Hi Folks,
I have the following log file information. With my props.conf, it consumes it and visually shows fine, but I can't search on any of the elements without using spath. I would to be able to search on any of the sub-fields natively. There are two problems the first:
host="analytics" severity="8" | chart count(program)
Current Props:
[json_timestamp]
BREAK_ONLY_BEFORE_DATE = true
TIMESTAMP_FIELDS = timestamp
INDEXED_EXTRACTIONS = json
KV_MODE = none
Sample Log Info:
{"timestamp":"2016-10-20T21:58:31.428263+00:00", "host":"analytics", "host_ip":"127.0.0.1", "type":"syslog", "class":"SPLUNK_SERVER", "version":"1", "app":"axis", "severity_label":"info", "severity":"6", "facility_label":"user", "facility":"1", "program":"yum", "pid":"16284", "syslog_tag":"yum[16284]:", "message":" Updated: tzdata-java-2016g-2.64.amzn1.noarch"}
{"timestamp":"2016-10-20T21:58:31.983626+00:00", "host":"analytics", "host_ip":"127.0.0.1", "type":"syslog", "class":"SPLUNK_SERVER", "version":"1", "app":"axis", "severity_label":"info", "severity":"6", "facility_label":"user", "facility":"1", "program":"yum", "pid":"16284", "syslog_tag":"yum[16284]:", "message":" Updated: tzdata-2016g-2.64.amzn1.noarch"}
{"timestamp":"2016-10-20T21:58:32.038861+00:00", "host":"analytics", "host_ip":"127.0.0.1", "type":"syslog", "class":"SPLUNK_SERVER", "version":"1", "app":"axis", "severity_label":"info", "severity":"6", "facility_label":"user", "facility":"1", "program":"yum", "pid":"16284", "syslog_tag":"yum[16284]:", "message":" Updated: kernel-tools-4.4.23-31.54.amzn1.x86_64"}
{"timestamp":"2016-10-20T21:58:32.206431+00:00", "host":"analytics", "host_ip":"127.0.0.1", "type":"syslog", "class":"SPLUNK_SERVER", "version":"1", "app":"axis", "severity_label":"info", "severity":"6", "facility_label":"user", "facility":"1", "program":"yum", "pid":"16284", "syslog_tag":"yum[16284]:", "message":" Updated: aws-cfn-bootstrap-1.4-13.8.amzn1.noarch"}
{"timestamp":"2016-10-20T22:08:31.979328+00:00", "host":"analytics", "host_ip":"127.0.0.1", "type":"syslog", "class":"SPLUNK_SERVER", "version":"1", "app":"axis", "severity_label":"notice", "severity":"5", "facility_label":"auth", "facility":"4", "program":"su", "pid":"-", "syslog_tag":"su:", "message":" (to root) ec2-user on pts/0"}
↧