About rahiparikh

rahiparikh · ‎11-07-2011

Hi, I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part of field1 to give it appropriate value. Now, if I don't correct value of field1, I get field2. But, if I don't correct field1, I don't get field2 at all. [transforms.conf] [autocorrect_field1] SOURCE_KEY = field1 REGEX = (<regex1>)(<regex2>)(<regex3>) DEST_KEY = field1 WRITE_META = true FORMAT = field1::$1$3 [extract_field2] SOURCE_KEY = field1 REGEX = (<regex1>)(<regex2.1>)(<regex2.2>)(<regex3>) DEST_KEY = field2 FORMAT = field2::$2 WRITE_META = true I have also set 101 priority for field2 in props.conf. What is the issue? Thanks!

rahiparikh · ‎10-26-2011

Will this work? I want to perform transformation on Heavy Forwarder and send data to indexer. I do not index locally.

rahiparikh · ‎10-26-2011

Thanks for reply! This works. I have already tried this. But problem with it is -- is a device name. I use host_segment to extract device name. Now, when I use both together, the host_segment will not have effect! 😞

rahiparikh · ‎10-26-2011

Hi, I have a small lab where there is a heavy forwarder . I can/want to perform transformation on Meta info at Heavy forwarder level. I have two related questions. The first question -- I have a source field something like -- /<dir1>/<dir2>/<logfilename> and I want to remove /<dir1>/<dir2> from source field. How can I do that? I also want to rewrite sourcetype field before sending data to indexer. Let's say if we find secure in any part of sourcetype then sourcetype should be secure . (i.e. remove all other characters except secure ) Please help! Thanks!

rahiparikh · ‎09-28-2011

@joelshprentz - Thanks! But, same problem! Splunk think's host name field should be the splunk forwarder's name and not folder name! 😞

rahiparikh · ‎09-27-2011

Hi, How can I extract hostname from path? /dir/server1/*.log /dir/server2/*.log /dir/server3/*.log I want server1, server2 and server3 to be hostname. My current config -- [ INPUTS.CONF ] [monitor:///dir/*/messages] host_regex = /dir/([\w\.\-_a-zA-Z0-9]+)/ source = /var/log/messages disabled = 0 followTail = 1 I am pre-processing logs ( i.e. transforming before sending them to indexer ) and this config is applied to pre-processing instance. This either doesn't extract the information or extracts wrong information.

rahiparikh · ‎09-23-2011

Hi, I installed a heavy forwarder on a box and, after a while, I found out that license was not working. ( By mistake, I forgot to change the license type to forwarder and instead ran it under enterprise trial license. ) Indexer name server-name License expiration xxx x, xxxx 4:00:04 AM Licensed daily volume 1 MB Volume used today 0 MB (0% of quota) Warning count 0 So, I contacted splunk and got the reset license and applied it. But, now after reboot I get the same message and my data doesn't show up in indexer. I am sure that they have an established connection because when I check for open ports they have a live connection. Don't know what problem could be. Any idea? Thanks!

rahiparikh · ‎09-14-2011

@bbingham - Thanks for your help! I modified search app's config files and I am searching in context of search app only. I am using unix app to generate this data and nothing else. Also, the output of df command is the way event looks when searched in splunk.

rahiparikh · ‎09-13-2011

Hi, I have posted the output for that search.

rahiparikh · ‎09-12-2011

Hi, I tried to tansform unix app's data something like this -- [transforms.conf] [df] REGEX = ([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+([^\s]+)\s+([0-9]+)%\s+([^\s]+) MV_ADD = true FORMAT = filesystem::$1 type::$2 size::$3 used::$4 avail::$5 usepct::$6 mountedon::$7 [props.conf] [df] REPORT-df_field_extraction = df Now, I am searching following in search app -- index=os sourcetype="df" usepct>20 This should give me information of all the disks that are used more than 20% full but instead it gives me nothing. Any help will be appreciated. --Edit-- As requested, the output of df command is -- Filesystem Type Size Used Avail UsePct MountedOn /dev/sda1 ext3 99M 20M 75M 21% /boot Thanks!

rahiparikh · ‎08-31-2011

Hi, I am trying to configure a lab environment but I am not seeing data in indexer. When I checked splunkd.log it says -- ERROR TcpOutputProc - Illegal format for config item 'uri' ERROR NetUtils - Illegal format for config item 'uri' My config files are stored in /opt/splunkforwarder/etc/system/local and they look like - [inputs.conf] [default] host = a_web.splunk.lab.x.y.z [monitor:///var/log/messages] disabled = 0 followTail = 1 [monitor:///var/log/cron] disabled = 0 followTail = 1 [monitor:///var/log/secure] disabled = 0 followTail = 1 [monitor:///var/log/maillog] disabled = 0 followTail = 1 [monitor:///var/log/spooler] disabled = 0 followTail = 1 [outputs.conf] [tcpout] defaultGroup = splunk-lab [tcpout:splunk-lab] autoLB = true server = a_indexer.splunk.lab.x.y.z:5050 [deploymentclient.conf] [target-broker:deploymentServer] targetUri = a_deploy.splunk.lab.x.y.z:8089 Can you give me some idea of what's going on?

rahiparikh · ‎07-06-2011

Hi, I wish to tag basic information in source data before I send it to Indexer. I wish to tag the host, sourcetype and such similar basic information. What forwarder should I use? ( I tried to read the docs but it got me confused! 😞 ) Thanks!

rahiparikh · ‎06-20-2011

Hi, I already tried that but in IFE it extracts some not required results. 😞 Though.. Thanks!

rahiparikh · ‎06-20-2011

Hi Thanks for the reply. I am unable to extract the field the way you specified using Manager.

rahiparikh · ‎06-16-2011

Hi, Previously I was searching and extracting field at search time by explicitly specifying rex command. Now, I want to do the same thing but I want splunk to understand that I want "that" field extracted when relevant data is searched. How can I do using manager? ( Also, I do wish to keep it general i.e. not based on any source or something similar. ) My previous query was - * | rex "(?<authentication_type>(?i)(password))" Now, I want to do something like this - * authentication_type=password Thanks, Rahil

rahiparikh · ‎06-14-2011

Wow! I didn't know that one! Thanks! 🙂

rahiparikh · ‎06-14-2011

So, what if I don't extract fields at search time but extract using the manager? Will splunk consider Password and password different? If so, am I always required to use eval and lower functions at reporting type?

rahiparikh · ‎06-14-2011

Hi, I am trying to extract a field from logs and generate report from it. Basically, I am trying to identify the authentication method. My current search looks like - * | rex "(?<authentication_type>(?i)(password))" | search password This extracts a field called authentication_type with value password. But, it considers Password and password to be two different values. Does anyone know how can I force splunk to consider both the same values? Thanks, Rahil

rahiparikh · ‎06-06-2011

Thanks for the help. I just copied the text from Splunk User Manual but didn't know that I need to escape the dots. Thanks again for you help. 🙂

rahiparikh · ‎06-06-2011

Hi, I am trying to use simple regex to find clients with specific IPs. My regex looks like status=404 | regex host=*10.\d\d\d.\d\d\d.\d\d\d* When I run the search in splunk it gives me error which looks like - Error in 'SearchOperator:regex': The regex '*10.\d\d\d.\d\d\d.\d\d\d*' is invalid. nothing to repeat. I am completely new to splunk. So, any help is appreciated. Thanks, Rahil

Posts	20
Solutions	0
Karma Given	3
Karma Received	2
Member Since	‎06-06-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Index time field extraction from another field

How to replace meta information?

Extract hostname from folder path

Heavy forwarder - Doesn't show/forward events

Search app doesn't recognise the transformed searc...

Unable to send data to indexer

Which forwarder to use?

Automatically extracting field at search time

Case insensitive field extraction and reporting

Regex Error