Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Field extraction on working (props.conf)

$
0
0
I have one props placed in location , opt splunk etc apps appname local props Below is the code [db_accounts] DATETIME_CONFIG = EXTRACT-AUTHID = \s+(?[A-Za-z]\w+)(,|\n) EVAL-sourcetype = if(source like "%rgn%","db_log_summaries",sourcetype) EXTRACT-PRIM_ID,CORR_ID,DATE,TIME,TABLE,DBASE,TBLSPACE,UPS,DES,NS = (?\w+)\s+(?(\W\w+|\w+))\s+(?\d{4}-\d{2}-\d{2})\s+(?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>