Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
James Esposito's Discussions
Incorrect Links for swfobject.js when using amMap App
All, It appears that I'm having a classic "You need to upgrade your Flash Player" problem that many users encounter when trying to run amMap. From reading the forums and playing a bit with Firebug,…Continue
Started Apr 7, 2010
Need RegEx Help Please!
5 Replies
All,I'm a newbie to Splunk and Regular Expressions. I could really use some help creating some Splunk friendly regular expressions that I can use as fields. Here is a sample syslog entry:Apr 3…Continue
Started this discussion. Last reply by Michael Wilde Apr 6, 2010.
Error with Trying to Use Any App in Splunk
All,I’ve been working to get a number of Apps working on my new install of Splunk 4.0.10 (I’m a new user to Splunk). To speak to a specific example, I downloaded and installed Splunk Globe (a 3.x…Continue
Tags: error, install, iglobe, app
Started Apr 3, 2010
James Esposito's Page
Gifts Received
James Esposito has not received any gifts yet
Latest Activity
Incorrect Links for swfobject.js when using amMap App
All, It appears that I'm having a classic "You need to upgrade your Flash Player" problem that many users encounter when trying to run amMap. From reading the forums and playing a bit with Firebug, I believe that I've honed in on the issue. When I attempt to simply view the initial amMap in Splunk, I receive the "You need to upgrade..." error message. When I look at the Firebug details, two of the swfobject.js files are "404 Not Found." When I hover over the missing files, it displays the…See More
Discussion posted by James Esposito
Michael Wilde replied to James Esposito's discussion 'Need RegEx Help Please!'
Looks like some of my message got garbled by this forum tool (because it looks like XML).. lets try again: (using an HTML "PRE" tag around it)
[cisco_syslog]
EXTRACT-num_packets = (?\d+)\spacket|packets
EXTRACT-logp_fields = ACCESSLOGP\:…
Ferry Leirissa replied to James Esposito's discussion 'Need RegEx Help Please!'
Hai Micheal,
Whats the total input here, can you sent me it as well?
Cause you dont have the fields decribed here now right? What is your advice, to do FORMAT or inline?
Cheers
Ferry
James Esposito replied to James Esposito's discussion 'Need RegEx Help Please!'
MIchael,
Thanks. Just so you know, I wrote the above discussion post before I got your email.
Thanks for the help!
James
Michael Wilde replied to James Esposito's discussion 'Need RegEx Help Please!'
Per our email discussion
go to C:\Program Files\Splunk\etc\system\local
create and edit a file called "props.conf" (as it probably isnt there) -- changes to this file will be system wide (meaning these field extractions will be in every…
Ferry Leirissa replied to James Esposito's discussion 'Need RegEx Help Please!'
Hai James,
This is syslog right?
I am happy to help you, can you sent me a part of the logile? So I have some mass data to doublecheck before twaeking afterwards.
Please sent it to leirissa@hotmail.com
Thanks
Ferry
Discussions posted by James Esposito
James Esposito replied to Patrick Swackhammer's discussion 'Regex For Identifying IP Addresses (To Extract Field)'
Guys,
I found your thread and hope that you can help me with a similar extraction problem. Here is a single syslog entry I'm trying to extract a field:
Apr 3 15:04:55 adsl-068-153-219-120.sip.bct.bellsouth.net 6807: Router-1969: 006804: Apr 3…
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Ops Director
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
