Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
03-28-2024
08:02 AM
@Yoavast Up, I'm facing a similar issue. Do you have any specific instructional documentation available?
03-28-2024
07:55 AM
Is there currently a capability in Splunk that will allow us search and compare the previous version of an input lookup to the current version of the input lookup to identify what has changed between...
See more...
Is there currently a capability in Splunk that will allow us search and compare the previous version of an input lookup to the current version of the input lookup to identify what has changed between the two? In search is there a parameter we can pass the input lookup command to specify the version what we want to evaluate?
- Tags:
- lookup
Labels
- Labels:
-
administration
03-28-2024
07:27 AM
1 Karma
Hi Bowesmana, I want to say I really appreciated the level of detail you have provided and it will prove useful for future people who lands here from google searches. So I actually found the probl...
See more...
Hi Bowesmana, I want to say I really appreciated the level of detail you have provided and it will prove useful for future people who lands here from google searches. So I actually found the problem: I use the Splunk Cloud product so we use a series of API calls to populate objects in the cloud, since we do not have access to the directories on their EC2 instances. I found the Splunk App for Lookup File Editing API that our CI/CD process uses may have not supported kvStore acceleration options. On github, I had the following collections.conf in our master branch – so I incorrectly assumed this was production: [qualys_kb_kvstore]
accelerated_fields.QID_accel = {"QID": 1, "PATCHABLE": 1}
replicate = true I tested the Splunk KVstore API against Splunk cloud, and discovered the two lines accelerated_fields and replicate was not there. It was not getting applied. Our CI/CD process was NOT getting the acceleration options applied. I used the Splunk KVstore API instead to get acceleration options to apply, and it worked. The lookup is now accelerated as expected. The lookup time was cut from 165 seconds to just 20 seconds.
03-28-2024
07:22 AM
| rex max_match=0 "\\\\\\\"jobname\\\\\\\":\s*\\\\\\\"(?<Name>[^\\\]+).*?\\\\\\\"status\\\\\\\":\s*\\\\\\\"(?<State>ENDED NOTOK).*?Timestamp\\\\\\\": \\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+)"
03-28-2024
07:12 AM
Hello ITWhisperer, Thank you for your response. I have extracted all the mentioned fields earlier as well. But is there any possibility in extraction, so that we can only extract the status of ENDED...
See more...
Hello ITWhisperer, Thank you for your response. I have extracted all the mentioned fields earlier as well. But is there any possibility in extraction, so that we can only extract the status of ENDED NOTOK jobs only.
03-28-2024
06:58 AM
Hi! I tried adding this line to my inputs.conf -> no_appending_timestamp = true but I am still seeing logs come in to splunk with the UTC time even though the log itself shows a central timest...
See more...
Hi! I tried adding this line to my inputs.conf -> no_appending_timestamp = true but I am still seeing logs come in to splunk with the UTC time even though the log itself shows a central timestamp.
03-28-2024
06:55 AM
I have an odd task I'm trying to fulfill and I'm not entirely sure how to go about it. We have a print server that forwards logs to Splunk. We also have multiple printers that are on a separate VLA...
See more...
I have an odd task I'm trying to fulfill and I'm not entirely sure how to go about it. We have a print server that forwards logs to Splunk. We also have multiple printers that are on a separate VLAN that only the print server can see. The objective is to see if we can pull the logs directly from the printer and forward them to Splunk. From what I've been reading, this should be possible by setting up the print server as a sort of intermediate forwarder? I believe the process is to have the printers redirect their logs to the print server to a specific folder, then add that folder to the list of logs being reported in the Splunk forwarder. Does that sound correct? Has anyone done this before? Any instructions that could make this easier? I'm fairly new to Splunk and I'm still learning how to set things up so as many details as possible would be helpful. Thanks.
Labels
- Labels:
-
intermediate forwarder
03-28-2024
06:35 AM
@bhawkins1 Old post; you probably have an answer. I was looking for one and came up with this. ```Set blank_calc for same and not fields for future eval commands.```
| foreach *_same, *_not
[|...
See more...
@bhawkins1 Old post; you probably have an answer. I was looking for one and came up with this. ```Set blank_calc for same and not fields for future eval commands.```
| foreach *_same, *_not
[| fillnull value="blank_calc" <<FIELD>>] Worked for me. God bless, Genesius
03-28-2024
06:33 AM
1 Karma
Please don't duplicate posts - it just clutters the site - please follow the answer here https://community.splunk.com/t5/Splunk-Search/Facing-issue-while-extracting-required-fields-and-while-using/m-...
See more...
Please don't duplicate posts - it just clutters the site - please follow the answer here https://community.splunk.com/t5/Splunk-Search/Facing-issue-while-extracting-required-fields-and-while-using/m-p/682268#M233094
03-28-2024
06:27 AM
It looks like you have too many backslashes (and execution_time_in_seconds does not appear in your sample) | rex max_match=0 "\\\\\\\"jobname\\\\\\\":\s*\\\\\\\"(?<Name>[^\\\]+)"
| rex max_match=0 "...
See more...
It looks like you have too many backslashes (and execution_time_in_seconds does not appear in your sample) | rex max_match=0 "\\\\\\\"jobname\\\\\\\":\s*\\\\\\\"(?<Name>[^\\\]+)"
| rex max_match=0 "\\\\\\\"status\\\\\\\":\s*\\\\\\\"(?<State>[^\\\]+)"
| rex max_match=0 "Timestamp\\\\\\\": \\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+)"
| rex max_match=0 "execution_time_in_seconds\\\\\\\": \\\\\\\"(?<EXECUTION_TIME>[\d\.\-]+)"
03-28-2024
06:21 AM
Unfortunately, I never found a solution. If you happen to find the fix, please reply with it.
03-28-2024
06:09 AM
Hi Team, we facing issue in our environment, as Episodes are not generating after upgrading of ITSI 4.17.1 version. And everything is enabled (Services, Correlation searches, NEAP policies) and...
See more...
Hi Team, we facing issue in our environment, as Episodes are not generating after upgrading of ITSI 4.17.1 version. And everything is enabled (Services, Correlation searches, NEAP policies) and even though it is not creating. ITSI_event_grouping is enabled and Rules engine is working fine. Please provide solution for this.
Labels
- Labels:
-
using ITSI
03-28-2024
06:05 AM
Hi @riley_lewis, the avg function must be used in a streaming command as stats or timechart: index="mydata"
| stats avg(floatnumbers) AS floatnumbers BY mymean Ciao. Giuseppe
03-28-2024
05:43 AM
When I do this search:
index="mydata" | eval mymean=avg(floatnumbers) | table floatnumbers,mymean
mymean just mimics whatever is in floatnumbers. How do I calculate the mean? I have tried the fie...
See more...
When I do this search:
index="mydata" | eval mymean=avg(floatnumbers) | table floatnumbers,mymean
mymean just mimics whatever is in floatnumbers. How do I calculate the mean? I have tried the fieldsummary command, but when I did that, it would not port to chart correctly.
Labels
- Labels:
-
eval
03-28-2024
05:18 AM
Finally, this worked for me. Thanks for advice.
| mvexpand Json
| spath "Action{}" input=Json output="Action"
| spath "Effect" input=Json output="Effect"
| mvexpand Action
| table Action Effect
03-28-2024
05:04 AM
The problem appears to stem from missing newlines before the timestamps. Try these props.conf settings: [sourcetype::_json]
SHOULD_LINEMERGE = false
LINE_BREAKER = app_context=port_data"([\r\n]*)\d...
See more...
The problem appears to stem from missing newlines before the timestamps. Try these props.conf settings: [sourcetype::_json]
SHOULD_LINEMERGE = false
LINE_BREAKER = app_context=port_data"([\r\n]*)\d{2}\/\d{2}\/\d{4}
03-28-2024
04:45 AM
Hello team,
I am facing an issue with multiple events getting merged as a single event in tier 3. I do not have this issue with tier 1 or when I manually run the saved search. However when the save...
See more...
Hello team,
I am facing an issue with multiple events getting merged as a single event in tier 3. I do not have this issue with tier 1 or when I manually run the saved search. However when the saved search runs at a scheduled time these multiple events gets merged as 1 single event. I even tried adding the below values in props.conf of Data App but did not help
[sourcetype::_json]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\s\+\d{4}
Below is how the event in tier 3 is like: 03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="1.1.1.1 : ip-sample_ip.ec2.internal",metric_label="Port_Connectivity : Reporting no data",instance="Port : 45",metric_value="0",metric_unit="latest",alert_value="100",tower="Port reporting no data",threshold1="-2",threshold2="-1",threshold3="0.5",threshold4="0.5",blacklist_alerts="1",add_info="Time=1711622100.000000;!@#;state=offline;!@#;message=NA;!@#;protocol=NA;!@#;responsetext=NA;!@#;responsetime=1711622100.000000;!@#;returncode=NA;!@#;roundtriptime=NULL;!@#;service_name=NA;!@#;app_context=port_data"03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="1.1.1.1 : ip-sample_ip.ec2.internal",metric_label="Port_Monitoring : Port_Status",instance="Port : 45",metric_value="201",metric_unit="Status",alert_value="100",tower="Infra",threshold1="0",threshold2="0",threshold3="300",threshold4="500",blacklist_alerts="1",add_info="Time=2024-03-28T10:33:48Z;!@#;state=reachable;!@#;message=reachable;!@#;protocol=UDP;!@#;responsetext=/bin/sh: line 1: nc: command not found;!@#;responsetime=na;!@#;returncode=0;!@#;roundtriptime=NULL;!@#;service_name=IMP;!@#;app_context=port_data"03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="127.0.0.1 : ip-sample_ip.ec2.internal",metric_label="Port_Connectivity : Reporting no data",instance="Port : 3389",metric_value="0",metric_unit="latest",alert_value="100",tower="Port reporting no data",threshold1="-2",threshold2="-1",threshold3="0.5",threshold4="0.5",blacklist_alerts="1",add_info="Time=1711622100.000000;!@#;state=offline;!@#;message=NA;!@#;protocol=NA;!@#;responsetext=NA;!@#;responsetime=1711622100.000000;!@#;returncode=NA;!@#;roundtriptime=NULL;!@#;service_name=NA;!@#;app_context=port_data" Every event will end at "app_context=port_data"" to be exact. Please let me know how to resolve this.
Labels
- Labels:
-
fields
-
search job inspector
-
subsearch
03-28-2024
04:29 AM
Hi Team, The below is the event which we have received into the splunk, Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\...
See more...
Hi Team, The below is the event which we have received into the splunk, Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240317 13:25:23\"","5":" }","6":" \"1\": {","7":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\"","8":" \"status\": \"ENDED NOTOK\"","9":" \"Timestamp\": \"20240317 13:25:23\"","10":" }","11":" \"2\": {","12":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\"","13":" \"status\": \"ENDED NOTOK\"","14":" \"Timestamp\": \"20240317 13:25:23\"","15":" }","16":" \"3\": {","17":" \"jobname\": \"D001_GVE_SOFT_MATCHING_GDH_CA\"","18":" \"status\": \"ENDED NOTOK\"","19":" \"Timestamp\": \"20240317 13:25:23\"","20":" }","21":" \"4\": {","22":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TRX_ORG\"","23":" \"status\": \"ENDED NOTOK\"","24":" \"Timestamp\": \"20240317 13:25:23\"","25":" }","26":" \"5\": {","27":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_123\"","28":" \"status\": \"ENDED NOTOK\"","29":" \"Timestamp\": \"20240317 13:25:23\"","30":" }","31":" \"6\": {","32":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_45\"","33":" \"status\": \"ENDED OK\"","34":" \"Timestamp\": \"20240317 13:25:23\"","35":" }","36":" \"7\": {","37":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_ENPW\"","38":" \"status\": \"ENDED NOTOK\"","39":" \"Timestamp\": \"20240317 13:25:23\"","40":" }","41":" \"8\": {","42":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_T\"","43":" \"status\": \"ENDED NOTOK\"","44":" \"Timestamp\": \"20240317 13:25:23\"","45":" }","46":" \"9\": {","47":" \"jobname\": \"DREAMPC_CALC_ML_NAMESAPCE\"","48":" \"status\": \"ENDED NOTOK\"","49":" \"Timestamp\": \"20240317 13:25:23\"","50":" }","51":" \"10\": {","52":" \"jobname\": \"DREAMPC_MEMORY_AlERT_SIT\"","53":" \"status\": \"ENDED NOTOK\"","54":" \"Timestamp\": \"20240317 13:25:23\"","55":" }","56":" \"11\": {","57":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\"","58":" \"status\": \"ENDED NOTOK\"","59":" \"Timestamp\": \"20240317 13:25:23\"","60":" }","61":" \"12\": {","62":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","63":" \"status\": \"ENDED NOTOK\"","64":" \"Timestamp\": \"20240317 13:25:23\"","65":" }","66":" \"13\": {","67":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\"","68":" \"status\": \"ENDED OK\"","69":" \"Timestamp\": \"20240317 13:25:23\"","70":" }","71":" \"14\": {","72":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","73":" \"status\": \"ENDED OK\"","74":" \"Timestamp\": \"20240317 13:25:23\"","75":" }","76":" \"15\": {","77":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\"","78":" \"status\": \"ENDED OK\"","79":" \"Timestamp\": \"20240317 13:25:23\"","80":" }","81":" \"16\": {","82":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","83":" \"status\": \"ENDED OK\"","84":" \"Timestamp\": \"20240317 13:25:23\"","85":" }","86":" \"17\": {","87":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\"","88":" \"status\": \"ENDED OK\"","89":" \"Timestamp\": \"20240317 13:25:23\"","90":" }","91":" \"18\": {","92":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\"","93":" \"status\": \"ENDED OK\"","94":" \"Timestamp\": \"20240317 13:25:23\"","95":" }","96":" \"19\": {","97":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\"","98":" \"status\": \"ENDED NOTOK\"","99":" \"Timestamp\": \"20240317 13:25:23\"","100":" }","101":" \"20\": {","102":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\"","103":" \"status\": \"ENDED NOTOK\"","104":" \"Timestamp\": \"20240317 13:25:23\"","105":" }","106":" \"21\": {","107":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\"","108":" \"status\": \"ENDED OK\"","109":" \"Timestamp\": \"20240317 13:25:23\"","110":" }","111":" \"22\": {","112":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\"","113":" \"status\": \"ENDED OK\"","114":" \"Timestamp\": \"20240317 13:25:23\"","115":" }","116":" \"23\": {","117":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\"","118":" \"status\": \"ENDED NOTOK\"","119":" \"Timestamp\": \"20240317 13:25:23\"","120":" }","121":" \"24\": {","122":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\"","123":" \"status\": \"ENDED OK\"","124":" \"Timestamp\": \"20240317 13:25:23\"","125":" }","126":" \"25\": {","127":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\"","128":" \"status\": \"ENDED NOTOK\"","129":" \"Timestamp\": \"20240317 13:25:23\"","130":" }","131":" \"26\": {","132":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\"","133":" \"status\": \"ENDED NOTOK\"","134":" \"Timestamp\": \"20240317 13:25:23\"","135":" }" we have tried to extract the required fields such as Timestamp, Jobname, Status from the above events using the below splunk query index=app_events_dwh2_de_int _raw=*jobname* | rex max_match=0 "\\\\\\\\\\\\\"jobname\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<Name>[^\\\]+)" | rex max_match=0 "\\\\\\\\\\\\\"status\\\\\\\\\\\\\":\s*\\\\\\\\\\\\\"(?<State>[^\\\]+)" | rex max_match=0 "Timestamp\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<TIME>\d+\s*\d+\:\d+\:\d+)" | rex max_match=0 "execution_time_in_seconds\\\\\\\\\\\\\": \\\\\\\\\\\\\"(?<EXECUTION_TIME>[\d\.\-]+)"
| table "TIME", "Name", "State", "EXECUTION_TIME" | mvexpand TIME
But the issue we want to extract only those status jobs with status as " ENDED NOTOK". But we are unable to extract them. Also when we use mvexpand command for the table, it is showing multiple duplicate values. We request you to kindly look into this and help us on this issue.
Labels
- Labels:
-
rex
03-28-2024
04:28 AM
Such a small and straightforward environment I used GUI. I get the sense there is a bug in 9.2.0.x
I have been using this script to update many of our lookups/datasets but it's no longer working, giving the following error when downloading the file: "status 403, reason: Forbidden" It was working...
See more...
I have been using this script to update many of our lookups/datasets but it's no longer working, giving the following error when downloading the file: "status 403, reason: Forbidden" It was working last week but it suddenly stop. The user I'm using is the owner of these lookups/datasets and no permissions were changed. The Splunk instance is currently having a issue with a expired certificate, could it be because of that? Or something else?
Labels
- Labels:
-
scheduled search
