About ArmbrusterC

ArmbrusterC · ‎12-27-2020

Thats smart, I hadn't thought of using eval to feed in data with a search time extraction. Thanks for that piece. So using this method to test it appears the match is correct. So the problem Im having is likely related to the App changes Ive done |makeresults | eval _raw="Dec 27 01:47:46 pvlpfSense01 unbound: [91480:1] info: resolving acceptor.mcafee-mvision-mobile.com. A IN Dec 27 01:47:46 pvlpfSense01 unbound: [91480:0] info: resolving ns-1608.awsdns-09.co.uk. AAAA IN Dec 27 16:00:51 pvlpfSense01 unbound: [15920:1] info: resolving (init part 3): 165.185.in-addr.arpa. DS IN" | multikv noheader=t | table _raw | rex "(?<time>\S+ \d\d \S+) (?<sensor>\S+) (?<bound>\S+): \[(?<session>\d+:\d+)\] info: resolving (?:$init part \d$:\s{2})?(?P<query>[\S?]+)\.\s(?P<query_type>\S+)" The example you gave includes the final "." in the FQDN. I will mark your answer as correct since you gave me the piece I was missing to test the extraction in realtime. Thanks!

ArmbrusterC · ‎02-08-2018

02-07-2018 07:45:56.718 -0500 WARN FileClassifierManager - The file '/var/log/openvpn.log' is invalid. Reason: binary 02-07-2018 07:45:56.718 -0500 INFO TailReader - Ignoring file '/var/log/openvpn.log' due to: binary Well there we go, never occurred to check logs on the forwarder itself. So now I have a new mystery. The file is definitely not a binary. [2.4.2-RELEASE][root@pvlpfs01.local]/var/log: file openvpn.log openvpn.log: ASCII text [2.4.2-RELEASE][root@pvlpfs01.local]/var/log: hexdump -C openvpn.log | less 00000000 4a 61 6e 20 32 34 20 32 33 3a 33 32 3a 32 31 20 |Jan 24 23:32:21 | 00000010 70 76 6c 70 66 73 30 31 20 6f 70 65 6e 76 70 6e |pvlpfs01 openvpn| 00000020 5b 32 32 38 38 31 5d 3a 20 65 76 65 6e 74 5f 77 |[22881]: event_w| the /// doesn't hurt anything, just defines the path all the way from root. That was added to see if it made a difference with the problem I was having. In any case im going to add a stanza in props.conf [openvpn] NO_BINARY_CHECK = true

pfabrizi · ‎02-08-2018

So it is the mgmt. port that is in conflict. I used the out of the box 8089 to communicate with deployment server, changed it to 8090 and now that is conflicting with our VM center. What I want to change the UF management port to 80899 and just wasn't sure if I can do this. Thanks!

ArmbrusterC · ‎06-27-2016

This put me on the right track. The field is a text input for a hostname. I have posted the correct answer below. <row> <html> <a href="https://ticketing.system.com/textsearch.do?sysparm_search=$field1$">Search for Tickets</a> </html> </row>

sree6494 · ‎05-19-2020

is there a way we can get the count of main search before join and the final count after performing the join?

Posts	11
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎09-18-2014

Online Status	Offline
Date Last Visited	‎04-06-2022 02:01 PM

Unbound DNS Resolver Logs

MIssing events from Universal Fowarder

Looking for a way to append a token value to the e...

Search for value of FieldA, then search FieldB, Ma...

Re: Unbound DNS Resolver Logs

Re: MIssing events from Universal Fowarder

Re: What Ports can I use for UF

Re: Looking for a way to append a token value to t...

Re: Search for value of FieldA, then search FieldB...

Join the Conversation