You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
69 lines
2.1 KiB
69 lines
2.1 KiB
[<spec>]
|
|
priority = <number>
|
|
|
|
@placement search-head, indexer
|
|
CHARSET = <string>
|
|
TRUNCATE = <non-negative integer>
|
|
LINE_BREAKER = <regular expression>
|
|
LINE_BREAKER_LOOKBEHIND = <integer>
|
|
SHOULD_LINEMERGE = [true|false]
|
|
BREAK_ONLY_BEFORE_DATE = [true|false]
|
|
BREAK_ONLY_BEFORE = <regular expression>
|
|
MUST_BREAK_AFTER = <regular expression>
|
|
MUST_NOT_BREAK_AFTER = <regular expression>
|
|
MUST_NOT_BREAK_BEFORE = <regular expression>
|
|
MAX_EVENTS = <integer>
|
|
INDEXED_EXTRACTIONS = < CSV|W3C|TSV|PSV|JSON >
|
|
METRIC-SCHEMA-TRANSFORMS = <metric-schema:stanza_name>[,<metric-schema:stanza_name>]...
|
|
|
|
@placement search-head, indexer
|
|
DATETIME_CONFIG = <filename relative to $SPLUNK_HOME>
|
|
TIME_PREFIX = <regular expression>
|
|
MAX_TIMESTAMP_LOOKAHEAD = <integer>
|
|
TIME_FORMAT = <strptime-style format>
|
|
DETERMINE_TIMESTAMP_DATE_WITH_SYSTEM_TIME = <boolean>
|
|
TZ = <timezone identifier>
|
|
TZ_ALIAS = <key=value>[,<key=value>]...
|
|
MAX_DAYS_AGO = <integer>
|
|
MAX_DAYS_HENCE = <integer>
|
|
MAX_DIFF_SECS_AGO = <integer>
|
|
MAX_DIFF_SECS_HENCE = <integer>
|
|
ADD_EXTRA_TIME_FIELDS = [none | subseconds | all | <boolean>]
|
|
|
|
@placement search-head, indexer
|
|
TRANSFORMS-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
|
|
|
|
@placement search-head
|
|
REPORT-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
|
|
EXTRACT-<class> = [<regex>|<regex> in <src_field>]
|
|
KV_MODE = [none|auto|auto_escaped|multi|json|xml]
|
|
MATCH_LIMIT = <integer>
|
|
DEPTH_LIMIT = <integer>
|
|
AUTO_KV_JSON = [true|false]
|
|
KV_TRIM_SPACES = true|false
|
|
CHECK_FOR_HEADER = [true|false]
|
|
|
|
@placement search-head, indexer
|
|
SEDCMD-<class> = <sed script>
|
|
|
|
@placement search-head
|
|
FIELDALIAS-<class> = (<orig_field_name> AS <new_field_name>)+
|
|
EVAL-<fieldname> = <eval statement>
|
|
LOOKUP-<class> = $TRANSFORM (<match_field> (AS <match_field_in_event>)?)+ (OUTPUT|OUTPUTNEW (<output_field> (AS <output_field_in_event>)? )+ )?
|
|
|
|
@placement search-head, indexer
|
|
SEGMENTATION = <segmenter>
|
|
|
|
@placement search-head
|
|
SEGMENTATION-<segment selection> = <segmenter>
|
|
|
|
@placement search-head
|
|
rename = <string>
|
|
|
|
@placement search-head, indexer
|
|
ANNOTATE_PUNCT = [true|false]
|
|
|
|
@placement search-head
|
|
description = <string>
|
|
category = <string>
|