The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
James Fitzell's Discussions
AutoHeader and field extraction
3 Replies
I've spent some period of time trying to get Splunk to index our proxy logs and while I've made progress I'm still having some problems.My issues all revolve around field extraction, I was unable to…Continue
Started this discussion. Last reply by Michael Wilde Feb 10, 2010.
James Fitzell's Page
Gifts Received
James Fitzell has not received any gifts yet
Latest Activity
Michael Wilde replied to James Fitzell's discussion AutoHeader and field extraction"Got a sample I can monkey with?"
James Fitzell replied to James Fitzell's discussion AutoHeader and field extraction"I've resolved the failing to import issue. It was the crcSalt= setting, I just wasn't using it properly (I thought source was meant to be replaced by the source, rather than literally typing in ).
Still no luck with the headers,…"
James Fitzell replied to James Fitzell's discussion AutoHeader and field extraction"I'm also having terrible trouble getting Splunk to automatically import my logs.
The log files are being sent by FTP to a local directory on the Splunk server. Splunk shows me the correct number of files in the Manager - Data Inputs - Files…"
James Fitzell posted a discussionAutoHeader and field extraction
I've spent some period of time trying to get Splunk to index our proxy logs and while I've made progress I'm still having some problems.My issues all revolve around field extraction, I was unable to use the "extract fields" option within the GUI because it wasn't correctly detecting the data format so the regex's were all wrong (and I don't know enough to write my own). I then progressed to the AutoHeader setting and after modifiying my log source a little (to better delimit fields) I now have…See More
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- Network Security
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
