|
I've got Splunk installed on a Linux system and I'm forwarding all of the logs from my Zimbra email server over to splunk using Splunk to listen on UDP 514. The logs are being captured as syslog events and tagged with the host name. The Zimbra logs are actually being written as CSV events similar to the below: Each type of output has it's own csv format, with the header included in the log event. |
|
Hello, The way I would do is using a rex command to extract the values after the date at search time such as: index=-the index you are sending to- source=-your source file- "zmstat cpu.csv" | rex "softirq:: [^,]+,(?<cpu_user>[0-9.]),(?<cpu:nice>[0-9.]),(?<cpu:sys>[0-9.]),(?<cpu:idle>[0-9.]) -and so on-" If you are a bit advanced, you could as well ignore the header at index time to save some license space if this is important for you! Hope it helps. Olivier |
|
These are not Zimbra logs. You are looking at the zmstats files. They definitely contain useful information but the logs are usually under /opt/zimbra/log and named something like mailbox.log. There is also an access log tracking the web server connections (location varies by Zimbra version and you can also adjust via configuration). If you are running http or pop proxies, you will also have nginx log files. |
