cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
AdamHolmes
New Member
Member since: ‎03-14-2018
‎12-12-2023
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎03-14-2018
View All

Re: How do I remove fields from VMWare Add-on befo...

by in Getting Data In
‎05-23-2018 12:28 PM
‎05-23-2018 12:28 PM
That's what I was leaning towards but as the data is 'tab' separated I was unsure on how the field extractions would handle that. I was hoping to specify just the field names to be excluded. Along with writing the regex would be just 'fun' Example data and would need to remove the bold (if I have to deal with raw data) vm-125620 5006a450-f3f4-3794-ecb7-a50b97a8bec4 vmnic5 20 0 0 0 0 0 0 0 vm-1111 501170cc-8439-1cb3-04ba-8dc34434b33c 4000 20 58738 1108 1108 0 379 0 379 11612 0 0 0 1487 0 vm-163268 5006d319-719a-d56c-3e3c-eb1cab4163de aggregated 20 656 2 2 0 91 0 91 1591 0 0 0 94 60 ... View more

Re: How do I remove fields from VMWare Add-on befo...

by in Getting Data In
‎05-23-2018 12:08 PM
‎05-23-2018 12:08 PM
I need the raw input go from {"message": "Running ITBSA Common Module", "field1": "some text", "state": "OK"} to {"field1": "some text", "state": "OK"} from the specficied sourcetype. However, the catch is that the true data that is coming in does not fit that format it looks like a tab separated data _raw: vm-1111 501170cc-8439-1cb3-04ba-8dc34434b33c 4001 20 0 0 0 0 0 0 0 21 0 0 0 0 21 ... View more

Re: How do I remove fields from VMWare Add-on befo...

by in Getting Data In
‎05-23-2018 11:15 AM
‎05-23-2018 11:15 AM
Tried this approach, I created a test message (in JSON format for example) _raw: {"message": "Running ITBSA Common Module", "field1": "some text", "state": "OK"} On the Search Head / Indexer (my test system is a combined one) Updated file: /opt/splunk/etc/system/local/props.conf [common] TRANSFORMS-null = drop_message Update file: /opt/splunk/etc/system/local/transforms.conf [drop_message] REGEX = state DEST_KEY = queue FORMAT = nullQueue I restarted splunkd and now no data is coming in. On a forwarder I have this specified to create test data [script://./bin/common.py] source = monitoring::test sourcetype = common ... View more

How do I remove fields from VMWare Add-on before i...

by in Getting Data In
‎05-23-2018 06:11 AM
‎05-23-2018 06:11 AM
I'm currently receiving an excess amount of data from the VMWare app sample below and would like to only keep a few of the fields before being indexed. Is there a way to do this? _raw: vm-1111 501170cc-8439-1cb3-04ba-8dc34434b33c 4001 20 0 0 0 0 0 0 0 21 0 0 0 0 21 Field Extractions: p_average_net_bytesRx_kiloBytesPerSecond 0 p_average_net_bytesTx_kiloBytesPerSecond 0 p_average_net_received_kiloBytesPerSecond 0 p_average_net_transmitted_kiloBytesPerSecond 0 p_average_net_usage_kiloBytesPerSecond 0 p_summation_net_broadcastRx_number 21 p_summation_net_broadcastTx_number 0 p_summation_net_droppedRx_number 0 p_summation_net_droppedTx_number 0 p_summation_net_multicastRx_number 0 p_summation_net_multicastTx_number 0 p_summation_net_packetsRx_number 21 p_summation_net_packetsTx_number 0 I'm looking to only keep these fields before being indexed (for example) p_average_net_received_kiloBytesPerSecond 0 p_average_net_transmitted_kiloBytesPerSecond 0 p_summation_net_droppedRx_number 0 p_summation_net_droppedTx_number 0 p_summation_net_packetsRx_number 21 p_summation_net_packetsTx_number 0 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎12-12-2023 02:34 PM