About castle1126

smithy001

I know this is a very old post but here's a simple solution via spl at search time. Just split using "." and then use mvindex to extract the components. | eval host=mvindex(split(fqdn, "."),0) | eval domain=mvindex(split(fqdn, "."),1) | eval org_type=mvindex(split(fqdn, "."),2) | eval country=mvindex(split(fqdn, "."),3) Hope someone finds this useful Cheers

gkanapathy · ‎06-20-2011

Well, you're not going to have an exact copy if you do this, and there's no easy way to get them synced back up, but you can set dropEventsOnQueueFull and maxQueueSize in outputs.conf to control how much and how long the primary indexer holds and waits for the secondary.

castle1126 · ‎05-24-2011

I just tried this too. No luck, nothing returned.

BenAveling · ‎09-15-2013

Does the 3rd index have ip? If so, what happens when you try to build a transaction on ip and user_name?

castle1126 · ‎01-12-2011

Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?

hexx · ‎01-26-2012

I would suggest a review of the procedure detailed in this tutorial to set up splunk-2-splunk communication using SSL certificates signed by a 3rd party certificate authority. The troubleshooting section might help you to pinpoint where the issue with your current configuration is.

Ron_Naken · ‎02-11-2011

You can concatenate your strings right in the case statement. Assuming your EVAL expression is correct, you could do it like this to get the address as you wish: ... | eval changed = case(NOT address="-", "Address changed to " + address, NOT city="-", city, NOT state="-", state)

castle1126 · ‎12-03-2010

Thanks much! Doing the search that way worked very nicely...

chimell · ‎05-30-2015

Hi Type is it a name of a field in your data ? If no try to use the following search by replacing Type field by _raw field LookupQuery - Count by _raw

castle1126 · ‎12-01-2010

Nick, I've tried using the search that you added to your updated answer, but still no luck. I do not get the information required. Any other ideas?

castle1126 · ‎11-04-2010

To test with I added the PROPS and TRANSFORMS to my Forwarder (not running light forwarder) and the host field did change correctly. Thanks for this information it was very helpful!

jrodman · ‎11-02-2010

Yes, unless you were to, for example, disable AUTO_HEADER for the csv sourcetype. The AUTO_HEADER behavior is designed around storing the names of the fields in a sourctype, and 'learned' is the app that came to exist around storing generated sourcetypes for other purposes.

castle1126 · ‎10-28-2010

That was it! I thought I had changed licenses prior to setting up distributed searches but didn't. Thanks!

castle1126 · ‎10-26-2010

Hey SoutheringtonP, I changed the client from running LightForwarder to Forwarder. Your change to the props.conf worked perfect! Thanks for the insight!!

ftk · ‎10-25-2010

Please accept the answer that helped you out, so this question can be closed out. Thanks

hulahoop · ‎11-17-2010

I believe only the warm and cold dbs need to have unique ids.

castle1126 · ‎09-14-2010

Thanks! This worked great!

Justin_Grant · ‎08-25-2010

hi @castle1126 - instead of adding a new answer (like you'd do on a traditional forum), on Splunk Answers you'll want to add a comment on the correct answer and "accept" it by clicking the checkmark. Thanks!

Genti · ‎07-28-2010

I had a similar case just today. Try the following props.conf: [weblogs] KV_MODE = none REPORT-extracts = csv_extract protocol_extract Let me know how it goes, .gz

Posts	53
Solutions	0
Karma Given	10
Karma Received	20
Member Since	‎05-28-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Question about daisy chaining two indexers togethe...

How do I search for the = character?

How to build a transaction from multiple, somewhat...

Difficult SMTP log search. Help!

SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certif...

Can I add text to return value of eval/case?

Revisiting REGEX to extract domain name from an FQ...

issue with transactions

Custom view - pie chart not showing all data

Am I bumping into limits issue with subsearch resu...

Re: Revisiting REGEX to extract domain name from a...

Re: Question about daisy chaining two indexers tog...

Re: How do I search for the = character?

Re: How to build a transaction from multiple, some...

Re: Difficult SMTP log search. Help!

Re: SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no ce...

Re: Can I add text to return value of eval/case?

Re: issue with transactions

Re: Custom view - pie chart not showing all data

Re: Am I bumping into limits issue with subsearch ...

Re: Set hostname correctly for SYSLOG input coming...

Re: Logs ingested via sinkhole are not receiving t...

Re: distributed search issue - duplicate licenses

Re: Multi line log issue

Re: Monitoring files within the C:\Program Files (...

Re: Error moving warm buckets to new server

Re: Search for percent symbol in log entries

Re: GeoIP app not working correctly

Re: Trying to extract field, from a CSV extracted ...

Join the Conversation