About bbear

bbear · ‎07-28-2010

Greets friends, I noticed in another question that the Afterglow app is broken in the Windows version of Splunk. Is it also broken on Linux? I have installed the app and I can get it to work via command line but when trying to use the app within splunk ui I do not get the graphics. I do get a message that says "X number of matches" to the query.

bbear · ‎07-14-2010

I guess I should just keep trying. I figured out how to get it to work. in $SPLUNK_HOME/etc/system/local create props.conf props.conf [syslog] TRANSFORMS = syslog-header-stripper-ts-host REPORT-syslog = syslog-extractions In $SPLUNK_HOME/etc/system/local create transforms.conf transforms.conf [syslog-header-stripper-ts-host] REGEX = ^[A-Z][a-z]+\s+\d+\s\d+:\d+:\d+\s[^\s]\s(.)$ FORMAT = $1 DEST_KEY = _raw Restart Splunk and it works

bbear · ‎07-14-2010

Thanks for the help and advice. I am experimenting with what is easiest and best so I removed the FIFO and went back to reading the udp port.

bbear · ‎07-14-2010

Hi All, I have been trying to get Splunk to strip off the timestamp and host of forwarded events but do not understand how to do this. I have syslog-ng and Splunk on the same server. Syslog-ng is forwarding the events to udp port 1514 for Splunk to read and index. This all works fine. But the data Splunk receives has the timestamp and hostname of the syslog server in addition to the evendata host. I.E. Jul 14 14:15:56 10.128.213.50 Jul 14 14:15:56 my-host-int02 snmpd[7777]: Received SNMP packet(s) from UDP: [10.128.30.20]:54900 Notice the additional timestamp above. I see in the docs and in the answers forum that this is possible to have Splunk strip this out before indexing, but I have not been able to get all the pieces worked out. Does someone know the answer that has worked this out already? I would like Splunk to strip the event to look like: Jul 14 14:15:56 my-host-int02 snmpd[7777]: Received SNMP packet(s) from UDP: [10.128.30.20]:54900

bbear · ‎07-12-2010

OK, I figured it out. I needed to add the sourcetype = syslog to my inputs.conf file under the fifo config.

bbear · ‎07-12-2010

Greetings experts, I am using syslog-ng and Splunk on the same box. I have configure syslog-ng to pipe the incoming syslogs to a FIFO and get Splunk to read the FIFO. Splunk can read and index the FIFO fine but the sourceType is unkown and I am trying to get Splunk to recognize the data as sourceType syslog. Can this be done? What needs to be modified? I have tried to configure the /$SPLUNK_HOME/etc/modules/input/FIFO/config.xml file but this did not seem to get the sourceType changed. Any help would be greatly appreciated. Bear

bbear · ‎06-29-2010

OK, I hang my head in shame.... I thought I had tried it, but when I followed your recommendation it worked. I guess I got confused with all the things I tried. Than you for the help.

bbear · ‎06-29-2010

Greetings. I am trying to use an expression in the search string that will not display certain IP addresses. I have used the LIKE "172.%" to good use to display all IP addresses beginning with 172.x. However, I would like to exclude the 172.x, 10.x and 192.168.X from being displayed. I have been using a search string like the following: source="/logtest" drop |stats count by srchost |where (srchost LIKE "10.%")| where count > 2 | sort by -count | head 10 Notice in the string above the (srchost LIKE"10.%") Is there a way of creating something that will exclude 10.%? Something on the order of NOT LIKE? If anyone has the answer I would appreciate it. Thanks in Advance. bbear

bbear · ‎06-15-2010

Aaaahh. Thank you Simeon. You are correct. I went back and changed the sourcetype to syslog and new logs coming in parse just fine. Thanks for sharing your knowledge. Brad

bbear · ‎06-15-2010

Hi, Thanks for looking at this. The events displayed in my original post were 5 events that got lumped together in the search display. The search results show the date as the beginning of each line, but when I try to paste the events into the question they bunched up and it looks like one wrapped line. the only thing in the inputs.conf file is [default] host = servxyz.mycomp.com brad

bbear · ‎06-15-2010

I have Splunk set up to monitor syslog on udp 514. Splunk is receiving event logs from several servers. When searching for a particular event Splunk finds the event but lumps the display with every event that came in at that second. Can I somehow get the search results to just show the event I want and not all of the events from the same second? My search is source="udp:514" "accepted password" Jun 15 12:18:47 20.102.22.240 2010 Jun 15 11:14:47 OCSBA <50000> Dropped Inbound packet (Custom rule) Src:10.102.1.1 SPort:138 Dst:10.102.255.255 DPort:138 IPP:17 Rule:16 Interface:WAN (Internet) Jun 15 12:18:49 10.128.213.106 sshd[22643]: pam_radius_auth: Got response from RADIUS server Jun 15 12:18:49 10.128.213.106 sshd[22643]: Accepted password for aaxxxx from 10.3.8.196 port 2941 ssh2 Jun 15 12:18:49 10.128.213.106 sshd(pam_unix)[22643]: session opened for user aaxxxx by (uid=0) Jun 15 12:18:51 10.128.213.106 sshd(pam_unix)[22643]: session closed for user aaxxxx As you can see, the search returns lines other than just the "accepted password" that I am looking for. Any clues? TIA Brad

Posts	11
Solutions	0
Karma Given	0
Karma Received	9
Member Since	‎06-15-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Afterglow application

double host name and timestamps

how to get fifo to be sourceType=syslog?

eval expression usage

search results displaying events not associated wi...

Afterglow application

Re: double host name and timestamps

Re: how to get fifo to be sourceType=syslog?