×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
tkashem
New Member
Member since: ‎04-15-2015
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎04-15-2015
View All

Re: Time capturing regex for virtual index that po...

by in Splunk Search
‎08-07-2015 01:22 PM
‎08-07-2015 01:22 PM
Sorry for the delay - here is relevant parts of indexes.conf file - vix.description = prod-elb vix.input.1.accept = \.log$ vix.input.1.path = s3://foo/AWSLogs/... vix.provider = development-cluster vix.input.1.et.format = yyyyMMdd vix.input.1.et.offset = 0 vix.input.1.et.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.regex = /foo/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/ vix.input.1.lt.offset = 0 ... View more

Time capturing regex for virtual index that points...

by in Splunk Search
‎04-29-2015 09:33 PM
‎04-29-2015 09:33 PM
I am using a virtual index that points to AWS ELB logs in S3 bucket to run Splunk query. I have set this up using Hunk app in Splunk which uses an EMR cluster in Amazon to run the queries. It seems Time capturing regex defined in virtual index never works. I see plenty of the following error in server logs. 04-30-2015 04:09:49.282 WARN ERP.elb_log_provider - VixTimeSpecifier - Could not match time regex="/AWSLogs/*/elasticloadbalancing/*/(\d+)/(\d+)/(\d+)/*" against path="/AWSLogs//elasticloadbalancing/us-east-1/2015/04/18/_elasticloadbalancing_us-east-1__20150418T0055Z_.log" Can anyone help me find out what's going on here? Thanks in advance! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM