Quantcast
Channel: Questions in topic: "heavy-forwarder"
Viewing all articles
Browse latest Browse all 727

How configure SED props.conf on a Heavy Forwarder to make a field CIM compliant?

$
0
0
All, My first time messing with data manipulation at the heavy forwarder tier. Specifically looking to CIM a field my developers can't fix at code. Essentially quick sub elapsedTime to duration. Version: Splunk 6.32/UF 6.24 Linux CentOS 6.x props.conf [log4j] SED-alter = y/elapsedTime/duration/

Viewing all articles
Browse latest Browse all 727

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>