cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
raynor
Explorer
Member since: ‎05-13-2011
‎09-21-2022
Community Statistics
Posts 4
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎05-13-2011
Activity Feed
View All

Re: How can I spit event into multiple events

by in Getting Data In
‎09-14-2022 06:33 PM
‎09-14-2022 06:33 PM
Dear @scelikok Thanks for your reply. The content of the event is still not split My props.conf   [mft] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = LINE_BREAKER = ()<\d+>\d+ NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured pulldown_type = 1 disabled = false description = mft Syslog TIME_PREFIX = INDEXED_EXTRACTIONS =         ... View more

Re: How can I spit event into multiple events

by in Getting Data In
‎09-13-2022 11:12 PM
‎09-13-2022 11:12 PM
Dear chaker: Yes, I need onboard this data correctly into Splunk. The raw event input from udp syslog，I try edit Source Type "Event Breaks" but not work A single event ending with "]" ，how can I split it. the props.conf [mft] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = LINE_BREAKER = ([]]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured pulldown_type = 1 disabled = false ... View more

How can I spit event into multiple events

by in Getting Data In
‎09-13-2022 10:05 PM
‎09-13-2022 10:05 PM
I'm trying to spit event into multiple events，my raw event like below <14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]<14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]<14>1 2022-09-14T12:49:12.727+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Login" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Login Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM" mftuser_name="testuser"] -------------------------------------------------------------------- I want to split it into three events, how can I do this? <14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"] <14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"] <14>1 2022-09-14T12:49:12.727+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Login" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Login Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM" mftuser_name="testuser"] ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-21-2022 11:26 PM
Karma given to
View All