Splunk_命令教学(3)

注:红色部分为连接之关键字

FORMAT = Application::$1

Inputs.conf 文件内容 [monitor://$SPLUNK_HOME/etc/log/Authsyslog] disabled = false host = AuthServer sourcetype = user_log Props.conf文件内容 [user_log] REPORT-Username_for_sourcetype_user_log_1 = Username_for_sourcetype_user_log_1

SYSTEX Group, SPLUNK Corp 2009