I setup Splunk DB Connect to pull in log files that are stored in a MS SQL database. The logs have a Source column that is being excluded from the search results, since Connect DB makes you set a source type. I even tried to use a Rex and when testing the regular expression on regexr.com it identifies the regex, but some some reason Splunk is identifying the one that was declared in the Connect DB settings. Does anyone know a workaround for this?
↧