Comments on: OSSEC and Splunk http://www.anthonyreinke.com/2009/07/27/ossec-and-splunk/ Rambling Thoughts of a Random Mind Wed, 01 Feb 2012 22:01:31 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Michael Wilde http://www.anthonyreinke.com/2009/07/27/ossec-and-splunk/#comment-2 Michael Wilde Wed, 29 Jul 2009 19:24:43 +0000 http://www.anthonyreinke.com/?p=66#comment-2 Anthony. Next to each event, right below the timestamp is an "Extract Fields" link. Its a nice little wizard that helps you pick out things you'd like to be fields and it writes the REGEX for you. You give it samples, it builds the field extraction. Check it out. I'm a regex ninja and i don't need most of my skills anymore. Michael Wilde Splunk Ninja twitter: @michaelwilde Anthony. Next to each event, right below the timestamp is an “Extract Fields” link. Its a nice little wizard that helps you pick out things you’d like to be fields and it writes the REGEX for you. You give it samples, it builds the field extraction.

Check it out. I’m a regex ninja and i don’t need most of my skills anymore.

Michael Wilde
Splunk Ninja
twitter: @michaelwilde

]]>