d\d\d) Rob ... View more