About raghunand

raghunand · ‎11-25-2015

Sure my bad ! I see this seems to return what I want index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[^\/]+)\/" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName Thank you !!

raghunand · ‎11-25-2015

Thank you sundar. But I could not get any results.. maybe the search command is wrong... Here is what I tried index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\s(?[\d.-]+)\sor\s(?[\d.]+)" | dedup pname, pname1 | table pname, pname1

raghunand · ‎11-25-2015

Thank you Rich - I did get most of the desired results all versions except for versions with SNAPSHOT. Any idea how to include the SNAPSHOTS? I am adding a few example paths here: /nfs/tibcosoftware/Splunk/impactAnalysis/menlo/FSIValidationForClassic/1.02-SNAPSHOT-1.02-SNAPSHOT.24 /nfs/tibcosoftware/Splunk/impactAnalysis/sharedapps/CSCHRCompanyEventPublisher/1.0.0-8 /nfs/tibcosoftware/Splunk/impactAnalysis/freight/ConwayServices-Customer/1.04-SNAPSHOT-47 index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "\/(?:[^\/]*\/){4}(?P[^\/]+)\/(?P[^\/]+)\/(?P[\d\.\-]+)(?:\/|-SNAPSHOT)" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName

raghunand · ‎11-24-2015

Ex: /nfs/tibcosoftware/splunk/impactAnalysis/freight/ConwayServicesOMSEvents/1.01-49/AESchemas /nfs/tibcosoftware/splunk/impactAnalysis/freight/Conway-OMSEvents/1.01-SNAPSHOT-57/AESchemas iaComponent=freight iaProjectName= ConwayServicesOMSEvents or Conway-OMSEvents iaReleasedVersionName= 1.01-49 or 1.01-SNAPSHOT-57 I have tried the following, but I cannot get <Project> literals with - or <Version> literals with no SNAPSHOTS. index=eicoe_tibco_ia sourcetype=eicoe_tibco_ia "wsdl" | rex field=iaSource "(/\w*)+(/\w*)+(/\w*)+(/\w*)+(?<iaComponent>(/\w*))+(?<iaProjectName>(/\w*))+(?<iaReleasedVersionName>(/\d*)\.(\d*)[^-]*(-SNAPSHOT))" | dedup iaComponent, iaProjectName, iaReleasedVersionName | table iaComponent, iaProjectName, iaReleasedVersionName Please advise?

raghunand · ‎10-13-2015

My regex to extract a file from a source field works: [^/]*(?=($|\?)) For example: /nfs/tibcosoftware/Splunk/impactAnalysis/freight/TestProject/1.0-SNAPSHOT-31/defaultVars/folder/defaultVars.substvar returns defaultVars.substvar See here - http://www.regexr.com/3bvp8 But when I try using this in the rex search command, I cannot get the same result. Why? sourcetype=tibco_ia | rex field=source "(?<iaFileName>.*)[^/]*(?=($|\?))" | table iaFileName This returns full file path - /nfs/tibcosoftware/Splunk/impactAnalysis/freight/TestProject/1.0-SNAPSHOT-31/defaultVars/folder/defaultVars.substvar , but I expected to get defaultVars.substvar Please advise?

raghunand · ‎08-06-2014

Thanks for giving setting and sorry about the font, it was unintentional 🙂 I tried the settings and still no result. Q - for [tcpout:splunk_cloud] disabled = false server = ? Did you get the server name from "Splunk server name" in the general settings ? Raghu

raghunand · ‎08-05-2014

ok then thats exactly the one I had changed. But it did not work [satibsvc@cdcxvt0765 local]$ cat outputs.conf [tcpout] defaultGroup = default-autolb-group defaultGroup = sandbox [tcpout:default-autolb-group] server = cdcxvt0765.conway.prod.con-way.com:9997 [tcpout-server://cdcxvt0765.conway.prod.con-way.com:9997] [tcpout:sandbox] server = input-XXXXXXXXX.splunk6.splunktrial.com:9997 [satibsvc@cdcxvt0765 local]$ pwd /opt/eicoe/splunkforwarder/etc/system/local [satibsvc@cdcxvt0765 local]$

raghunand · ‎08-05-2014

OR Can I change a different output.conf. Other output.conf available are ./splunk/etc/modules/distributedDeployment/classes/deployable/outputs.conf ./splunk/etc/system/default/outputs.conf ./splunk/etc/apps/SplunkLightForwarder/default/outputs.conf ./splunk/etc/apps/SplunkForwarder/default/outputs.conf ./splunkforwarder/etc/system/local/outputs.conf ./splunkforwarder/etc/system/default/outputs.conf ./splunkforwarder/etc/apps/SplunkUniversalForwarder/default/outputs.conf OR something else ?? Please advice ? Raghu

raghunand · ‎08-05-2014

When I installed the splunk forwarder in Unix I did not see the folder local under /opt/splunkforwarder/etc/apps/search/ So does this mean I have the wrong install? I installed splunkforwarder-6.1.2-213098-Linux-x86_64.gz OR Does does this mean I missed a configuration step?

raghunand · ‎08-01-2014

According to step 3 "3. To help configure your forwarder, we've provided an app. Your app is unique to you. Unzip the attached file and move the entire unzipped directory into your forwarder app directory, /opt/splunkforwarder/etc/apps" Where do I actually find this app? online in the App List? Does it get emailed?

raghunand · ‎08-01-2014

Can you please provide the steps to configure splunk forwarder to talk to a splunk web instance in the cloud?

Posts	11
Solutions	0
Karma Given	2
Karma Received	6
Member Since	‎01-10-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

What regular expression can be used to extract lit...

extract file name from the source using rex

Steps to setup splunk forwarder for splunk in the ...

Re: What regular expression can be used to extract...

Re: What regular expression can be used to extract...

Re: What regular expression can be used to extract...

What regular expression can be used to extract lit...

extract file name from the source using rex

Re: How do I send my own data into a Splunk Cloud ...

Re: How do I send my own data into a Splunk Cloud ...

Re: How do I send my own data into a Splunk Cloud ...

Re: How do I send my own data into a Splunk Cloud ...

Re: Steps to setup splunk forwarder for splunk in ...

Steps to setup splunk forwarder for splunk in the ...