You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
1.7 KiB
60 lines
1.7 KiB
# Version 9.2.2.20240415
|
|
# DO NOT EDIT THIS FILE!
|
|
# Changes to default files will be lost on update and are difficult to
|
|
# manage and support.
|
|
#
|
|
# Please make any changes to system defaults by overriding them in
|
|
# apps or $SPLUNK_HOME/etc/system/local
|
|
# (See "Configuration file precedence" in the web documentation).
|
|
#
|
|
# To override a specific setting, copy the name of the stanza and
|
|
# setting to the file where you wish to override it.
|
|
#
|
|
# This file contains configuration for segmentation of events.
|
|
|
|
|
|
MAJOR = [ ] < > ( ) { } | ! ; , ' " * \n \r \s \t & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29
|
|
#The %xx are for url-encoded characters that should be broken on
|
|
MINOR = / : = @ . - $ # % \\ _
|
|
|
|
[full]
|
|
|
|
[indexing]
|
|
# change INTERMEDIATE_MAJORS to "true" if you want an ip address to appear in typeahead as a, a.b, a.b.c, a.b.c.d
|
|
# the typical effect on performance by setting to "true" is 30%
|
|
INTERMEDIATE_MAJORS = false
|
|
|
|
[search]
|
|
MAJOR = [ ] < > ( ) { } | ! ; , ' " \n \r \s \t & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29 / : = @ . - $ # % \\ _
|
|
MINOR =
|
|
|
|
[standard]
|
|
MAJOR = [ ] < > ( ) { } | ! ; , ' " * \n \r \s \t / : = @ . ? - & $ # + % _ \\ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
|
|
MINOR =
|
|
|
|
[inner]
|
|
MAJOR = [ ] < > ( ) { } | ! ; , ' " * \n \r \s \t / : = @ . ? - & $ # + % _ \\ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
|
|
MINOR =
|
|
|
|
[outer]
|
|
MAJOR = [ ] < > ( ) { } | ! ; , ' " * \n \r \s \t & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
|
|
MINOR =
|
|
|
|
[none]
|
|
MAJOR =
|
|
MINOR =
|
|
MAJOR_COUNT = 0
|
|
LOOKAHEAD = 0
|
|
MINOR_COUNT = 0
|
|
|
|
|
|
[whitespace-only]
|
|
MAJOR = \n \r \s \t %20
|
|
MINOR =
|
|
|
|
|
|
#Don't delete or change this tokenizer it is needed to tokenize meta information internal
|
|
[meta-tokenizer]
|
|
MAJOR = \s
|
|
MINOR =
|