silkyrich / ingest_eval_examples Goto Github PK

in transforms.conf stanza: enrich_splunkd_component_level_thread-extract_log_level_etc the log_level DEBUG is being referenced twice
(INFO|DEBUG|ERROR|WARN|DEBUG)

I think, it should be:
(INFO|DEBUG|ERROR|WARN|FATAL)

For Splunk 8.2.4. the regex is not working
(\d{0,3}\.\d{0,3}\.\d{0,3}\.\d{0,3})\s-\s(\S*)\s\[[^\]]+\]\s"(GET|POST)\s(\S+)\s([^"]+)"\s(\d+)\s(\d+)\s-\s\-\s-\s(\d+)ms

Here an example
127.0.0.1 - splunk-system-user [19/Feb/2022:19:46:32.802 +0100] "GET /servicesNS/nobody/splunk_instrumentation/telemetry/general HTTP/1.0" 200 6381 "-" "splunk-sdk-python/1.6.15" - 2ms

The quotes around the dash are the problem:
6381 "-" "splunk

I changed it to:
(\d{0,3}\.\d{0,3}\.\d{0,3}\.\d{0,3})\s-\s(\S*)\s\[[^\]]+\]\s"(GET|POST)\s(\S+)\s([^"]+)"\s(\d+)\s(\d+)\s.*?"\s-\s(\d+)ms
simply ignoring all characters between 6381 and 2ms

enrich_splunkd_access_log-move_host_to_meta is referenced in props.conf in enrich_splunkd_access_log stanza, but the definition is missing (/not needed) in transforms.conf

BTW: great examples! I'm implementing the ideas in our production environment. Thanks a lot.