|
I am trying to remove the extra description text that gets appended to windows 2k8 logs using SEDCMD in props.conf. However, I can't seem to get it to work, no matter what i use as my expression. I am receiving events from a light forwarder on a windows box that is pulling the events using WMI from our domain controllers. The indexer is actually a linux box. This is what I have in props.conf Nothing is being removed. I've tried all kinds of variations on both the stanza name as well as the regular expression itself. I've tried just [WMI:WinEventLog:Security], [WMI:WinEventLog*], [WMI*], and even the name of one of the hosts: [host::<hostname>] I've also tried different variations of the regex. Even something like this doesn't do any replacement: I've tried with and without (single or double) quotes around the entire part after the = as well. Thoughts? |
|
The problem is that the You'd actually a stanza to match against sourcetype That worked. I will have to watch the performance as we will be looking at several million events a day just from all the DCs. Is it not possible to specify a sourcetype of [wmi:wineventlog:security] as that is what is shown in the search results, or is the sourcetype changed via a transform as well?
(03 Feb '11, 21:36)
ajs07635
Same problem with sourcetype I'm afraid. It is transformed at the same time as source. On the other hand, several million events per day isn't that much for a standard Splunk server to handle.
(04 Feb '11, 01:29)
gkanapathy ♦
|
Have you restarted Splunk after putting your SEDCMD stanza in place?
yep. every time I make a change, I restart splunk through the manager UI.