The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
James Esposito's Discussions
Incorrect Links for swfobject.js when using amMap App
All, It appears that I'm having a classic "You need to upgrade your Flash Player" problem that many users encounter when trying to run amMap. From reading the forums and playing a bit with Firebug,…Continue
Started Apr 6, 2010
Need RegEx Help Please!
5 Replies
All,I'm a newbie to Splunk and Regular Expressions. I could really use some help creating some Splunk friendly regular expressions that I can use as fields. Here is a sample syslog entry:Apr 3…Continue
Started this discussion. Last reply by Michael Wilde Apr 6, 2010.
Error with Trying to Use Any App in Splunk
All,I’ve been working to get a number of Apps working on my new install of Splunk 4.0.10 (I’m a new user to Splunk). To speak to a specific example, I downloaded and installed Splunk Globe (a 3.x…Continue
Tags: error, install, iglobe, app
Started Apr 3, 2010
James Esposito's Page
Gifts Received
James Esposito has not received any gifts yet
Latest Activity
James Esposito posted a discussionIncorrect Links for swfobject.js when using amMap App
All, It appears that I'm having a classic "You need to upgrade your Flash Player" problem that many users encounter when trying to run amMap. From reading the forums and playing a bit with Firebug, I believe that I've honed in on the issue. When I attempt to simply view the initial amMap in Splunk, I receive the "You need to upgrade..." error message. When I look at the Firebug details, two of the swfobject.js files are "404 Not Found." When I hover over the missing files, it displays the…See More
Michael Wilde replied to James Esposito's discussion Need RegEx Help Please!"Looks like some of my message got garbled by this forum tool (because it looks like XML).. lets try again: (using an HTML "PRE" tag around it)
[cisco_syslog]
EXTRACT-num_packets = (?\d+)\spacket|packets
EXTRACT-logp_fields = ACCESSLOGP\:…"
Ferry Leirissa replied to James Esposito's discussion Need RegEx Help Please!"Hai Micheal,
Whats the total input here, can you sent me it as well?
Cause you dont have the fields decribed here now right? What is your advice, to do FORMAT or inline?
Cheers
Ferry"
James Esposito replied to James Esposito's discussion Need RegEx Help Please!"MIchael,
Thanks. Just so you know, I wrote the above discussion post before I got your email.
Thanks for the help!
James"
Michael Wilde replied to James Esposito's discussion Need RegEx Help Please!"Per our email discussion
go to C:\Program Files\Splunk\etc\system\local
create and edit a file called "props.conf" (as it probably isnt there) -- changes to this file will be system wide (meaning these field extractions will be in every…"
Ferry Leirissa replied to James Esposito's discussion Need RegEx Help Please!"Hai James,
This is syslog right?
I am happy to help you, can you sent me a part of the logile? So I have some mass data to doublecheck before twaeking afterwards.
Please sent it to leirissa@hotmail.com
Thanks
Ferry"
James Esposito replied to Patrick Swackhammer's discussion Regex For Identifying IP Addresses (To Extract Field)"Guys,
I found your thread and hope that you can help me with a similar extraction problem. Here is a single syslog entry I'm trying to extract a field:
Apr 3 15:04:55 adsl-068-153-219-120.sip.bct.bellsouth.net 6807: Router-1969: 006804: Apr 3…"
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Ops Director
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
