Hello,
I've got a problem with 2008 eventlogs returns by universal forwarder.
My win 2008 R2 is a french version and Fields which extract by Splunk contains spaces and they are not be used.
Splunk 4.3.5
Ex :
...
OpCode=Informations
RecordNumber=45957
Keywords=Échec de l’audit
Message=Échec d’ouverture de session d’un compte.
Sujet :
ID de sécurité : AUTORITE NT\Système
Nom du compte : MIB2011081$
...
No problem with 'OpCode' but 'Nom du compte' isn't usable yet appears in interesting fields.
With a Win2003 eventlog, no problem, 'Nom du compte' is automatically replace by 'Nom_du_compte' in interesting fields.
Any ideas ?
Thanks
A workaround may be to create a field extraction for this specific field.
example with an inline field extraction :
| rex "Nom du compte :\s(?<Nom_du_compte>\w+)"
see http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsatsearchtime
Hello,
I have a same issue on my splunk 5.0.4 with windows 2008 R2 french can you tell me how you solve this issue.
Thanks
A workaround may be to create a field extraction for this specific field.
example with an inline field extraction :
| rex "Nom du compte :\s(?<Nom_du_compte>\w+)"
see http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsatsearchtime
Thanks, finally that's what I do.
can you expline how to use rex in this example please