"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Light forwarder sends directly to an Index on the splunk server
Is it possible to have a splunk light forwarder (with unix enabled) to send its logs to a seperate index on the splunk server?
Thanks everyone :)
Thanks everyone :)
Views: 82
Replies to This Discussion
-
Permalink Reply by Ferry Leirissa on -
Yes its possible, you can read it on http://www.splunk.com/support/forum:SplunkAdministration/3994
You have to edit the props and transforms (on receive) like :
props.conf
[host::devhost*]
TRANSFORMS-dev = IndexIs-dev
[host::prodhost*]
TRANSFORMS-prod = IndexIs-prod
transforms.conf
[IndexIs-dev]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = dev
[IndexIs-prod]
REGEX = .
DEST_KEY = _MetaData:Index
FORMAT = prod
-
Permalink Reply by Michael Wilde on -
you an also set an "index" setting in inputs.conf
[monitor://var/log/messages]
index=mysweetindex
© 2012 Created by Michael Wilde.
