Community
Splunk Answers
Splunk Administration
Deployment Architecture
Getting Data In
Installation
Security
Knowledge Management
Monitoring Splunk
Using Splunk
Splunk Search
Dashboards & Visualizations
Splunk Dev
Alerting
Reporting
Other Usage
Splunk Platform Products
Splunk Enterprise
Splunk Cloud Platform
Splunk Data Stream Processor
Splunk Data Fabric Search
Splunk Premium Solutions
News & Education
Blog & Announcements
Community Blog
Product News & Announcements
Practitioner Resources
Adoption Boards
Community Office Hours
Splunk Tech Talks
Great Resilience Quest
Training & Certification
Training + Certification Discussions
Training & Certification Blog
Community Lounge
Getting Started
Welcome
Feedback
SplunkTrust
User Groups
Splunk Love
Apps and Add-ons
All Apps and Add-ons
User Groups
Resources
SplunkBase
Developers
Documentation
Splunk Ideas
Sign In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
All community
Knowledge base
macvili
Users
Products
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
Ask a Question
About macvili
macvili
Engager
Member since:
09-17-2014
06-05-2020
Community Statistics
Posts
1
Solutions
0
Karma Given
1
Karma Received
1
Member Since
09-17-2014
View all badges
Activity Feed
Got Karma for
Re: How to send events in JSON format to NullQueue?
.
06-05-2020
12:49 AM
Karma
Search with output_mode=csv ends up reordering the table command output.
for paragcisco.
06-05-2020
12:46 AM
Posted
Re: How to send events in JSON format to NullQueue?
on
Splunk Search
.
12-04-2017
11:54 PM
Topics I've Started
No posts to display.
View All
Latest Contributions by macvili
Topics macvili has Participated In
Latest Contributions by macvili
Re: How to send events in JSON format to NullQueue...
by
macvili
in
Splunk Search
12-04-2017
11:54 PM
1 Karma
12-04-2017
11:54 PM
1 Karma
Your regex won't match. The _raw data contais this: ...,"EventId": 5156,... therefore your regex in the transforms.conf stanza should go like this: REGEX = \"EventId\":\s*(?:5156|5158)
... View more
Contact Me
Online Status
Offline
Date Last Visited
06-05-2020
02:03 AM
Karma from
User
Karma Count
DEAD_BEEF
1
View All
Karma given to
User
Karma Count
paragcisco
1
View All