AppD Archive

data collectors

CommunityUser
Splunk Employee
Splunk Employee

i am having trouble collecting data.

not getting exactly what parameters should i write in case the method is overloaded.

its in .net.

any help is appreciated.

working example would be great.

Tags (1)
0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Do you want to capture only parameters of a specific overloaded method or of all the methods of a class sharing the same name ?

What's your current data collector definition ? Could you please join a screenshot of the rule ?

Just to be sure to understand what you are trying to do.

++

Edouard.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

i just want to capture the parameters of a specific overloaded method.

i tried it for non-overloaded method too but failure again.

i am attaching the screenshot of configuration that i have made.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

So you want to retrieve the result of the method toString() of the LogOnModel instance which is passed as first parameter right ?

Did you get something as result (even unexpected value) when testing or is there no data gathered at all ?

By the way, you've specified the full classname of the second and the third parameters as System.string; as far as I remember c# classnames are case sensitive, so let's change it to System.String (I'm not sure it explains your problem but give it a try).

Also, be sure to keep the actual parameters order of the method you want to instrument.

You can also check your bytecodeTransformer logs on the java agent to make sure that the method is properlly instrumented.

Grep on classname/method, you should find something like :

Applying method interceptor data.POJOGatherer at <classname>.<method_name>

Then check if the instrumented class has been properly verified. (if not, the agent will rollback the bytecode injection)

Look for something like "<classname> has been successfully verified"

++

Edouard

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

yes, i want to collect the data on first parameter which is LogOnModel instance.

and nothing at all is gathered.

i will check for the case sensitivity but the order is correct.

also let i will check for log files.

i will revert you soon.

also whenever i make any changes in the data collector configuration, popup comes and says 'need to restart CLR to take effect'...how can we do that?

thank you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...