it's not working for me, as i said below, i believe there is something wrong going on with my cluster and config files. as soon i find a solution and this work i'll mark it as working thank you this is how it looks like link text ... View more

check now please reading again my message i was not very clear, i edited it. ... View more

i think there is something going on with my cluster, if i upload a txt sample, and i add the regex (finished) it merges it almost fine, but then, when i add to props.conf does not work at all. ... View more

this does not work ... View more

no it does not work i almost find a solution adding the example in data file but now it cuts off the word 'finished' which i use as regex. and of course i need it in. (finished) ... View more

the example has been edited, and like that seems just one long line, instead i have multiple lines which i want to merge in a single event it should start here: 2019-05-09 13:29:02.3975 INFO CycleData - CycleDataTask started ________________________________________________________ and finish here: 2019-05-09 13:29:06.8166 INFO CycleData - CycleDataTask finished _______________________________________________________ ... View more

as i said it's not always like that. at the i asked the devs and the fields pattern is always the same so i just gram from sql_queries to @timestamp and that's it ... View more

the regex i posted match every pattern but just doesn't work in splunk.. yes i am going to ask to to the dev if fields position is static ... View more

i got a indexers cluster and i am pushing props.conf from the master at every edit. that works but the problem is not every sql_queries value has 'COMMIT' at the end or { token......, some are simplier.. i have another regex which match from sql_queries to timestamp (excluded) and it works but it's too generic ... View more

i tried with a new log file and it works and i can extract all fields except the queries which is always the last lines, basically all the queries are in a new line and splitted in multiple lines like: ProxySQL LOG QUERY: thread_id="43" username="redacted" schemaname=information_schema" client=redacted:51827" HID=1 server="redacted:3306" starttime="2019-01-24 10:37:20.959324" endtime="2019-01-24 10:37:21. 47135" duration=87811us digest="0x8D9F0318EE412645" select date_format(t.redacted,'%d-%m-%Y') date, t.redacted,t.redacted, c.redacted, c.description, CASE when t.redacted = 'redacted' then redacted else ppcustom_field end Ref, t.redacted, t.net_amount, t.redacted from redacted.redacted c, redacted.redacted t where c.redacted = t.redacted -- and t.redacted is not null and t.redacted >= '2019-01-23 00:00:01' and t.redacted < '2019-01-24 00:00:01' order by 2,1,4,6,5 i don't know how to write a regex to extract that, i can't do ^select because it could be a query update. what i am sure is the query is always after the digest field. ... View more

i was expecting that. at the end, i save the configuration of props made by the web upload data and overwritting proxysql sourcettype, then i just copy and paste from the searchhead to the master node in props.conf tomorrow i got new logs to check if it works thanks ... View more

yes perfect thanks! ... View more

They don't have access to our logs. It's internal just for us. And what i want to do it's just to make a partner's log easier to find. ... View more

this worked thanks! ... View more

i just checked messages and there is test-01 as hostname there, it's not a splunk config issue it's the system i sent my rsyslog.conf but the comment needs to be approved ... View more

i got rsyslog ` # /etc/rsyslog.conf Configuration file for rsyslog. # # For more information see # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html ################# #### MODULES #### ################# module(load="imuxsock") # provides support for local system logging module(load="imklog") # provides kernel logging support #module(load="immark") # provides --MARK-- message capability # provides UDP syslog reception #module(load="imudp") #input(type="imudp" port="514") # provides TCP syslog reception #module(load="imtcp") #input(type="imtcp" port="514") ########################### #### GLOBAL DIRECTIVES #### ########################### # # Use traditional timestamp format. # To enable high precision timestamps, comment out the following line. # $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # # Set the default permissions for all log files. # $FileOwner root $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 # # Where to place spool and state files # $WorkDirectory /var/spool/rsyslog # # Include all config files in /etc/rsyslog.d/ # $IncludeConfig /etc/rsyslog.d/*.conf ############### #### RULES #### ############### # # First some standard log files. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warn -/var/log/mail.warn mail.err /var/log/mail.err # # Some "catch-all" log files. # *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg :omusrmsg:* ... View more

well that did the trick! Thanks now i need to parse the nested list inside the same line. i'll have a look around here propably there is already the answer i am trying with spath but is not working i got something like: {"class":"EventsWorker","args":["{\"id\"=187918,....] i can't extract args, i tried: mysearch | spath path=args{} output=args ... View more