Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
James Fitzell's Discussions
AutoHeader and field extraction
3 Replies
I've spent some period of time trying to get Splunk to index our proxy logs and while I've made progress I'm still having some problems.My issues all revolve around field extraction, I was unable to…Continue
Started this discussion. Last reply by Michael Wilde Feb 11, 2010.
James Fitzell's Page
Gifts Received
James Fitzell has not received any gifts yet
Latest Activity
Michael Wilde replied to James Fitzell's discussion 'AutoHeader and field extraction'
Got a sample I can monkey with?
James Fitzell replied to James Fitzell's discussion 'AutoHeader and field extraction'
I've resolved the failing to import issue. It was the crcSalt= setting, I just wasn't using it properly (I thought source was meant to be replaced by the source, rather than literally typing in ).
Still no luck with the headers,…
James Fitzell replied to James Fitzell's discussion 'AutoHeader and field extraction'
I'm also having terrible trouble getting Splunk to automatically import my logs.
The log files are being sent by FTP to a local directory on the Splunk server. Splunk shows me the correct number of files in the Manager - Data Inputs - Files…
AutoHeader and field extraction
I've spent some period of time trying to get Splunk to index our proxy logs and while I've made progress I'm still having some problems.My issues all revolve around field extraction, I was unable to use the "extract fields" option within the GUI because it wasn't correctly detecting the data format so the regex's were all wrong (and I don't know enough to write my own). I then progressed to the AutoHeader setting and after modifiying my log source a little (to better delimit fields) I now have…See More
Discussion posted by James Fitzell
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Network Security
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
