About jmcrabb

jmcrabb · ‎12-15-2014

I saw this issue when I had tried copying the app's etc/local directory from a Windows server to a CentOS server. To get it to work, I had to delete the local directory, restart splunk, and use the web interface to add the sensors. This is with Splunk 6.1.4 heavy forwarder and Splunk Add-on for Cisco IPS 2.1.1. On top of that, I had to edit pySDEE.py per the comment by Colin Humphreys here: http://answers.splunk.com/answers/171146/ciscoips-script-not-working-in-splunk-universal-fo.html.

jmcrabb · ‎03-19-2014

I've got a log file I'd like to have the Universal Forwarder watch and index, but there are 34 lines at the beginning of the file from when the service/server restarts that I don't want indexed. I'm trying to use PREAMBLE_REGEX in props.conf on the indexer to have it ignore these lines, but it appears to be ignoring the regex, not the lines. I've verified the syntax of the regex using regex101.com, and it checks out. I've seen other posts where people have used this, so I'm confused as to why it's not working for me. I've even added a # to the beginning of a couple lines and just had ^# in the PREAMBLE_REGEX , but those lines still make it into the indexed data. Maybe I've missed a setting somewhere that turns this on? Any help would be appreciated. I have the PREAMBLE_REGEX in props.conf on the indexer under the corresponding sourcetype, and on the UF, I have queue = parsingQueue in inputs/conf. Jim

jmcrabb · ‎02-14-2014

Thanks for the info!

jmcrabb · ‎02-13-2014

Are there plans to make a Windows Server compatible version of this add-on? If so, what's the timeframe? Jim

Posts	4
Solutions	0
Karma Given	7
Karma Received	4
Member Since	‎01-02-2014

Online Status	Offline
Date Last Visited	‎09-16-2020 12:42 AM

PREAMBLE_REGEX

Splunk Add-on for Netflow Windows compatibility

Re: Splunk Add-on for Cisco IPS: Why am I getting ...

PREAMBLE_REGEX

Re: Splunk Add-on for Netflow Windows compatibilit...

Splunk Add-on for Netflow Windows compatibility