Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Zanusha443
Zanusha443
Explorer
Member since:
02-03-2023
10-05-2023
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 02-03-2023 |
Activity Feed
- Posted Are _SYSLOG_ROUTING and _TCP_ROUTING dest_keys on the transform.conf consume Splunk license ? on Splunk Enterprise. 10-04-2023 02:31 AM
- Tagged Are _SYSLOG_ROUTING and _TCP_ROUTING dest_keys on the transform.conf consume Splunk license ? on Splunk Enterprise. 10-04-2023 02:31 AM
- Tagged Are _SYSLOG_ROUTING and _TCP_ROUTING dest_keys on the transform.conf consume Splunk license ? on Splunk Enterprise. 10-04-2023 02:31 AM
- Posted How to add prefix string to events before forwarding to external server? on Getting Data In. 02-22-2023 08:54 AM
- Posted Re: Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? on Luxembourg User Group. 02-22-2023 05:52 AM
- Posted Re: Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? on Luxembourg User Group. 02-21-2023 07:02 AM
- Karma Re: Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? for PickleRick. 02-21-2023 06:59 AM
- Karma Re: Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? for gcusello. 02-21-2023 12:11 AM
- Posted Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? on Luxembourg User Group. 02-20-2023 09:32 AM
- Posted Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? on Getting Data In. 02-20-2023 09:17 AM
- Tagged Is it possible to create an if/else statement with the TRANSFORMS_ field into props.conf file ? on Getting Data In. 02-20-2023 09:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-04-2023
02:31 AM
Hi, I am sending logs without indexing on Splunk to another product by using the "SYSLOG_ROUTING" DEST_KEY on the transform.conf file. Looking at the documentation of "How Splunk licensing works", it says: "When ingesting event data, the measured data volume is based on the raw data that is placed into the indexing pipeline." By looking on the monitor console I realized that the indexer pipeline is made by: syslog out, tcp out and indexer lines, so it seems that by using syslog_routing dest key I could also consume Splunk license. Can you confirm this? Kind Regards, Angelo are those
... View more
- Tags:
- license
- tranform.conf
Labels
02-22-2023
08:54 AM
Hi everybody,
I would like to duplicate data coming from my sourcetype in such a way:
- send the original data to Splunk for indexing.
- send the duplicated events to an external server with "<DNS>" prefix string.
How should I modify the transform.conf file in order to do that?
Another question: is there a better way to forwards logs to external server while keeping the original source host (source IP) instead of adding prefixes like what I'm trying to do.
Thanks in advance,
Angelo
... View more
- Tags:
- splunk search
- string
Labels
- Labels:
-
heavy forwarder
-
indexer
-
transforms.conf
02-22-2023
05:52 AM
At the end I solved the issue with the help of the global community: https://community.splunk.com/t5/Getting-Data-In/Is-it-possible-to-create-an-if-else-statement-with-the/m-p/631617/thread-id/108255#M108259 Thanks for the help. Angelo
... View more
02-21-2023
07:02 AM
You are right, checking it again there are no duplicate events over the 2 indexes.
... View more
02-20-2023
09:32 AM
I have data coming from a single source but I want to send the events that match a REGEX to an index and all the other that not match it to another index. I have already tried to change the order of the fields into the TRANSFORMS_ but it still put the events in both indexes. This is the content of the props.conf file: [tmpproxy] TRANSFORMS_routing1 =CIDR_Routing_matched, CIDR_Routing_others and this is the content of the transforms.conf file: [CIDR_Routing_matched] REGEX =src_host\=(?:10\.10\.10\.\d{1,3}|) FORMAT = tmp_matched_proxy DEST_KEY=_MetaData:Index WRITE_META=true [CIDR_Routing_others] REGEX =.+ FORMAT = tmp_others_proxy DEST_KEY=_MetaData:Index WRITE_META=true Is it possible to stop the TRANSFORMS_ field in the props.conf file after the first good match?
... View more
Labels
- Labels:
-
index
-
props.conf
-
transforms.conf
02-20-2023
09:17 AM
I have data coming from a single source but I want to send the events that match a REGEX to an index and all the other that not match it to another index. I have already tried to change the order of the fields into the TRANSFORMS_ but it still put the events in both indexes. This is the content of the props.conf file: [tmpproxy] TRANSFORMS_routing1 =CIDR_Routing_matched, CIDR_Routing_others and this is the content of the transforms.conf file: [CIDR_Routing_matched] REGEX =src_host\=(?:10\.10\.10\.\d{1,3}|) FORMAT = tmp_matched_proxy DEST_KEY=_MetaData:Index WRITE_META=true [CIDR_Routing_others] REGEX =.+ FORMAT = tmp_others_proxy DEST_KEY=_MetaData:Index WRITE_META=true Is it possible to stop the TRANSFORMS_ field in the props.conf file after the first good match?
... View more
- Tags:
- routing
Labels
- Labels:
-
index
-
props.conf
-
transforms.conf
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-05-2023
01:36 PM
|
