Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ugruner
ugruner
Explorer
Member since:
09-22-2014
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 09-22-2014 |
Activity Feed
- Got Karma for DBConnect 3.x Rising columns not working. 06-05-2020 12:49 AM
- Got Karma for Why does the Splunk App for Windows Infrastructure not show any User, Computer, or Group data?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does the Splunk App for Windows Infrastructure not show any User, Computer, or Group data?. 06-05-2020 12:47 AM
- Got Karma for Re: Why does the Splunk App for Windows Infrastructure not show any User, Computer, or Group data?. 06-05-2020 12:47 AM
- Posted Can you help me build the regex that would extract a filename without filenamenumber and extension? on Splunk Search. 11-16-2018 03:19 AM
- Tagged Can you help me build the regex that would extract a filename without filenamenumber and extension? on Splunk Search. 11-16-2018 03:19 AM
- Tagged Can you help me build the regex that would extract a filename without filenamenumber and extension? on Splunk Search. 11-16-2018 03:19 AM
- Posted Re: How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 05:37 AM
- Posted Re: How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 02:34 AM
- Posted How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 02:30 AM
- Tagged How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 02:30 AM
- Tagged How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 02:30 AM
- Tagged How to rename a sourcetype based on the source on my indexer within a custom app? on Getting Data In. 07-04-2018 02:30 AM
- Posted Re: My regex is not working in Splunk although it works at regex101.com on Splunk Search. 12-06-2017 11:52 PM
- Posted My regex is not working in Splunk although it works at regex101.com on Splunk Search. 12-06-2017 11:10 AM
- Tagged My regex is not working in Splunk although it works at regex101.com on Splunk Search. 12-06-2017 11:10 AM
- Tagged My regex is not working in Splunk although it works at regex101.com on Splunk Search. 12-06-2017 11:10 AM
- Posted DBConnect 3.x Rising columns not working on All Apps and Add-ons. 10-04-2017 05:38 AM
- Tagged DBConnect 3.x Rising columns not working on All Apps and Add-ons. 10-04-2017 05:38 AM
- Tagged DBConnect 3.x Rising columns not working on All Apps and Add-ons. 10-04-2017 05:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
11-16-2018
03:19 AM
Hi,
i am not familiar with regex and am trying to extract only the filename from the following data without the number at the end:
myfile2.txt
myfileagain.doc
myfile33.txt
to
myfile
myfileagain
myfile
REGEX=(\bmy\w\D+) was my first idea, but I had no luck.
Can you give me a tip on how to solve this?
Regards
Udo
... View more
07-04-2018
05:37 AM
Shame on me. For missing the ().
Thanks.
... View more
07-04-2018
02:34 AM
sorry there was a copy and paste error: it should be wst-sourcetype not wisdom-sourcetype in transforms.conf
transforms.conf is
[wst-sourcetype]
DEST_KEY=MetaData:Sourcetype
SOURCE_KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true
... View more
07-04-2018
02:30 AM
Hi, I am trying to rename a sourcetype based on the source on my indexer within a custom app
so i created props.conf and transforms.conf in %splunkhome%\etc\apps\myapp\default
props.conf
[source::C:\\temp\\MyFile*.csv]
TRANSFORMS-wst=wst-sourcetype
transforms.conf
[wisdom-sourcetype]
DEST_KEY=MetaData:Sourcetype
SOURCE_KEY=MetaData:Source
REGEX=\bMyFile\w+
FORMAT=sourcetype::$1
WRITE_META=true
Any idea why I still get the Sourcetype in csv?
... View more
12-06-2017
11:52 PM
Thanks, I am always thinking too complicated.
... View more
12-06-2017
11:10 AM
Hello,
I have a field "group" these field contains some values with a prefix: "AD-". I need to get rid of the prefix.
E.g
AD-test = test
ADtest = ADtest
test = test
AD-123 = 123
123 = 123
I am trying to do this with regex. My regex works fine outside of Splunk e.g at regex101.com or in a powershell script, but I am not able to get it work in splunk.
This is my regex: [^AD-].\s
But in splunk | rex field="group" (?[^AD-].\s) results in: Missing a search command before '^'. ..... Error in 'SearchParser': errorcontext = [^AD-].*\s)}'.
Udo
... View more
10-04-2017
05:38 AM
1 Karma
After migration to DBConnect 3.11 my SQL Statement won't work any more. It fails with an error in the UI.
com.microsoft.sqlserver.jdbc.SQLServerException: The value is not set for the parameter number 1.
I created a new Input in the Ui, first I run the stement with Batchmode by Execute Sql
SELECT [Entry No_] as [Entry_No]
,[Date and Time] as [Date_and_Time]
,[Time] as [Time]
,[User ID] as [User_ID]
FROM [table]
Next I select Rising Column and select Enty_No (bigint) also added the following line to my SQL Statement
WHERE Entry_No > ? ORDER BY Entry_No ASC
When I run Execute SQL again, the above error is displayed.
I created several Inputs with DB Connect 2.x and all of them worked. But now I cannot create a single one with 3.11
... View more
01-14-2016
06:03 AM
2 Karma
severals issues:
SA-Ldapsearch was configured but not in the way App for Windows Infrastructure needs it to work correctly.
The "default" stanza must be filled out and a second stanza with the FQDN must exists. The Alternative name in both stanzas must be the same. The Wizard detects duplicates, so one Alternative Name should be written in UPPERCASES and one in lowercases.
Last but not least if you running splunk Server on german OS, you don't see data in some Dashboards. So I have to Switch to English OS for the splunk Server. After this ALL Dashboards Shows up Information. To make it clear Data was sent to the Indexes but the Dashboards could not display those.
Also the Eventlogs from non english Servers should be sent as XML.
http://blogs.splunk.com/2014/11/04/splunk-6-2-feature-overview-xml-event-logs/
... View more
01-07-2016
11:20 PM
index=msad" Shows a lot of data
source=ActiveDirectory also exists with thousands of data.
I can use the Splunk App for Windows Infrastructure and browse all data e.g DNS, Domain Status, Health Status, only those for User, Groups, OU and Computers have no data if I open the Dashboards.
... View more
01-07-2016
02:49 AM
1 Karma
We are running the following versions of Splunk and supporting apps for Windows infrastructure:
Splunk Enterprise 6.3.2
Splunk App for Windows Infrastructure 1.2.0
Splunk Supporting Add-on for Active Directory 2.1.2
Windows Add-on 4.8.1
German OS
The Splunk App for Windows Infrastructure does not Show me any User, Computer, or Group entry.
Also the Guided Setup says "users not found", and "Groups not found", but "Computers found"
Also no OU is displayed in the Org Units: All Dashboard
On the DC the following apps are installed:
SA-ModularInput-PowerShell
sendtoindexer
Splunk_TA_windows
TA-DNSServer-NT6
TA-DomainController-2012R2
Because I am totally new to Splunk, please can someone help me to figure out why I can't get data?
... View more
