All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Looking for props.conf / transforms.conf configuration guidance. The aim is to search logs from a HTTP Event Collector the same way we search for regular logs. Don't want to search JSON in the sea... See more...
Looking for props.conf / transforms.conf configuration guidance. The aim is to search logs from a HTTP Event Collector the same way we search for regular logs. Don't want to search JSON in the search heads. We're in the process of migrating from Splunk Forwarders to logging-operator in k8s. Thing is, Splunk Forwarder uses log files and standard indexer discovery whereas logging-operator uses stdout/stderr and must output to an HEC endpoint, meaning the logs arrive as JSON at the heavy forwarder. We want to use Splunk the same way we did over the years and want to avoid adapting alerts/dashboards etc to the new JSON source OLD CONFIG AIMED TO THE INDEXERS (using the following config we get environment/site/node/team/pod as search-time extraction fields)   [vm.container.meta] # source: /data/nodes/env1/site1/host1/logs/team1/env1/pod_name/localhost_access_log.log CLEAN_KEYS = 0 REGEX = \/.*\/.*\/(.*)\/(.*)\/(.*)\/.*\/(.*)\/.*\/(.*)\/ FORMAT = environment::$1 site::$2 node::$3 team::$4 pod::$5 SOURCE_KEY = MetaData:Source WRITE_META = true   SAMPLE LOG USING logging-operator   { "log": "ts=2024-10-15T15:22:44.548Z caller=scrape.go:1353 level=debug component=\"scrape manager\" scrape_pool=kubernetes-pods target=http://1.1.1.1:8050/_api/metrics msg=\"Scrape failed\" err=\"Get \\\"http://1.1.1.1:8050/_api/metrics\\\": dial tcp 1.1.1.1:8050: connect: connection refused\"\n", "stream": "stderr", "time": "2024-10-15T15:22:44.548801729Z", "environment": "env1", "node": "host1", "pod": "pod_name", "site": "site1", "team": "team1" }  
@ marnall, You are right. I do not have any data in my KV store that would need to be restored in the future. Upgrade to 9.3.1 has been completed without any issues!   Thanks
Please share the full SPL you ran.  The one command I provided will not return a table so we need to know how you are creating a table.
| spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | spath input=unit_test_name_failed | where message="Failed to save the shipping address. An unexpected e... See more...
| spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | spath input=unit_test_name_failed | where message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance." | table message test_rail_name
We are creating a SOC with an SIEM that we would like to implement Splunk into. We are making the Splunk dashboard but would like to use Splunk in our code. It's okay if we have Splunk running in the... See more...
We are creating a SOC with an SIEM that we would like to implement Splunk into. We are making the Splunk dashboard but would like to use Splunk in our code. It's okay if we have Splunk running in the background but we would like to pull some GUI of Splunk into our code. In short, we are creating a Splunk dashboard through python code. 
Yes. I had to download Splunk Security Essentials on my personal laptop and then safe apps it to my work laptop. Next I copied the zip file up to the secure network and was able to install the applic... See more...
Yes. I had to download Splunk Security Essentials on my personal laptop and then safe apps it to my work laptop. Next I copied the zip file up to the secure network and was able to install the application. My issues was that DISA was blocking some of the files when I downloaded from Splunk. Not sure if this helps your situation.
What do you get from this | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | table unit_test_name_failed
I just started a Free trial and it's already horrible. For 30mins I'm running around in circles trying to figure out how to add data as per your docs: https://docs.splunk.com/Documentation/SplunkClou... See more...
I just started a Free trial and it's already horrible. For 30mins I'm running around in circles trying to figure out how to add data as per your docs: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchTutorial/Systemrequirements . I didn't get any link to Splunk web and the profile page is useless. At some point I got to a different part (splunk.my.site.com) but not only it was as useless but also how the F do I even got there and ? All I see is  'You have no active instances at this time.' .      
@ptothehil did you manage to get any further with this issue?
Thanks for the response. Appreciate it. I tried your query,  and it didn't match my result.  Below is the result of your query. I want to display a row, with test_rail_name as 'test_printe... See more...
Thanks for the response. Appreciate it. I tried your query,  and it didn't match my result.  Below is the result of your query. I want to display a row, with test_rail_name as 'test_printer_order_placement_magento' and message as 'Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance.'
mvexpand on message creates 3 events from one. mvexpand on test_rail_name creates 2 events from each of these - hence 6 events. | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpan... See more...
mvexpand on message creates 3 events from one. mvexpand on test_rail_name creates 2 events from each of these - hence 6 events. | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | spath input=unit_test_name_failed | where message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance."  
This is how data is shown If I just display the list.  
This is a code block  </API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDat... See more...
This is a code block  </API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}> </Starting Controller=Full Action=GetClueReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}/ The rex pattern provided would extract the policyId from this so there is probably something different about the event as you have shown it and your actual events. If you don't provide accurate (enough) information, we will not be able to provide you with an accurate (enough) solution.
Query is to retrieve failed test case matching with exception message. Out of 6 failed test case, one test as exception and rest of them are skipped with message 'Test was skipped'. Below data of ... See more...
Query is to retrieve failed test case matching with exception message. Out of 6 failed test case, one test as exception and rest of them are skipped with message 'Test was skipped'. Below data of one event.      { "suite_build_id": "20241015.12", "suite_build_name": "pipeline_name", "unit_test_name_failed": [ { "message": "Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance.", "test_rail_name": "test_printer_order_placement_magento", "test_result": "fail" }, { "message": "Test was skipped", "test_rail_name": "test_updation_of_access_token", }, { "message": "Test was skipped", "test_name": "test_printer_and_user_details", "test_rail_name": "test_printer_and_user_details", } ] }      Now, I want to display result to show test_rail_name and exception_message which matches exception. Below is the query that I tried.     index="eqt-e2e" suite_build_name="pipeline-name" suite_build_number="20241015.12" | mvexpand unit_test_name_failed{}.message | mvexpand unit_test_name_failed{}.test_rail_name | search unit_test_name_failed{}.message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance." | table suite_build_number, suite_build_start_time, unit_test_name_failed{}.test_rail_name, unit_test_name_failed{}.message | rename suite_build_number AS "Pipeline Number", suite_build_start_time AS "Pipeline Date", unit_test_name_failed{}.test_rail_name AS "Test Name", unit_test_name_failed{}.message AS "Exception Message"     In the result, it should have been 1 event, but retrieve 6 events.  I understand, mvexpand works only on one multivalue fields, and here I have 2 multivalue fields. Let me know if there is any solution on retrieving the data.
</API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00... See more...
</API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}>   </Starting Controller=Full Action=GetClueReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}/  
Sorry, i am new to Splunk. Yes, I have only being able to connect mySql to DBConnect but i am not able to configure it to logstash. Any idea how can i get the audit logs on logstash  though TCP? U... See more...
Sorry, i am new to Splunk. Yes, I have only being able to connect mySql to DBConnect but i am not able to configure it to logstash. Any idea how can i get the audit logs on logstash  though TCP? UF can forward the log to TCP and logstash has a input plugin for TCP.
Without knowledge of your data, I can't see any further optimisations you might try
@ITWhisperer Yes, I replace join with lookup command. Do you want me to try something more to optimize further?
If the rex isn't working, it is probably because it doesn't match precisely to the event you have. Please repost your events in a code block </> to preserve the formatting which will be important to ... See more...
If the rex isn't working, it is probably because it doesn't match precisely to the event you have. Please repost your events in a code block </> to preserve the formatting which will be important to getting the rex correct.