Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
03-28-2024
01:57 AM
Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240317 13:25:23\"","5":" }","6":" \"1\":...
See more...
Dataframe row : {"_c0":{"0":"{","1":" \"0\": {","2":" \"jobname\": \"A001_GVE_ADHOC_AUDIT\"","3":" \"status\": \"ENDED NOTOK\"","4":" \"Timestamp\": \"20240317 13:25:23\"","5":" }","6":" \"1\": {","7":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS\"","8":" \"status\": \"ENDED NOTOK\"","9":" \"Timestamp\": \"20240317 13:25:23\"","10":" }","11":" \"2\": {","12":" \"jobname\": \"BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TSYS_WEEKLY\"","13":" \"status\": \"ENDED NOTOK\"","14":" \"Timestamp\": \"20240317 13:25:23\"","15":" }","16":" \"3\": {","17":" \"jobname\": \"D001_GVE_SOFT_MATCHING_GDH_CA\"","18":" \"status\": \"ENDED NOTOK\"","19":" \"Timestamp\": \"20240317 13:25:23\"","20":" }","21":" \"4\": {","22":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TRX_ORG\"","23":" \"status\": \"ENDED NOTOK\"","24":" \"Timestamp\": \"20240317 13:25:23\"","25":" }","26":" \"5\": {","27":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_123\"","28":" \"status\": \"ENDED NOTOK\"","29":" \"Timestamp\": \"20240317 13:25:23\"","30":" }","31":" \"6\": {","32":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_45\"","33":" \"status\": \"ENDED OK\"","34":" \"Timestamp\": \"20240317 13:25:23\"","35":" }","36":" \"7\": {","37":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_ENPW\"","38":" \"status\": \"ENDED NOTOK\"","39":" \"Timestamp\": \"20240317 13:25:23\"","40":" }","41":" \"8\": {","42":" \"jobname\": \"D100_AKS_CDWH_SQOOP_TYP_T\"","43":" \"status\": \"ENDED NOTOK\"","44":" \"Timestamp\": \"20240317 13:25:23\"","45":" }","46":" \"9\": {","47":" \"jobname\": \"DREAMPC_CALC_ML_NAMESAPCE\"","48":" \"status\": \"ENDED NOTOK\"","49":" \"Timestamp\": \"20240317 13:25:23\"","50":" }","51":" \"10\": {","52":" \"jobname\": \"DREAMPC_MEMORY_AlERT_SIT\"","53":" \"status\": \"ENDED NOTOK\"","54":" \"Timestamp\": \"20240317 13:25:23\"","55":" }","56":" \"11\": {","57":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS\"","58":" \"status\": \"ENDED NOTOK\"","59":" \"Timestamp\": \"20240317 13:25:23\"","60":" }","61":" \"12\": {","62":" \"jobname\": \"DREAM_BDV_NBR_PRE_REQUISITE_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","63":" \"status\": \"ENDED NOTOK\"","64":" \"Timestamp\": \"20240317 13:25:23\"","65":" }","66":" \"13\": {","67":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS\"","68":" \"status\": \"ENDED OK\"","69":" \"Timestamp\": \"20240317 13:25:23\"","70":" }","71":" \"14\": {","72":" \"jobname\": \"DREAM_BDV_NBR_STG_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","73":" \"status\": \"ENDED OK\"","74":" \"Timestamp\": \"20240317 13:25:23\"","75":" }","76":" \"15\": {","77":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS\"","78":" \"status\": \"ENDED OK\"","79":" \"Timestamp\": \"20240317 13:25:23\"","80":" }","81":" \"16\": {","82":" \"jobname\": \"DREAM_BDV_NBR_TLX_LSP_3RD_PARTY_TRNS_WEEKLY\"","83":" \"status\": \"ENDED OK\"","84":" \"Timestamp\": \"20240317 13:25:23\"","85":" }","86":" \"17\": {","87":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH\"","88":" \"status\": \"ENDED OK\"","89":" \"Timestamp\": \"20240317 13:25:23\"","90":" }","91":" \"18\": {","92":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_GDH_WEEKLY\"","93":" \"status\": \"ENDED OK\"","94":" \"Timestamp\": \"20240317 13:25:23\"","95":" }","96":" \"19\": {","97":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_SAMCONTDEPOT\"","98":" \"status\": \"ENDED NOTOK\"","99":" \"Timestamp\": \"20240317 13:25:23\"","100":" }","101":" \"20\": {","102":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TLXLSP_TRXN\"","103":" \"status\": \"ENDED NOTOK\"","104":" \"Timestamp\": \"20240317 13:25:23\"","105":" }","106":" \"21\": {","107":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR\"","108":" \"status\": \"ENDED OK\"","109":" \"Timestamp\": \"20240317 13:25:23\"","110":" }","111":" \"22\": {","112":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADEABR_WEEKLY\"","113":" \"status\": \"ENDED OK\"","114":" \"Timestamp\": \"20240317 13:25:23\"","115":" }","116":" \"23\": {","117":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON\"","118":" \"status\": \"ENDED NOTOK\"","119":" \"Timestamp\": \"20240317 13:25:23\"","120":" }","121":" \"24\": {","122":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_TRADESON_WEEKLY\"","123":" \"status\": \"ENDED OK\"","124":" \"Timestamp\": \"20240317 13:25:23\"","125":" }","126":" \"25\": {","127":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI\"","128":" \"status\": \"ENDED NOTOK\"","129":" \"Timestamp\": \"20240317 13:25:23\"","130":" }","131":" \"26\": {","132":" \"jobname\": \"DREAM_BDV_NEW_BUSINESS_REPORTING_PRE_REQUISITE_ZCI_WEEKLY\"","133":" \"status\": \"ENDED NOTOK\"","134":" \"Timestamp\": \"20240317 13:25:23\"","135":" }"
Labels
- Labels:
-
rex
03-28-2024
01:07 AM
We are planning to integrate our SAP BTP Fiori app with Cisco AppDynamics and need some guidance. Could you please provide us with information on the following: The initial setup required in AppDy...
See more...
We are planning to integrate our SAP BTP Fiori app with Cisco AppDynamics and need some guidance. Could you please provide us with information on the following: The initial setup required in AppDynamics for SAP Fiori apps. Any specific agents or SDKs we should use for monitoring Fiori apps. How to set up custom metrics and configure alerts for Fiori apps. Tips on troubleshooting common issues during integration. We appreciate any documentation, resources, or advice you can share to help us ensure a smooth integration.
03-28-2024
01:04 AM
@bpenny did you ever figure this out? I'm running into the exact same issue. I think the problem is that we're referencing a json path. If I move the timestamp to a top level json field in the event,...
See more...
@bpenny did you ever figure this out? I'm running into the exact same issue. I think the problem is that we're referencing a json path. If I move the timestamp to a top level json field in the event, it picks up the timestamp just fine.
03-28-2024
12:21 AM
Hi according to the suggestion, I have tried out and successfully getting the expected behavior that only "admin" role users can have the options to do "Open in Search"/"Export" and etc... Amend the ...
See more...
Hi according to the suggestion, I have tried out and successfully getting the expected behavior that only "admin" role users can have the options to do "Open in Search"/"Export" and etc... Amend the SPL search accordingly to what you desire to achieve <!-- Running searches and gaining role value for current user --> <search> <query>| rest /services/authentication/current-context | search username!=splunk-system-user | fields roles </query> <earliest>-15m</earliest> <latest>now</latest> <done> <eval token="search_visible">if($result.roles$=="admin","true","false")</eval> </done> </search> <!-- Running searches and gaining role value for current user --> <!-- selectively disable only exporting fucntion --> <!-- admin role can export, other roles can't etc etc..--> <option name="link.exportResults.visible">$search_visible$</option>
03-28-2024
12:09 AM
Oh, in the future, timestamp issues will have to be resolved by restarting the instance. thank you @gcusello!
03-27-2024
11:45 PM
Hi @MVK1 , you can create your lookup using the Splunk Lookup Editor App (https://splunkbase.splunk.com/app/1724). Then you have to create your lookup definition [Settings > Lookups > Lookup Defini...
See more...
Hi @MVK1 , you can create your lookup using the Splunk Lookup Editor App (https://splunkbase.splunk.com/app/1724). Then you have to create your lookup definition [Settings > Lookups > Lookup Definitions > Create New Definition]; in this job put attention to the other properties, if you don't want that the lookup is case sensitive. Then you can manually populate this lookup using the Lookup Editor or schedule a search to extract the FailureMsgs and store in the lookup using the outputlookup command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Outputlookup). Only one question: in your lookup you whould have product and Feature, but I don't see these information in the sample you shared, so, how would you have these information? Ciao. Giuseppe
03-27-2024
11:35 PM
1 Karma
Hi @abi2023 , as @marnall said, you can create different apps and deploy to the UFs using different serverclasses. About data mascking, for my knowledge UFs enter only in the input phase, but the o...
See more...
Hi @abi2023 , as @marnall said, you can create different apps and deploy to the UFs using different serverclasses. About data mascking, for my knowledge UFs enter only in the input phase, but the other phases (merge and parsing) are in the first full Splunk instance that data are passing through. In other words, in the Indexers or (when present) in the first Heavy Forwarder, but not in the UFs. If your doubt is that data are sent in clear mode, you can encrypt them between the UFs and the Indexers (or HFs), and then mask them on these other systems. Ciao. Giuseppe
03-27-2024
11:28 PM
Hi @satyaallaparthi , good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Ka...
See more...
Hi @satyaallaparthi , good for you, see next time! let me know if I can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated
03-27-2024
11:27 PM
1 Karma
Hi @dongwonn , not all the configuration are reloaded with /debug/refresh. For this reason it's always better to restart Splunk. Ciao. Giuseppe
03-27-2024
11:25 PM
1 Karma
Hi @selvam_sekar , to identify the common clientids between the threee sourcetypes, you should run something like this: index=a sourcetype IN ("Cos","Ma","Ph")
| stats
count
dc(sourcetype)...
See more...
Hi @selvam_sekar , to identify the common clientids between the threee sourcetypes, you should run something like this: index=a sourcetype IN ("Cos","Ma","Ph")
| stats
count
dc(sourcetype) AS sourcetype_count
BY clientid
| where sourcetype_count=3
| fields - sourcetype_count Ciao. Giuseppe
03-27-2024
11:15 PM
I don't know why, but after applying the settings and restarting, the year value was set normally. [host::x.x.x.21] TIME_PREFIX = .... TIME_FORMAT = .... So far, I have reloaded the settings with...
See more...
I don't know why, but after applying the settings and restarting, the year value was set normally. [host::x.x.x.21] TIME_PREFIX = .... TIME_FORMAT = .... So far, I have reloaded the settings with /debug/refresh, but this time I tried reloading the settings by restarting Splunk. Although the current operating environment is difficult to operate with just one server, is it possible that there may be cases where new settings are not reloaded?
03-27-2024
10:57 PM
1 Karma
If you do not have a 'group' value per event, then you can simply create one by putting | streamstats c as group before the first stats mentioned by @yuanliu
03-27-2024
10:57 PM
Thank you @bowesmana . I'm also considering implementing the select value in JavaScript . Appreciate your time.
03-27-2024
10:51 PM
Hello Everyone I have Splunk Enterprise installed in a Centos 7 linux OS I have added csv data and i wish to build a dashboard however when attempting to add a background image i am getting the 5...
See more...
Hello Everyone I have Splunk Enterprise installed in a Centos 7 linux OS I have added csv data and i wish to build a dashboard however when attempting to add a background image i am getting the 503 -service unavailable error When running the status start command this is what i get : Splunk> Finding your faults, just like mom. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _configtracker _dsappevent _dsclient _dsphonehome _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history keepereu main summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-9.2.0.1-d8ae995bf219-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... PYTHONHTTPSVERIFY is set to 0 in splunk-launch.conf disabling certificate validation for the httplib and urllib libraries shipped with the embedded Python interpreter; must be set to "1" for increased security Done [ OK ] Waiting for web server at http://127.0.0.1:8000 to be available..................... When running the status command i get [root@localhost splunk]# /opt/splunk/bin/splunk status splunkd is running (PID: 2614). splunk helpers are running (PIDs: 2640 3079 3140 10111 10113 10144 10155 10172 10692 10808 11367 21735 24183). [root@localhost splunk]# What logs should i inspect to better understand why this is happening?
Labels
03-27-2024
10:38 PM
This seems to be a bug but for me it started working on its own after like 12 hrs.
03-27-2024
10:22 PM
Can you please try appending below - | makemv delim="," allowempty=t CmdArgAV Please accept the solution and hit Karma, if this helps!
03-27-2024
09:34 PM
2 Karma
As you already experience, Splunk strongly disfavors join. This is just natural as most noSQL do. So, you explained how many events these sources can give, and how many different client ID's. What...
See more...
As you already experience, Splunk strongly disfavors join. This is just natural as most noSQL do. So, you explained how many events these sources can give, and how many different client ID's. What you forget to tell us is what you mean by "to get the count/volume based on the client id". If you only want to count events from each sourcetype by clientid, all you need to do is (index=a sourcetype=Cos) OR (index=a sourcetype=Ma) OR (index=a sourcetype=Ph)
``` you can also use
index=a sourcetype IN (Cos, Ma, Ph)
```
| stats count by clientid, sourcetype (which is a copy of the SPL snippet but added a pipe (|) in front of stats to make syntax correct.) There is no join. The above will not timeout even with millions of event. In other words, what does "compare" mean in "to compare the same in another application", and what does the word mean in "to compare whether these clients ids are present in another application"? If you want to know which and how many sourcetypes (apps) each clientid appear in, all you need is to add the following: | stats sum(count) as total values(sourcetype) as apps dc(sourcetype) as app_count by clientid Put together, (index=a sourcetype=Cos) OR (index=a sourcetype=Ma) OR (index=a sourcetype=Ph)
``` you can also use
index=a sourcetype IN (Cos, Ma, Ph)
```
| stats count by clientid, sourcetype
| stats sum(count) as total values(sourcetype) as apps dc(sourcetype) as app_count by clientid Still no join. Where do you get join to time out?
03-27-2024
09:10 PM
I cannot get a sense of this question. What is that data table at the beginning of this post supposed to be? Right before inputlookup, you have a stats command that reduces data fields to downtime...
See more...
I cannot get a sense of this question. What is that data table at the beginning of this post supposed to be? Right before inputlookup, you have a stats command that reduces data fields to downtime and data.componentId. I assume that everything above inputlook is working as expected. If this is the case, please just post sample/mock values of downtime and data.componentId and ignore anything about app and input selection. (See below.) What fields (columns) are in this all_env_component.csv file? And how is this file useful to what you wanted in the end? What exact is it that you wanted in the end? By this, I mean what does "4 multi select boxes" have to do with this question? Your search does not use a single token. This means that none of these selections should have any effect of results. In short, you need to post data input - you can post just sample/mock values downtime- data.componentId pairs; explain what is in that lookup file, provide some sample/mock values. Then, explain what you are trying to do after that inputlookup, illustrate what your expected results look like from the sample/mock input values, and the logic between the input and desired results. These are the basis of an answerable question in a forum about data analytics.
03-27-2024
09:08 PM
@meetmshahthanks 'max_match=0' helped. but command keywords are separated by 'Enter'. is there any options to keep all words in one line?
03-27-2024
08:41 PM
Hi, I have requirement as below, please could you review and suggest ? Need to pick up all client ids from application log called "Cos" (index=a sourcetype=Cos ) where distinct client ids are in 6M...
See more...
Hi, I have requirement as below, please could you review and suggest ? Need to pick up all client ids from application log called "Cos" (index=a sourcetype=Cos ) where distinct client ids are in 6Millions. And, I want to compare whether these clients ids are present in another application log called "Ma" (index=a sourcetype=Ma). And, I also want to compare the same in another application called "Ph" (index=a sourcetype=Ph) Basically trying to get the count/volume based on the client id, which is common among the 3 application (Cos, Ma,Ph). The total events are in Millions and when i use join, the search job is getting auto-cancelled or getting terminated. (index=a sourcetype=Cos) OR (index=a sourcetype=Ma) OR (index=a sourcetype=Ph) stats count by clientid, sourcetype Thanks, Selvam.
- Tags:
- join
Labels
- Labels:
-
join
-
search job inspector
-
stats
-
tstats
