About ch_goh

ch_goh · ‎06-25-2014

Can I put this in the deploymentclient.conf file? targetUri= deploymentServer-A:8089;deploymentServer-B:8089 If the "deploymentServer-A" is down, will the splunk forwarder try "deploymentServer-B"? Thanks.

ch_goh · ‎06-02-2014

Thanks. But Splunk doesn't pick it up. Here is what I have in props.conf and transforms.conf. props.conf: [source::/logs/dxserver/3*_query_*.log] REPORT-queryLog = dsaname transforms.conf: [dsaname] SOURCE_KEY = source REGEX = 3......(?P .+?)rly FORMAT = dsaname::$1 Example of the source field = "/logs/dxserver/3wtxq20corerly1_query_20140601.log". I expect the dsaname field equals to 'core' (without the qoute). Any syntax or format errors? Thanks.

ch_goh · ‎05-30-2014

This rex statement works in search command: rex field=source "3......(?P .+?)rly" I would like to convert it into REGEX statement in transforms.conf file. What should be the REGEX statement? Thanks in advanced.

ch_goh · ‎08-14-2013

It works. Thanks.

ch_goh · ‎08-12-2013

Hi, I have the following outputs.conf set in deployment server but the _internal index doesn't seem to be forwarded to the Indexer. What do I miss? outputs.conf [tcpout] autoLB=true autoLBFrequency=30 blockOnCloning=true compressed=false connectionTimeout=20 disabled=false> dropClonedEventsOnQueueFull=5 dropEventsOnQueueFull=-1 forwardedindex.0.whitelist=.* forwardedindex.1.whitelist=_.* forwardedindex.2.whitelist=_audit forwardedindex.filter.disable=false heartbeatFrequency=30 indexAndForward=false maxConnectionsPerIndexer=2 maxFailuresPerInterval=2 maxQueueSize=500KB readTimeout=300 secsInFailureInterval=1 sendCookedData=true server=165.36.15.217:9997,165.36.15.218:9997 useACK=false writeTimeout=300 Please help. Thanks.

ch_goh · ‎08-10-2012

Hi, I have these multlines row event from different hosts and I would like show the multilines events by host. Example,HOST1 has these multilines event: KEY VALUE CPUTYPE AMD CPU X7560 @ 2.27GHz CPUCACHE 24576 KB CPUCOUNT 64 and HOST2 has these multilines event: KEY VALUE CPUTYPE Intel CPU E7330 @ 2.40GHz CPUCACHE 3072 KB CPUCOUNT 16 Now, I would like the search results to display them as: KEY HOST1 HOST2 CPUTYPE AMD CPU X7560 @ 2.27GHz Intel CPU E7330 @ 2.40GHz CPUCACHE 24576 KB 3072 KB CPUCOUNT 64 16 Please help. Thanks, C.H.

Posts	6
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎04-27-2012

Online Status	Offline
Date Last Visited	‎01-05-2023 07:43 PM

Will Splunk forwarder try a deployment server if a...

rex command to regex in transforms.conf

forward _internal index from deployment server

show multlines event in column

Will Splunk forwarder try a deployment server if a...

Re: rex command to regex in transforms.conf

rex command to regex in transforms.conf

Re: forward _internal index from deployment server

forward _internal index from deployment server

show multlines event in column