Current Path :
/
opt
/
splunkforwarder
/
etc
/
system
/
default
/
Or
Select Your Path :
Upload File :
New :
File
Dir
//opt/splunkforwarder/etc/system/default/props.conf
# Version 9.4.7 # DO NOT EDIT THIS FILE! # Changes to default files will be lost on update and are difficult to # manage and support. # # Please make any changes to system defaults by overriding them in # apps or $SPLUNK_HOME/etc/system/local # (See "Configuration file precedence" in the web documentation). # # To override a specific setting, copy the name of the stanza and # setting to the file where you wish to override it. # # This file contains possible attribute/value pairs for configuring # Splunk's processing properties. # [default] CHARSET = UTF-8 LINE_BREAKER_LOOKBEHIND = 100 TRUNCATE = 10000 LB_CHUNK_BREAKER_TRUNCATE = 2000000 DATETIME_CONFIG = /etc/datetime.xml ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True HEADER_MODE = MATCH_LIMIT = 100000 DEPTH_LIMIT = 1000 MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = false SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = True MAX_EVENTS = 256 MAX_EXPECTED_EVENT_LINES = 7 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard LEARN_SOURCETYPE = true LEARN_MODEL = true termFrequencyWeightedDist = false maxDist = 100 AUTO_KV_JSON = true detect_trailing_nulls = false sourcetype = priority = unarchive_cmd_start_mode = shell ########## APPLICATION SERVERS ########## [log4j] BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d pulldown_type = true maxDist = 75 category = Application description = Output produced by any Java 2 Enterprise Edition (J2EE) application server using log4j [log4php] pulldown_type = true BREAK_ONLY_BEFORE = ^\w{3} \w{3} category = Application description = Output produced by a machine that runs the log4php logging utility [weblogic_stdout] pulldown_type = true maxDist = 60 MAX_TIMESTAMP_LOOKAHEAD = 34 MAX_EVENTS = 2048 REPORT-st = weblogic-code category = Application description = Output produced by the Oracle WebLogic Java EE application server [websphere_activity] pulldown_type = true BREAK_ONLY_BEFORE = ^----- MAX_TIMESTAMP_LOOKAHEAD = 500 REPORT-st = colon-line category = Application description = Activity logs produced by the Oracle WebLogic Java EE application server [websphere_core] pulldown_type = true maxDist = 70 BREAK_ONLY_BEFORE = ^NULL\s category = Application description = Output produced by the IBM WebSphere application server [websphere_trlog] pulldown_type = true REPORT-st = was-trlog-code category = Application description = Trace output produced by the IBM WebSphere application server [log4net_xml] maxDist = 75 NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <log4net:event TIME_PREFIX = timestamp=" MAX_EVENTS = 1000 pulldown_type = 1 category = Application description = An XML-formatted output of the Apache log4j framework to the Microsoft .NET runtime [catalina] BREAK_ONLY_BEFORE_DATE = true SHOULD_LINEMERGE=true MAX_TIMESTAMP_LOOKAHEAD=30 TIME_PREFIX = ^ pulldown_type = 1 category = Application description = Output produced by Apache Tomcat Catalina (System.out and System.err) [ruby_on_rails] TIME_PREFIX = (for [\d\.]+ at\s) TIME_FORMAT = %Y-%m-%d %H:%M:%S %Z BREAK_ONLY_BEFORE = Processing pulldown_type = 1 category = Application description = Output produced by a Ruby On Rails Web application framework ########## ARCHIVES ########## [preprocess-bzip] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-Z] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-gzip] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-tar] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-zip] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-targz] invalid_cause = archive is_valid = False LEARN_MODEL = false [preprocess-zstd] invalid_cause = archive is_valid = False LEARN_MODEL = false ########## DATABASES ########## [db2_diag] pulldown_type = 1 maxDist = 90 REPORT-st = db2 category = Database description = Diagnostic output produced by the IBM DB2 database server [mysqld] pulldown_type = 1 maxDist = 20 BREAK_ONLY_BEFORE = ^\d{6}\s TIME_FORMAT = %y%m%d %k:%M:%S category = Database description = Output produced by the MySQL database server [mysqld_error] pulldown_type = 1 maxDist = 50 MAX_EVENTS = 1024 BREAK_ONLY_BEFORE = ^\d{6}\s category = Database description = Errors produced by the MySQL database server [mysqld_bin] pulldown_type = 1 maxDist = 20 BREAK_ONLY_BEFORE = ^#\d{6} category = Database description = Binary log output produced by the MySQL database server [mysql_slow] SHOULD_LINEMERGE = true TIME_FORMAT = Time: %y%m%d %k:%M:%S %Z BREAK_ONLY_BEFORE = #\sTime:\s\d{6}\s[\s\d]\d:\d\d:\d\d MAX_EVENTS = 512 pulldown_type = 1 category = Database description = Slow query log output produced by the MySQL database server ########## EMAIL ########## [exim_main] SHOULD_LINEMERGE = False [exim_reject] SHOULD_LINEMERGE = False [postfix_syslog] pulldown_type = 1 MAX_TIMESTAMP_LOOKAHEAD = 32 TIME_FORMAT = %b %d %H:%M:%S TRANSFORMS-host = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False category = Email description = Output produced by the Postfix email server [sendmail_syslog] pulldown_type = 1 MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False TIME_FORMAT = %b %d %H:%M:%S TRANSFORMS = syslog-host REPORT-syslog = sendmail-extractions category = Email description = Output produced by the Sendmail email server [procmail] pulldown_type = 1 BREAK_ONLY_BEFORE = procmail: \[\d+\] MAX_TIMESTAMP_LOOKAHEAD = 64 category = Email description = Output produced by the Procmail email server ########## OSs ########## [linux_messages_syslog] pulldown_type = 1 MAX_TIMESTAMP_LOOKAHEAD = 32 TIME_FORMAT = %b %d %H:%M:%S TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False category = Operating System description = Format found within the Linux log file /var/log/messages [linux_secure] pulldown_type = 1 REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False category = Operating System description = Format for the /var/log/secure file containing all security related messages on a Linux machine [linux_audit] pulldown_type = 1 BREAK_ONLY_BEFORE_DATE = False category = Operating System description = Output produced by the auditd system daemon used to track changes on a Linux machine [linux_bootlog] BREAK_ONLY_BEFORE_DATE = False [anaconda] BREAK_ONLY_BEFORE = ^\* [anaconda_syslog] REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False TIME_FORMAT = %b %d %H:%M:%S [osx_asl] BREAK_ONLY_BEFORE_DATE = False REPORT-asl = bracket-space [osx_crashreporter] BREAK_ONLY_BEFORE_DATE = False [osx_crash_log] BREAK_ONLY_BEFORE = gooblygook MAX_EVENTS = 200000 [osx_install] BREAK_ONLY_BEFORE_DATE = False [osx_secure] BREAK_ONLY_BEFORE_DATE = False [osx_daily] BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) [osx_weekly] BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) [osx_monthly] BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) [osx_window_server] SHOULD_LINEMERGE = False [windows_snare_syslog] pulldown_type = 1 MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False TIME_FORMAT = %b %d %H:%M:%S category = Operating System description = Output produced by the Snare syslog server on Windows [dmesg] pulldown_type = 1 BREAK_ONLY_BEFORE = ^\S DATETIME_CONFIG = NONE category = Operating System description = Output produced by the "dmesg" *nix command, printing the *nix kernel ring buffer [ftp] pulldown_type = 0 BREAK_ONLY_BEFORE_DATE = False [ssl_error] pulldown_type = 0 BREAK_ONLY_BEFORE_DATE = False [syslog] pulldown_type = true maxDist = 3 TIME_FORMAT = %b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 32 TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions SHOULD_LINEMERGE = False category = Operating System description = Output produced by many syslog daemons, as described in RFC3164 by the IETF [sar] ; break on blanklines, clock-resets, or common headers attributes (/s, %, or alpha-) BREAK_ONLY_BEFORE = (?:^\s*$)|00:00:0|/s|%|[a-z]- MAX_EVENTS = 1000 [rpmpkgs] BREAK_ONLY_BEFORE_DATE = False LEARN_MODEL = false ########## NETWORK ########## [novell_groupwise] SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 9 TRANSFORMS-nov = novell-groupwise-arrival,novell-groupwise-queue,novell-groupwise-transfer [tcp] BREAK_ONLY_BEFORE = (=\+)+ KV_MODE = none REPORT-tcp = tcpdump-endpoints, colon-kv ########## PRINTERS ########## [cups_access] BREAK_ONLY_BEFORE_DATE = False [cups_error] BREAK_ONLY_BEFORE_DATE = False [spooler] BREAK_ONLY_BEFORE_DATE = False ########## ROUTERS AND FIREWALLS ########## [cisco_cdr] maxDist = 1 SHOULD_LINEMERGE = False [cisco_syslog] pulldown_type = 0 MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False TIME_FORMAT = %b %d %H:%M:%S TRANSFORMS = syslog-host REPORT-syslog = syslog-extractions [cisco:asa] SHOULD_LINEMERGE = false pulldown_type = 1 category = Network & Security description = Output produced by the Cisco Adaptive Security Appliance (ASA) Firewall [clavister] SHOULD_LINEMERGE = False ########## VoIP ########## [asterisk_cdr] MAX_TIMESTAMP_LOOKAHEAD = 256 SHOULD_LINEMERGE = False [asterisk_event] maxDist = 3 SHOULD_LINEMERGE = False [asterisk_messages] SHOULD_LINEMERGE = False [asterisk_queue] SHOULD_LINEMERGE = False ########## WEBSERVERS ########## [access_combined] pulldown_type = true maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = \[ category = Web description = National Center for Supercomputing Applications (NCSA) combined format HTTP web server logs (can be generated by apache or other web servers) [access_combined_wcookie] MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = \[ [access_common] MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = \[ [apache_error] pulldown_type = true maxDist = 50 MAX_TIMESTAMP_LOOKAHEAD = 128 BREAK_ONLY_BEFORE = ^\[ TIME_FORMAT = [%A %B %d %T %Y] category = Web description = Error log format produced by the Apache web server (typically error_log on *nix systems) [iis] pulldown_type = true MAX_TIMESTAMP_LOOKAHEAD = 32 SHOULD_LINEMERGE = False INDEXED_EXTRACTIONS = w3c detect_trailing_nulls = auto category = Web description = W3C Extended log format produced by the Microsoft Internet Information Services (IIS) web server ########## MISC ########## [snort] pulldown_type = true BREAK_ONLY_BEFORE = (=\+)+ KV_MODE = none REPORT-tcp = tcpdump-endpoints, colon-kv category = Network & Security description = Output produced by the Snort network intrusion detection/prevention application ########## SPLUNK ########## [splunk_com_php_error] maxDist = 70 MAX_TIMESTAMP_LOOKAHEAD = 40 [splunkd] MAX_TIMESTAMP_LOOKAHEAD = 40 # splunkd TIME_FORMAT should be kept in synch with # - etc/log.cfg # - src/framework/SplunkdTimestamp.cpp # This format won't, of course, match all older forwarders, but regex fallback # will handle those cases TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z # logs from old forwarders (4.1 and prior) will not match the TIME_FORMAT, due to a lack of timezone. # This will cause some events to be merged. # Disable multiline support to get these case right. # Splunkd data prior to 5.0 can have multiline events, but it is quite rare # (debug output and bugs mostly), and 5.0+ explicitly disallows generating such SHOULD_LINEMERGE = false TRUNCATE = 20000 [splunkd_crash_log] SHOULD_LINEMERGE = True MUST_BREAK_AFTER = ^(?i)terminating\.\.\. MAX_TIMESTAMP_LOOKAHEAD = 1 DATETIME_CONFIG = NONE MAX_EVENTS = 2048 [splunkd_misc] SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 1 [splunkd_stderr] TIME_FORMAT = %m-%d-%Y %T.%Q %z SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 40 LINE_BREAKER = ([\r\n]+)(?:\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3}) EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+)(?:\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}\.\d{3}) [splunkd_stdout] DATETIME_CONFIG = NONE SHOULD_LINEMERGE = False [splunk_python] TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N %z LINE_BREAKER = ([\n\r]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2} SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_pdfgen] TIME_FORMAT = %m-%d-%Y %H:%M%S,%l SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk-blocksignature] SEGMENTATION = whitespace-only MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_directory_monitor] MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_directory_monitor_misc] MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_search_history] BREAK_ONLY_BEFORE = ^\d MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_search_messages] MAX_TIMESTAMP_LOOKAHEAD = 40 TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z SHOULD_LINEMERGE = false TRUNCATE = 20000 EXTRACT-message = .*?(message=)(?<message>.*)$ EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - [splunkd_remote_searches] MAX_TIMESTAMP_LOOKAHEAD = 40 TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z SHOULD_LINEMERGE = false REPORT-fields = remote_searches_extractions_starting,remote_searches_extractions_terminated, remote_searches_extractions_starting_fallback KV_MODE = none TRUNCATE = 20000 [searches] SHOULD_LINEMERGE = False [splunkd_access] maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions, extract_spent SHOULD_LINEMERGE = False TIME_PREFIX = \[ TRUNCATE = 20000 [wlm_monitor] MAX_TIMESTAMP_LOOKAHEAD = 40 TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z SHOULD_LINEMERGE = False TRUNCATE = 20000 [splunkd_ui_access] maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions, extract_spent SHOULD_LINEMERGE = False TIME_PREFIX = \[ TRUNCATE = 20000 [splunk_web_access] maxDist = 28 MAX_TIMESTAMP_LOOKAHEAD = 128 REPORT-access = access-extractions SHOULD_LINEMERGE = False TIME_PREFIX = \[ EXTRACT-extract_spent = \s(?<spent>\d+(\.\d+)?)ms$ TRUNCATE = 75000 [splunk_web_service] MAX_TIMESTAMP_LOOKAHEAD = 40 REPORT-fields = splunk-service-extractions TRUNCATE = 20000 [splunkd_conf] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none TRUNCATE = 20000 [splunk_help] BREAK_ONLY_BEFORE = gooblygook MAX_EVENTS = 200000 TRANSFORMS-help = splunk_help [postgres] TIME_FORMAT = %Y-%m-%d %H:%M:%S.%l %Z MAX_TIMESTAMP_LOOKAHEAD = 40 [mongod] TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 40 [mongod_upgrade] TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%Z SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 40 [splunk_version] DATETIME_CONFIG = CURRENT MUST_NOT_BREAK_AFTER = .* [source::.../var/log/splunk/searchhistory.log(.\d+)?] TRANSFORMS = splunk_index_history sourcetype = splunk_search_history [source::.../var/log/splunk/(web|report)_access(-\d+)?.log(.\d+)?] sourcetype = splunk_web_access [source::.../var/log/splunk/(web|report)_service(-\d+)?.log(.\d+)?] sourcetype = splunk_web_service [source::.../var/log/splunk/metrics.log(.\d+)?] sourcetype = splunkd [source::.../var/log/splunk/license_usage(|_summary).log(.\d+)?] sourcetype = splunkd [source::.../splunkd.log(.\d+)?] sourcetype = splunkd [source::.../mergebuckets.log(.\d+)?] sourcetype = splunkd [source::.../var/log/splunk/configuration_change.log(.\d+)?] sourcetype = splunk_configuration_change TRUNCATE = 0 [source::.../var/log/splunk/splunkd-utility.log(.\d+)?] sourcetype = splunkd [source::.../var/log/splunk/scheduler.log(.\d+)?] sourcetype = scheduler [source::.../var/log/splunk/audit.log(.\d+)?] TRANSFORMS = send_to_nullqueue sourcetype = splunk_audit [source::.../var/log/splunk/btool.log(.\d+)?] sourcetype = splunk_btool [source::.../var/log/splunk/intentions.log(.\d+)?] sourcetype = splunk_intentions [source::.../var/log/splunk/python.log(.\d+)?] sourcetype = splunk_python [source::.../var/log/splunk/pdfgen.log(.\d+)?] sourcetype = splunk_pdfgen [source::.../var/log/splunk/searches.log] sourcetype = searches [source::.../var/log/splunk/splunkd_stdout.log(.\d+)?] sourcetype = splunkd_stdout [source::.../var/log/splunk/splunkd_stderr.log(.\d+)?] sourcetype = splunkd_stderr [source::.../var/log/splunk/*crash-*.log] sourcetype = splunkd_crash_log [source::.../var/log/splunk/migration.log.*] sourcetype = splunk_migration [source::.../var/log/splunk/remote_searches.log(.\d+)?] sourcetype = splunkd_remote_searches [source::.../splunkd_access.log(.\d+)?] sourcetype = splunkd_access [source::.../wlm_monitor.log(.\d+)?] sourcetype = wlm_monitor [source::.../splunkd_ui_access.log(.\d+)?] sourcetype = splunkd_ui_access [source::.../var/log/splunk/conf.log(.\d+)?] sourcetype = splunkd_conf [source::.../var/log/splunk/postgres-*.log] sourcetype = postgres [source::.../var/log/splunk/mongod.log(.\d+)?] sourcetype = mongod [source::.../var/log/splunk/mongod_upgrade.log(.\d+)?] sourcetype = mongod_upgrade [source::.../var/log/splunk/health.log(.\d+)?] sourcetype = splunkd [source::.../var/log/watchdog/watchdog.log(.\d+)?] sourcetype = splunkd [source::.../var/log/splunk/search_messages.log(.\d+)?] sourcetype = splunk_search_messages [source::.../etc/splunk.version] sourcetype = splunk_version ########## SPECIAL ########## [__singleline] SHOULD_LINEMERGE = False [too_small] maxDist = 9999 BREAK_ONLY_BEFORE_DATE = True PREFIX_SOURCETYPE = True ; same as too_small but for larger text that has special characters [breakable_text] BREAK_ONLY_BEFORE = (^(?:---|===|\*\*\*|___|=+=))|^\s*$ LEARN_MODEL = false [lastlog] invalid_cause = binary LEARN_MODEL = false [wtmp] invalid_cause = binary LEARN_MODEL = false [known_binary] is_valid = False invalid_cause = binary LEARN_MODEL = false [ignored_type] is_valid = False invalid_cause = ignored_type LEARN_MODEL = false [stash] TRUNCATE = 0 # only look for ***SPLUNK*** on the first line HEADER_MODE = firstline # we can summary index past data, but rarely future data MAX_DAYS_HENCE = 2 MAX_DAYS_AGO = 10000 # 5 years difference between two events MAX_DIFF_SECS_AGO = 155520000 MAX_DIFF_SECS_HENCE = 155520000 MAX_TIMESTAMP_LOOKAHEAD = 64 LEARN_MODEL = false # search time extractions KV_MODE = none REPORT-1 = stash_extract [stash_new] TRUNCATE = 0 # only look for ***SPLUNK*** on the first line HEADER_MODE = firstline # we can summary index past data, but rarely future data MAX_DAYS_HENCE = 2 MAX_DAYS_AGO = 10000 # 5 years difference between two events MAX_DIFF_SECS_AGO = 155520000 MAX_DIFF_SECS_HENCE = 155520000 MAX_TIMESTAMP_LOOKAHEAD = 64 LEARN_MODEL = false # break .stash_new custom format into events SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = false LINE_BREAKER = (\r?\n==##~~##~~ 1E8N3D4E6V5E7N2T9 ~~##~~##==\r?\n) # change sourcetype to stash before indexing/forwarding this data (these events # are feed to the stashparsing pipeline) TRANSFORMS-sourcetype = set_sourcetype_to_stash [stash_hec] SHOULD_LINEMERGE = False pulldown_type = false INDEXED_EXTRACTIONS = hec # we can summary index past data, but rarely future data MAX_DAYS_HENCE = 2 MAX_DAYS_AGO = 10000 # 5 years difference between two events MAX_DIFF_SECS_AGO = 155520000 MAX_DIFF_SECS_HENCE = 155520000 [mcollect_stash] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = csv ADD_EXTRA_TIME_FIELDS = subseconds KV_MODE = none TIMESTAMP_FIELDS = metric_timestamp TIME_FORMAT = %s.%Q ########## NON-LOG FILES ########## # settings copied from zip [source_archive] invalid_cause = needs_preprocess is_valid = False LEARN_MODEL = false [web] BREAK_ONLY_BEFORE=goblygook MAX_EVENTS=200000 DATETIME_CONFIG = NONE CHECK_METHOD = modtime LEARN_MODEL = false [backup_file] BREAK_ONLY_BEFORE=goblygook MAX_EVENTS=10000 LEARN_MODEL = false [manpage] BREAK_ONLY_BEFORE = gooblygook MAX_EVENTS = 200000 DATETIME_CONFIG = NONE CHECK_METHOD = modtime LEARN_MODEL = false [misc_text] BREAK_ONLY_BEFORE=goblygook MAX_EVENTS=200000 DATETIME_CONFIG = NONE CHECK_METHOD = modtime pulldown_type = false LEARN_MODEL = false [csv] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = csv KV_MODE = none category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" [psv] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = psv FIELD_DELIMITER=| HEADER_FIELD_DELIMITER=| KV_MODE = none category = Structured description = Pipe-separated value format. Set header and other settings in "Delimited Settings" [tsv] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = tsv FIELD_DELIMITER=tab HEADER_FIELD_DELIMITER=tab KV_MODE = none category = Structured description = Tab-separated value format. Set header and other settings in "Delimited Settings" [_json] pulldown_type = true INDEXED_EXTRACTIONS = json KV_MODE = none category = Structured description = JavaScript Object Notation format. For more information, visit http://json.org/ [json_no_timestamp] BREAK_ONLY_BEFORE = ^{ DATETIME_CONFIG = CURRENT MAX_TIMESTAMP_LOOKAHEAD = 800 pulldown_type = 1 category = Structured description = A variant of the JSON source type, with support for nonexistent timestamps [fs_notification] SHOULD_LINEMERGE=false [exchange] INDEXED_EXTRACTIONS = w3c KV_MODE = none [generic_single_line] TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N %Z SHOULD_LINEMERGE = false pulldown_type = 1 category = Miscellaneous description = A common log format with a predefined timestamp. Customize timestamp in "Timestamp" options ########## RULE BASED CONDITIONS ########## [rule::snort] sourcetype = snort # IF MORE THAN 5% OF LINES MATCH REGEX, MUST BE THIS TYPE MORE_THAN_1 = (=\+)+ MORE_THAN_10 = (?:[0-9A-F]{2} ){16} [rule::exim_main] sourcetype = exim_main # MORE THAN 2% HAVE <=, =>, 'queue' MORE_THANA_2 = <= MORE_THANB_2 = => MORE_THANC_2 = queue [rule::postfix_syslog] sourcetype = postfix_syslog # IF 75% OF LINES MATCH REGEX, MUST BE THIS TYPE MORE_THAN_75 = ^\w{3} +\d+ \d\d:\d\d:\d\d .* postfix(/\w+)?\[\d+\]: [rule::sendmail_syslog] sourcetype = sendmail_syslog # IF 75% OF LINES MATCH REGEX, MUST BE THIS TYPE MORE_THAN_75 = ^\w{3} +\d+ \d\d:\d\d:\d\d .* (sendmail|imapd|ipop3d)\[\d+\]: [rule::access_common] sourcetype = access_common MORE_THAN_75 = ^\S+ \S+ \S+ \[[^\]]+\] "[^"]+" \S+ \S+$ [rule::access_combined] sourcetype = access_combined MORE_THAN_75 = ^\S+ \S+ \S+ \S* ?\[[^\]]+\] "[^"]*" \S+ \S+ \S+ "[^"]*"$ [rule::access_combined_wcookie] sourcetype = access_combined_wcookie # more restrictive version = ^\S+ \S+ \S+ \S* ?\[[^\]]+\] "[^"]*" \S+ \S+ \S+ "[^"]*" "[^"]*"$ MORE_THAN_75 = ^\S+ \S+ \S+ \S* ?\[[^\]]+\] "[^"]*" \S+ \S+(?: \S+)? "[^"]*" "[^"]*" ### DELAYED RULE BASED CONDITIONS. RUN AS LAST DITCH EFFORT BEFORE MAKING A NEW SOURCETYPE ### # break text on ascii art and blanklines if more than 10% of lines # have ascii art or blanklines, and less than 10% have timestamps [delayedrule::breakable_text] MORE_THAN_10 = (^(?:---|===|\*\*\*|___|=+=))|^\s*$ LESS_THAN_10 = [: ][012]?[0-9]:[0-5][0-9] sourcetype = breakable_text [delayedrule::syslog] sourcetype = syslog # IF MORE THAN 80% OF LINES MATCH REGEX, MUST BE THIS TYPE MORE_THAN_80 = ^\w{3} +\d+ \d\d:\d\d:\d\d (?!AM|PM)[\w\-.]+ [\w\-/.]+(\[\d+\])?: ########## FILE MATCH CONDITIONS ########## [source::.../var/log/anaconda.syslog(.\d+)?] sourcetype = anaconda_syslog [source::.../var/log/anaconda.log(.\d+)?] sourcetype = anaconda [source::.../var/log/httpd/error_log(.\d+)?] sourcetype = apache_error [source::.../var/log/cups/access_log(.\d+)?] sourcetype = cups_access [source::.../var/log/cups/error_log(.\d+)?] sourcetype = cups_error [source::.../var/log/dmesg(.\d+)?] sourcetype = dmesg [source::.../var/log/ftp.log(.\d+)?] sourcetype = ftp [source::.../(u_|)ex(tend|\d{4,8})*?.log] sourcetype = iis [source::.../var/log/lastlog(.\d+)?] sourcetype = lastlog [source::.../var/log/audit/audit.log(.\d+)?] sourcetype = linux_audit [source::.../var/log/boot.log(.\d+)?] sourcetype = linux_bootlog [source::.../var/log/secure(.\d+)?] sourcetype = linux_secure [source::.../man/man\d+/*.\d+] sourcetype = manpage [source::.../var/log/asl.log(.\d+)?] sourcetype = osx_asl [source::.../var/log/crashreporter.log(.\d+)?] sourcetype = osx_crashreporter [source::....crash.log(.\d+)?] sourcetype = osx_crash_log [source::.../var/log/install.log(.\d+)?] sourcetype = osx_install [source::.../var/log/secure.log(.\d+)?] sourcetype = osx_secure [source::.../var/log/daily.out(.\d+)?] sourcetype = osx_daily [source::.../var/log/weekly.out(.\d+)?] sourcetype = osx_weekly [source::.../var/log/monthly.out(.\d+)?] sourcetype = osx_monthly [source::.../private/var/log/windowserver.log(.\d+)?] sourcetype = osx_window_server [source::....Z(.\d+)?] unarchive_cmd = gzip -cd - sourcetype = preprocess-Z NO_BINARY_CHECK = true [source::....(tbz|tbz2)(.\d+)?] unarchive_cmd = _auto sourcetype = preprocess-bzip NO_BINARY_CHECK = true [source::....bz2?(.\d+)?] unarchive_cmd = bzip2 -cd - sourcetype = preprocess-bzip NO_BINARY_CHECK = true [source::....(?<!tar.)gz(.\d+)?] unarchive_cmd = gzip -cd - sourcetype = preprocess-gzip NO_BINARY_CHECK = true [source::....(tar.gz|tgz)(.\d+)?] unarchive_cmd = _auto sourcetype = preprocess-targz NO_BINARY_CHECK = true [source::....tar(.\d+)?] unarchive_cmd = _auto sourcetype = preprocess-tar NO_BINARY_CHECK = true [(?i)source::....zip(.\d+)?] unarchive_cmd = _auto sourcetype = preprocess-zip NO_BINARY_CHECK = true [source::....zstd?(.\d+)?] unarchive_cmd = zstd --stdout -d sourcetype = preprocess-zstd NO_BINARY_CHECK = true [source::.../var/log/rpmpkgs(.\d+)?] sourcetype = rpmpkgs [source::.../var/log/sa/sar\d+] sourcetype = sar [source::.../var/log/spooler(.\d+)?] sourcetype = spooler [source::.../var/log/httpd/httpd/ssl_error_log(.\d+)?] sourcetype = ssl_error [source::.../messages(.\d+)?] sourcetype = syslog [source::.../syslog(.\d+)?] sourcetype = syslog #[source::.../(www|apache|httpd).../access*] #sourcetype = access_common [source::.../(apache|httpd).../error*] sourcetype = apache_error [source::.../private/var/log/system.log(.\d+)?] sourcetype = syslog [source::.../private/var/log/mail.log(.\d+)?] sourcetype = syslog [source::.../var/log/wtmp(.\d+)?] sourcetype = wtmp [source::.../procmail(_|.)log] sourcetype = procmail [source::.../mysql.log(.\d+)?] sourcetype = mysqld [source::...stash] sourcetype = stash [source::...stash_new] sourcetype = stash_new ####### NON-LOG FILES [source::....(jar)(.\d+)?] sourcetype = source_archive [source::....(css|htm|html|sgml|shtml|template)] sourcetype = web [source::....csv] sourcetype = csv [source::...((.(bak|old))|,v|~|#)] sourcetype = ignored_type [source::.../(readme|README)...] sourcetype=misc_text [source::....(0t|a|ali|asa|au|bmp|cg|cgi|class|d|dat|deb|del|dot|dvi|dylib|elc|eps|exe|ftn|gif|hlp|hqx|hs|icns|ico|inc|iso|jame|jin|jpeg|jpg|kml|la|lhs|lib|lo|lock|mcp|mid|mp3|mpg|msf|nib|o|obj|odt|ogg|ook|opt|os|pal|pbm|pdf|pem|pgm|plo|png|po|pod|pp|ppd|ppm|ppt|prc|ps|psd|psym|pyc|pyd|p3d|rast|rb|rde|rdf|rdr|rgb|ro|rpm|rsrc|so|ss|stg|strings|tdt|tif|tiff|tk|uue|vhd|xbm|xlb|xls|xlw)] sourcetype = known_binary [source::....(cache|class|cxx|dylib|jar|lo|xslt|md5|rpm|deb|iso|vim)] sourcetype = ignored_type # internal sourcetype used in the fish bucket [fileTrackerCrcLog] SEGMENTATION = meta-tokenizer KV_MODE = none EXTRACT-1 = (?<_KEY_1>\S+)::(?<_VAL_1>\S+) # MySQL example. # See the Splunker's Guide for Splunk.com # for the myunbinit script and sample MySQL setup # This example is commented out. # # [mysql] # match_filename1 = *.bin # invalid_cause = needs_preprocess # is_valid = False # # Dealing with all windows type data, even when we're a unix # platform, incase these types of data is forwarded by a windows # light weight forwarder [ActiveDirectory] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-admon-end-of-event---\r\n[\r\n]*) EXTRACT-GUID = (?i)(?!=\w)(?:objectguid|guid)\s*=\s*(?<guid_lookup>[\w\-]+) EXTRACT-SID = objectSid\s*=\s*(?<sid_lookup>\S+) REPORT-MESSAGE = ad-kv # some schema AD events may be very long MAX_EVENTS = 10000 TRUNCATE = 100000 [WinRegistry] DATETIME_CONFIG=NONE LINE_BREAKER = ([\r\n]+---splunk-regmon-end-of-event---\r\n[\r\n]*) [WinWinHostMon] DATETIME_CONFIG=NONE SHOULD_LINEMERGE = false [WinPrintMon] DATETIME_CONFIG=NONE SHOULD_LINEMERGE = false [wmi] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-wmi-end-of-event---\r\n[\r\n]*) CHARSET = UTF-8 [source::WMI...] REPORT-MESSAGE = wel-message, wel-eq-kv, wel-col-kv TRANSFORMS-FIELDS = wmi-host, wmi-override-host SHOULD_LINEMERGE = false [source::WinEventLog...] REPORT-MESSAGE = wel-message, wel-eq-kv, wel-col-kv KV_MODE=none # Note the below settings are effectively legacy, in place here to handle # data coming from much much older forwarders (3.x & 4.x) SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD=30 LINE_BREAKER = ([\r\n](?=\d{2}/\d{2}/\d{2,4} \d{2}:\d{2}:\d{2} [aApPmM]{2})) TRANSFORMS-FIELDS = strip-winevt-linebreaker [PerformanceMonitor] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-perfmon-end-of-event---\r\n[\r\n]*) REPORT-MESSAGE = perfmon-kv [source::....(?i)(evt|evtx)(.\d+)?] sourcetype = preprocess-winevt NO_BINARY_CHECK = true SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD=30 LINE_BREAKER = ([\r\n](?=\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} [aApPmM]{2})) REPORT-MESSAGE = wel-message, wel-eq-kv, wel-col-kv [preprocess-winevt] invalid_cause = winevt is_valid = False LEARN_MODEL = false [source::PerfmonMk...] EXTRACT-collection,category,object = collection=\"?(?P<collection>[^\"\n]+)\"?\ncategory=\"?(?P<category>[^\"\n]+)\"?\nobject=\"?(?P<object>[^\"\n]+)\"?\n KV_MODE = multi_PerfmonMk NO_BINARY_CHECK = 1 pulldown_type = 1 [WinNetMonMk] KV_MODE = multi_WinNetMonMk NO_BINARY_CHECK = 1 pulldown_type = 0 [source::.../disk_objects.log(.\d+)?] sourcetype = splunk_disk_objects [source::.../resource_usage.log(.\d+)?] sourcetype = splunk_resource_usage [source::.../kvstore.log(.\d+)?] sourcetype = kvstore [source::.../token_input_metrics.log(.\d+)?] sourcetype = token_endpoint_metrics [source::.../http_event_collector_metrics.log(.\d+)?] sourcetype = http_event_collector_metrics [splunk_disk_objects] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [splunk_resource_usage] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [kvstore] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none TRUNCATE = 1000000 JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [token_input_metrics] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [collectd_http] METRICS_PROTOCOL = collectd_http NO_BINARY_CHECK = true SHOULD_LINEMERGE = false ADD_EXTRA_TIME_FIELDS = false ANNOTATE_PUNCT = false pulldown_type = true TIMESTAMP_FIELDS = time KV_MODE=none category = Metrics description = Collectd daemon format. Uses the write_http plugin to send metrics data to a Splunk platform data input via the HTTP Event Collector. [http_event_collector_metrics] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [statsd] METRICS_PROTOCOL = statsd NO_BINARY_CHECK = true SHOULD_LINEMERGE = false DATETIME_CONFIG = CURRENT # remove indextime fields that aren't super useful. ADD_EXTRA_TIME_FIELDS = false ANNOTATE_PUNCT = false pulldown_type = true category = Metrics description = Statsd daemon output format. Accepts the plain StatsD line metric protocol or the StatsD line metric protocol with dimensions extension. [metrics_csv] SHOULD_LINEMERGE = False pulldown_type = true INDEXED_EXTRACTIONS = csv ADD_EXTRA_TIME_FIELDS = subseconds KV_MODE = none TIMESTAMP_FIELDS = metric_timestamp TIME_FORMAT = %s.%Q category = Metrics description = Comma-separated value format for metrics. Must have metric_timestamp, metric_name, and _value fields. [search_telemetry] SHOULD_LINEMERGE = false INDEXED_EXTRACTIONS = json TRUNCATE = 1000000 KV_MODE = none description = JSON-formatted file containing search related telemetry. [splunk_cloud_telemetry] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l %z INDEXED_EXTRACTIONS = json KV_MODE = none JSON_TRIM_BRACES_IN_ARRAY_NAMES = true [splunkd_latency_tracker] SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = datetime TIME_FORMAT = %s.%l INDEXED_EXTRACTIONS = json KV_MODE = none
