About nwenzl_splunk

nwenzl_splunk · ‎12-11-2023

Hello, two quick questions regarding the Splunk Add-on for JBoss and the Splunk Add-on for JMX: The documentation says that both TA's require Oracle JDK or openJDK. Given the documentation, I'm assuming that there is no possibility to run the TA's with another JDK distribution such as JDK variants of Azul (Zulu Prime aka Zing or Zulu) - could someone here confirm this? If it's indeed not possible, is it sufficient to only have the openJDK on the Heavy Forwarder? I would assume yes since the doc says: "Install Java Runtime 1.7 or later on the same machine as the Splunk Add-on for JBoss. Note: You need to use the OpenJDK Java Runtime or Oracle Java Runtime."

nwenzl_splunk · ‎03-20-2020

Thanks for your answer, I had already figured it out in the meantime. LINE_BREAKER = (&&&)(\d+) worked.

nwenzl_splunk · ‎03-20-2020

Hello Splunkers, I'm having trouble getting some weblogs to show up correctly in Splunk. What I'm trying to index looks like this: 201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4"&&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)" Every event is separated by &&& and so far I've managed the events to split somewhat correctly, but can't get rid of the &&& that still shows up at the beginning of each event: 201.28.109.162 - - [13/Jan/2016 21:03:04:164] "POST /cart.do?action=view&itemId=EST-21&product_id=FL-DLH-02&JSESSIONID=SD7SL9FF3ADFF4 HTTP 1.1" 404 2827 "http://www.myflowershop.com/category.screen?category_id=GIFTS" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4" &&&12.130.60.5 - - [13/Jan/2016 17:15:44:111] "POST /product.screen?product_id=FI-FW-02&JSESSIONID=SD8SL8FF7ADFF7 HTTP 1.1" 200 404 "http://www.myflowershop.com/product.screen?product_id=FI-FW-02" "Opera/9.20 (Windows NT 6.0; U; en)" props.conf: LINE_BREAKER = (\d+)&&&(\d+) NO_BINARY_CHECK = true REPORT-access = access-extractions SHOULD_LINEMERGE = false TIME_PREFIX = \[ TRUNCATE = 0 category = Custom disabled = false maxDist = 28 pulldown_type = true I've also tried using things like MUST_BREAK_AFTER = .+?(?=&&&) but that didn't help either. Anybody who can offer any advice?

nwenzl_splunk · ‎03-10-2020

Hi, have you tried using spath? https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Spath

nwenzl_splunk · ‎03-05-2020

Update: I got it to work by first combining the respective coordinates with mvzip, then breaking the pairs apart again with mvexpand and finally creating latitude and longitude fields with regex capture groups. Hope it can help somebody else! | head 1 | spath output=event.latitude path=events.data{}.place.location.latitude | spath output=event.longitude path=events.data{}.place.location.longitude | table event.latitude, event.longitude | eval test = mvzip('event.latitude', 'event.longitude', ";") | fields - event.* | mvexpand test | rex field=test "(?<latitude>.);(?<*longitude>.*)" | fields - test | geostats latfield=latitude longfield=longitude count

nwenzl_splunk · ‎02-28-2020

Hello Splunkers, So I am having trouble with some json nested arrays that contain multiple latitude and longitude in one event. Is there any way that I can split this one event up into 4 single events?

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-28-2020

Online Status	Offline
Date Last Visited	‎12-11-2023 04:36 AM

JRE for JBoss/JMX Add-Ons

Trouble splitting events correctly

Splitting multi-value field (json)

JRE for JBoss/JMX Add-Ons

Re: Trouble splitting events correctly

Trouble splitting events correctly

Re: json field extraction

Re: Splitting multi-value field (json)

Splitting multi-value field (json)