About wollinet

wollinet · ‎04-06-2011

Despite what's mentioned in the documentation, I think you need REGEX = (.). I had a similar problem in a different scenarion and it seems that transforms only work if they have a matching group.

wollinet · ‎03-23-2011

You have to re-feed the log files. With 4.2 I think there're some new features for re-indexing. But I haven't checked them yet.

wollinet · ‎03-16-2011

Just tried something like this and it seems to work: (?msi)^EventCode=(540|567|560).Object Name:..tmp.*Accesses:\s(DELETE|WRITE_DAC|WriteData) I couldn't try your exact pattern, but used a similar expression.

wollinet · ‎03-10-2011

wollinet · ‎03-09-2011

Can you post some sample log records ?

wollinet · ‎03-09-2011

You can't modify existing meta data. You have to re-index the old data.

wollinet · ‎03-09-2011

Just tried the same without success (version 4.1.7). Have you considered opening a case ? I found a solution that might help. You can overwrite the admin role in local\autorize.conf and reduce the number of capabilities. The you can define a new "myadmin" role with all capabilities. But I don't know, how that works out with updates.

wollinet · ‎03-09-2011

You just need to use SOURCE_KEY in the transform. props.conf: [source-extract] REPORT-sourcefield = source-transform transform.conf: [source-transform] SOURCE_KEY = source REGEX = ....... FORMAT = fieldname=$1

wollinet · ‎02-28-2011

Have a look here: http://answers.splunk.com/questions/4937/custom-event-renderer I had the same problem. If you exactly know how your event looks like and you have a predefined set of fields you can try putting this aroung your fields: SOME_VALUE_HERE

wollinet · ‎02-28-2011

Do you want the line breaker be removed from the event ? I think LINE_BREAKER = (?m)([0-9]{0,}.[0-9]{0,}) removes the match from the event. If you want to keep it, you need a look ahead or behind: LINE_BREAKER = (?m)\s(?u\d+.\d+\s) SHOULD_LINEMERGE = false

wollinet · ‎02-07-2011

You can add the field in fields.conf [environment] INDEXED = false INDEX_VALUE = false Settings INDEX_VALUE to false should prevent the search to be expanded to "val" AND fname="val"

wollinet · ‎01-28-2011

Is that still supported with 4.1 ? I tried both ways, first one prouced errors, second one didn't produce any output and nothing was installed.

wollinet · ‎10-13-2010

Thx fpr your answer. Support told me that, too. But unfortunately I have to handle a bunch of different event formats (some of them XML). They are all wrapped in a message which I tried to remove with this approach. But even if it would work, there are a lot more problems: - export still uses the raw format - field extraction dialog uses the raw format - and a lot more So we ended up stripping the message part from the event and put everything we need from it (basically meta data) into indexed fields.

wollinet · ‎07-29-2010

After a lot of testing I'm now sure that $0 doesn't work in DEFAULT_VALUE. I'm gonna file an enhancement request.

wollinet · ‎07-28-2010

Try index=_audit action="login attempt" | stats max(timestamp) by user

wollinet · ‎07-28-2010

Have a look at: http://www.regular-expressions.info/

wollinet · ‎07-22-2010

I'm trying to write a custom event renderer for an event type. I want to change the event display to a single field of the event. Basically it's working: <%def name="event_raw(job, event, request, options, xslt)"> <% msg = event.fields.get('message') %> % if msg is None: <%parent:event_raw job="${job}", event="${event}", request="${request}", options="${options}", xslt="${xslt}" /> % else: <pre class="event">${msg}</pre> % endif </%def> The problem is that I'm loosing the segmentation functionality (highlighting and selection in the GUI). It seems that this is achieved with the event.raw.toXml() call. Can I do something like that with any field ? Thx for any help, Wollinet

wollinet · ‎07-20-2010

"eval" doesn't help, since I need that functionality during indexing. I want to dynamically choose the index where the record is stored.

wollinet · ‎07-17-2010

$0 is used differently here. The documentation is correct as $0 is original value of DEST_KEY. I've already tested that. What I want is to add something to DEST_KEY (which already contains a value) if the regex matches and a default value if not. The problem is that the default value should be added to DEST_KEY and not overwrite it.

wollinet · ‎07-15-2010

FORMAT = <string> * The special identifier $0 represents what was in the DEST_KEY before this regex was performed. Can I use $0 in DEFAULT_VALUE, too ? My intention is to add a default value to the current content of the source key, if the regex doesn't match. Any help appreciated. Here's some more information about what I want to do. I need to build the index name from several fields in the record (e.g. stage and logtype). In some cases I can directly use the value from the record in some other cases not. I tried the following: props.conf: TRANSFORMS-index_stage = index_stage_prod, index_stage_test, index_logtype ... transforms.conf: [index_stage_prod] DEST_KEY = _MetaData:Index REGEX = (?i)stage=(PROD|BCP).* FORMAT = "idx_prod" [index_stage_test] DEST_KEY = _MetaData:Index REGEX = (?i)stage=(DEV|TEST).* FORMAT = "idx_test" [index_logtype] DEST_KEY = _MetaData:Index REGEX = (?i)logtype=([^\s\t\r]*).* FORMAT = $0_$1 DEFAULT_VALUE = $0_unclassified The seem to be at least two problems: 1) It seems that building the index name incrementally doesn't work. My tests showed that if the first transform was successful the other transforms do not fire. 2) I need "$0" to work in DEFAULT_VALUE I workaround would be to match all values with one regular expression, but that has some limitations. I will also open a case about that problem.

Posts	20
Solutions	4
Karma Given	2
Karma Received	14
Member Since	‎07-15-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Custom Event Renderer

Default value for transform

Re: Filtering local input data - problem

Re: Change source name for exisiting data.

Re: REGEX issue with multiple criteria

Re: REGEX issue with multiple criteria

Re: REGEX issue with multiple criteria

Re: Change source name for exisiting data.

Re: splunk access delegation/roles

Re: Field Extraction Question

Re: How to customize my own event display but keep...

Re: Tricky Line break

Re: Searching on fields extracted from Source fiel...

Re: Can I add python modules to the Splunk environ...

Re: Custom Event Renderer

Re: Default value for transform

Re: User last login date

Re: Regex crash course?

Custom Event Renderer

Re: Default value for transform

Re: Default value for transform

Default value for transform