创建索引字段

package splunktest;

 

import java.io.BufferedWriter;

import java.io.OutputStream;

import java.io.OutputStreamWriter;

import java.net.Socket;

 

public class InputTest {

 

public static void main(String[] args) throws Throwable {

Socket socket = new Socket("localhost", 60001);

   // 向服务端程序发送数据

   OutputStream ops = socket.getOutputStream();    

   OutputStreamWriter opsw = new OutputStreamWriter(ops);

   BufferedWriter bw = new BufferedWriter(opsw);

     

   bw.write("2008-10-30 14:15:21 mightyhost awesomeftpd INFO Attempt to login by user: root: login FAILED.\r\n\r\n");

   bw.flush();

   

   ops.close();

   opsw.close();

   bw.close();

   socket.close();

}

 

}

 

 

 

放在system/default下

 

[tcp://60001]

connection_host = dns

sourcetype = ftpd-log

index = main

 

 

 

Define two new indexed fields with one regex

This example creates two indexed fields called username and login_result.

transforms.conf

In transforms.conf add:

[ftpd-login]
REGEX = Attempt to login by user: (.*): login (.*)\.
FORMAT = username::"$1" login_result::"$2"
WRITE_META = true

This stanza finds the literal text Attempt to login by user:, extracts a username followed by a colon, and then the result, which is followed by a period. A line might look like:

2008-10-30 14:15:21 mightyhost awesomeftpd INFO Attempt to login by user: root: login FAILED.

props.conf

Add the following lines to props.conf:

[ftpd-log]
TRANSFORMS-login = ftpd-login

fields.conf

Add the following lines to fields.conf:

[username]
INDEXED=true

[login_result]
INDEXED=true

Restart Splunk for your configuration file changes to take effect.