Matt, I'd begin by alerting on any of the following terms (taken from the Troubleshooting section of the Install Guide) and then filtering the noise from the relevant.
Terms: 'exception|unable|fail|invalid|leak|invalid|warn' Regards, Matty Courtney CloudPlatform Implementation Engineer, Worldwide Cloud Services T +61 409 312 329 [email protected] Powering mobile work styles and cloud services On 18/10/12 9:03 PM, "Mathias Mullins" <[email protected]> wrote: >Caleb, > >You're spot on. Trying to figure out the alerts and how to set them up. > >Thanks, >Matt Mullins >CloudPlatform Implementation Engineer >Worldwide Cloud Services Citrix System, Inc. >+1 (407) 920-1107 Office/Cell Phone >[email protected] > > > > >On 10/18/12 11:30 AM, "Caleb Call" <[email protected]> wrote: > >>What exactly do you mean log parsing? We have our logs going in to >>splunk, which wasn't any different than adding any other log in to >>splunk. Do you mean setting up alerts around the logs? >> >> >>On Oct 17, 2012, at 11:39 AM, Mathias Mullins >><[email protected]> wrote: >> >>> We are trying to setup Splunk to do log parsing for a cluster of 4 >>>management servers. Does someone have some experience on this or some >>>script settings that have been effective with them? >>> >>> Thanks, >>> Matt >> >
