About Be_JAR

Be_JAR

Forgive my lack of knowledge. But the variables : $ingest_URL $SPLUNK_REALM .... Are configured in ITSI? I see that they are necessary for the installation of the collector.

Be_JAR

Thank you very much for your answer. An initial and basic doubt: Content Pack for Splunk Observability Cloud must be installed on the enterpise environment. Correct? BR

Be_JAR

Hello all, I am trying to ingest metrics via Opentelemetry in an enterprise environment. I have installed the Splunk Add-On for OpenTelemetry Collector , which according to the documentation is compatibl I have some doubts to configure it: where can you know the following connection points that my enterprise environment has? - SPLUNK_API_URL: The Splunk API URL, e.g. https://api.us0.signalfx.com - SPLUNK_INGEST_URL: The Splunk ingest URL, e.g. https://ingest.us0.signalfx.com - SPLUNK_LISTEN_INTERFACE: The network interface the agent receivers listen on.¿? - SPLUNK_TRACE_URL: The Splunk trace endpoint URL, e.g. https://ingest.us0.signalfx.com/v2/trace Is there a configuration file where to view it? Do I have to do some step before to get those services up? thanks in advance BR JAR T

Be_JAR

I finally got it this way: transform.conf: [my-log] Format = $1::$2 regex = FICHERO_LOG(\d+)\s+==s+([^=\n]+)\n MV-ADD = true props.conf REPORT-log = my-log thank you all for your help

Be_JAR

Hi all, I am ingesting data and I have a problem : event example: field1 = /var/log/asas/log1.log field2 = /var/log/as/as/log2.log field3 = /var/log/as/as/log3.log in the sourcetype (props.conf) I do it like this: ^.*field1 \=\s*(?<log1>.*?)\s*\n ^.*field2 \=\s*(?<log2>.*?)\s*\n ^.*field3 \=\s*(?<log3>.*?)\s*\n The problem is when the value of some field appears empty. In that case capture the following line. like this: source: field1 = /var/log/as/as/log1.log field2 = field3 = /var/log/log/as/log3.log result: log2= field3 = /var/log/logs/log3.log I'm sure there is a way to fix it and make the field appear empty, but I can't find it. Does anyone know how to do it? BR JAR

Be_JAR

this is the result: I would expect a LOG field to be created for each event with the different values of its log1, log2, or logn. Regular expression works (tested on 101), and other_transforms_stanza does not apply to this field.

Be_JAR

Hello everyone! I need some help creating a multivalue field. Events can contain 1 or more fields with the following forms: I try to explain with an example Event1: FICHERO_LOG1 = /any/log1/id/idca-admin/idca-admin.log FICHERO_LOG2 = /any/log1/id/log1/any1.log FICHERO_LOG3 = /any/log1/httpd/* Event2: FICHERO_LOG1 = /any/log2/id/id.log FICHERO_LOG2 = /any/log2/logging.log FICHERO_LOG3 = /any/log2/tree/httpd/ds/log2/* FICHERO_LOG4 = /any/log2/id/id-batch/id-batch2.log eventN FICHERO_LOG1 = /any/logN/data1/activemq.log FICHERO_LOG2 = /any/logN/id/hss2/*.system.log ……… FICHERO_LOGN = /any/path1/id/…./*…..log The result I expect is: For Event1 key values LOG= /any/log1/id/idca-admin/idca-admin.log /any/log1/id/log1/any1.log /any/log1/httpd/* for Event2: key values LOG= /any/log2/id/id.log /any/log2/logging.log /any/log2/tree/httpd/ds/log2/* /any/log2/id/idca-batch/idca-batch2.log For event N key values LOG= /any/logN/data1/activemq.log /any/logN/id/hss2/*.system.log ……. /any/path1/id/…./*…..log I have tried with transform.conf: [my-log] REGEX=^.*FICHERO_LOG.*\=\s*( ?<log>.*?)\s*\n MV-AD=true props.conf [extractingFields] TRANSFORM = other_transforms_stanza, my-log But it's not working. Any ideas or help? What steps should I follow? Thanks JAR

Be_JAR · ‎03-26-2024

Hi . Trying with: Field transformations: And adding them to sourcetype: But does not work is there anything wrong? Thank you all!! BR

Be_JAR · ‎03-25-2024

Thank you very much for the clarification. Yes, valid rows start with ##. And each event is what is inside each ##start_string and ##end_string block. From UI, is there any way to do the first step and remove the rows that do not start with ## ? BR JAR

Be_JAR · ‎03-25-2024

Thank you @marnall However, in my log (which has some line between event end markers and the next event start), something is wrong. Some info extra info ##start_string ##time = 1711292017 ##Field2 = 12 ##Field3 = field_value ##Field4 = somethingelse ##Field8 = 1 ##Field7 = 12 ##Field6 = 1 ##Field5 = ##end_string Some info more info extra info ##start_string ##time = 1711291017 ##Field2 = 12 ##Field3 = field_value2 ##Field4 = somethingelse3 ##Field8 = 14 ##Field7 = 12 ##Field6 = 15 ##Field5 = ##end_string SOme info more info info extra info ##start_string ##time = 1711282017 ##Field2 = 12 ##Field3 = asrsar ##Field4 = somethingelsec ##Field8 = 1 ##Field7 = 12 ##end_string Some info extra info Some idea to delimit events between the markers? ##start_string ##end_string BR JAR

Be_JAR · ‎03-22-2024

I tried it, but it didn't work. splunk does not create the events with the information between the delimiters: ## MONIT_DOC_START .... ..... ## MONIT_DOC_END Any ideas? I have also tried this (unsuccessful) : BR

Be_JAR · ‎03-21-2024

Hi all. I am ingesting data into Splunk Enterprise from a file. This file contains a lot of information, and I would like Splunk to make the events start on the ##start_string and end on the line before the next occurrence ##end_string Within these blocks there are different fields with the form-> ##key = value Here is an example of the file: ….. ##start_string ##Field = 1 ##Field2 = 12 ##Field3 = 1 ##Field4 = ##end_string ....... ##start_string ##Field = 22 ##Field2 = 12 ##Field3 = field_value ##Field4 = ##Field8 = 1 ##Field7 = 12 ##Field6 = 1 ##Field5 = ##end_string …… I have tried to create this sourcetype (with different regular expressions) but it creates only one event with all the lines: DATETIME_CONFIG = LINE_BREAKER = ([\n\r]+)##start_string ##LINE_BREAKER = ([\n\r]+##start_string\s+(?<block>.*?)\s+## end_string NO_BINARY_CHECK = true SHOULD_LINEMERGE = true category = Custom description = Format custom logs pulldown_type = 1 disabled = false How should I approach this case? Any ideas or help would be welcome Thanks in advanced

Posts	12
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎03-21-2024

Online Status	Offline
Date Last Visited	2 weeks ago

Add-On for OpenTelemetry Collector in enterprise

problem extracting empty values

extracting mv fields

Adding custom data from file

Re: Add-On for OpenTelemetry Collector in enterpri...

Re: Add-On for OpenTelemetry Collector in enterpri...

Add-On for OpenTelemetry Collector in enterprise

Re: extracting mv fields

problem extracting empty values

Re: extracting mv fields

extracting mv fields

Re: Adding custom data from file

Re: Adding custom data from file

Re: Adding custom data from file

Re: Adding custom data from file

Adding custom data from file