Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

I need a help in props.conf and transforms.conf

$
0
0
Hi, I am new to splunk. Need some help in log filtering. I have below example log: p 12 02:04:55 xxx,[DEFAULT_LOG] 2019-09-12 02:04:52,066 xxxxxxxxxxxxx Sep 12 02:04:55 xxx,[AUDIT_LOG] 2019-09-12 02:04:51,309 xxxxxxxxx Sep 12 02:04:55 xxx,[DEFAULT_LOG] 2019-09-12 02:04:51,904 xxxxxxx p 12 02:04:55 xxx,[AUTH_LOG] 2019-09-12 02:04:52,066 xxxxxxxxxxx I need to get only AUDIT_LOG and AUTH_LOG entry. How to write props and transforms confic file for this. Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>