About johndunlea

johndunlea · ‎07-05-2011

You could just rename the file something else, and tell Splunk to monitor that file. Then once Splunk reads in the contents of the "new" file (it will be a different source - but you could force this to be changed at index time), you can rename the file back to its original name, and Splunk will continue monitoring it as it would usually (provided that the inputs for that original file are still present).

johndunlea · ‎06-22-2011

Perfect solution. Thanks!

johndunlea · ‎06-22-2011

I have a SINGLE event in the following format (this is only part of the log): /root/pegaruninit: Empty file /root/eicar: Eicar-Test-Signature FOUND /root/.bash_history: Empty file This is part of an Antivirus log which is a "dump" of all the locations it scanned, and any viruses or signatures that it found. What i want to do is create a REGEX and REPORT that extracts the "Eicar-Test_Signature" from the log, and place it in a field called "virus_found". props.conf: REPORT-extract_virus_clamav = extract_virus_clamav transforms.conf: [extract_virus_clamav] REGEX = :\s(.+?)\sFOUND FORMAT = virus_found::$1 Problem is that it is taking the FIRST ":" and taking everything from " Empty file/root/eicar: Eicar-Test-Signature" and placing THIS in the new field. Is there a way to call a field extraction from ONE line at a time, from a multi line event?? EG: if the REGEX does not match the ":" AND the "FOUND" in one line, it continues to look through other lines?? I hope this makes sense! Thanks!

johndunlea · ‎05-25-2011

Thanks bwooden. I will check that now and see what I come up with.

johndunlea · ‎05-24-2011

When I run the backfill command for summary index searches in an app, I get an output saying that there is 30 searches found, but that 0 will be added to list. This is the command to backfill TWO summary indexes, using only TWO searches (there are a total of THREE searches in this app, however one is not for summary index gen): ./splunk cmd python fill_summary_index.py -app indexStatsApp -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:XXXXXXXXXXX After running this command, I get the following result: Getting list of all saved searches for selected app=indexStatsApp and owner=nobody ... found 30 saved searches ... of those, 0 will be added to list (those that are enabled, scheduled, and has summary_index action) No searches to run First of all, im not sure where Splunk is finding 30 searches, becuase there are only 3 in aoo. Secondly, I don't know why it cannot find the index searches to backfill the indexes. Summary indexing is turned on, and they are all saved, scheduled searches. Can anybody shed some light on this foor me?? Thanks!

johndunlea · ‎05-19-2011

Thanks jbssplunk. I thought that this was what could be done, but I was not sure if there would be issues with the shared storage mount. Thanks!

johndunlea · ‎05-19-2011

I want to archive my frozen data to another location which is not on my indexers. Is the simple way to do this, to set up a shared storage between the machines that the indexers are installed on, and then reference this path within the coldToFrozenDir attribute? Or are there more complicated Splunk attributes and configurations for this?

Posts	8
Solutions	1
Karma Given	2
Karma Received	19
Member Since	‎04-21-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Multi Line Event Field Extraction

Backfill command not finding searches

Archiving frozen data to another location

Re: What is the best method to reindex the file af...

Re: Multi Line Event Field Extraction

Multi Line Event Field Extraction

Re: Backfill command not finding searches

Backfill command not finding searches

Re: Archiving frozen data to another location

Archiving frozen data to another location