All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

I just started a Free trial and it's already horrible. For 30mins I'm running around in circles trying to figure out how to add data as per your docs: https://docs.splunk.com/Documentation/SplunkClou... See more...
I just started a Free trial and it's already horrible. For 30mins I'm running around in circles trying to figure out how to add data as per your docs: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchTutorial/Systemrequirements . I didn't get any link to Splunk web and the profile page is useless. At some point I got to a different part (splunk.my.site.com) but not only it was as useless but also how the F do I even got there and ? All I see is  'You have no active instances at this time.' .      
@ptothehil did you manage to get any further with this issue?
Thanks for the response. Appreciate it. I tried your query,  and it didn't match my result.  Below is the result of your query. I want to display a row, with test_rail_name as 'test_printe... See more...
Thanks for the response. Appreciate it. I tried your query,  and it didn't match my result.  Below is the result of your query. I want to display a row, with test_rail_name as 'test_printer_order_placement_magento' and message as 'Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance.'
mvexpand on message creates 3 events from one. mvexpand on test_rail_name creates 2 events from each of these - hence 6 events. | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpan... See more...
mvexpand on message creates 3 events from one. mvexpand on test_rail_name creates 2 events from each of these - hence 6 events. | spath unit_test_name_failed{} output=unit_test_name_failed | mvexpand unit_test_name_failed | spath input=unit_test_name_failed | where message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance."  
This is how data is shown If I just display the list.  
This is a code block  </API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDat... See more...
This is a code block  </API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}> </Starting Controller=Full Action=GetClueReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}/ The rex pattern provided would extract the policyId from this so there is probably something different about the event as you have shown it and your actual events. If you don't provide accurate (enough) information, we will not be able to provide you with an accurate (enough) solution.
Query is to retrieve failed test case matching with exception message. Out of 6 failed test case, one test as exception and rest of them are skipped with message 'Test was skipped'. Below data of ... See more...
Query is to retrieve failed test case matching with exception message. Out of 6 failed test case, one test as exception and rest of them are skipped with message 'Test was skipped'. Below data of one event.      { "suite_build_id": "20241015.12", "suite_build_name": "pipeline_name", "unit_test_name_failed": [ { "message": "Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance.", "test_rail_name": "test_printer_order_placement_magento", "test_result": "fail" }, { "message": "Test was skipped", "test_rail_name": "test_updation_of_access_token", }, { "message": "Test was skipped", "test_name": "test_printer_and_user_details", "test_rail_name": "test_printer_and_user_details", } ] }      Now, I want to display result to show test_rail_name and exception_message which matches exception. Below is the query that I tried.     index="eqt-e2e" suite_build_name="pipeline-name" suite_build_number="20241015.12" | mvexpand unit_test_name_failed{}.message | mvexpand unit_test_name_failed{}.test_rail_name | search unit_test_name_failed{}.message="Failed to save the shipping address. An unexpected error occurred. Please try again later or contact HP Support for assistance." | table suite_build_number, suite_build_start_time, unit_test_name_failed{}.test_rail_name, unit_test_name_failed{}.message | rename suite_build_number AS "Pipeline Number", suite_build_start_time AS "Pipeline Date", unit_test_name_failed{}.test_rail_name AS "Test Name", unit_test_name_failed{}.message AS "Exception Message"     In the result, it should have been 1 event, but retrieve 6 events.  I understand, mvexpand works only on one multivalue fields, and here I have 2 multivalue fields. Let me know if there is any solution on retrieving the data.
</API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00... See more...
</API=/api/full/reportAssessment/ CallStatus=Success Controller=Full Action=GetfullReportAssessment Duration=5 data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}>   </Starting Controller=Full Action=GetClueReportAssessment data={"policyId":"Q123456789","inceptionDate":"20241015","postDate":"1900-01-01T12:00:00"}/  
Sorry, i am new to Splunk. Yes, I have only being able to connect mySql to DBConnect but i am not able to configure it to logstash. Any idea how can i get the audit logs on logstash  though TCP? U... See more...
Sorry, i am new to Splunk. Yes, I have only being able to connect mySql to DBConnect but i am not able to configure it to logstash. Any idea how can i get the audit logs on logstash  though TCP? UF can forward the log to TCP and logstash has a input plugin for TCP.
Without knowledge of your data, I can't see any further optimisations you might try
@ITWhisperer Yes, I replace join with lookup command. Do you want me to try something more to optimize further?
If the rex isn't working, it is probably because it doesn't match precisely to the event you have. Please repost your events in a code block </> to preserve the formatting which will be important to ... See more...
If the rex isn't working, it is probably because it doesn't match precisely to the event you have. Please repost your events in a code block </> to preserve the formatting which will be important to getting the rex correct.
It returns a blank table. 
Have you tried this with the join being replaced by a lookup?
Unfortunately, it didn't pick up the policy ID.  It returns a blank table
Hello Splunkers,   I’m working on developing an app that requires making REST API calls to Splunk in order to gather information about saved searches, knowledge objects, and more. Co... See more...
Hello Splunkers,   I’m working on developing an app that requires making REST API calls to Splunk in order to gather information about saved searches, knowledge objects, and more. Could you please advise on the most secure method for authorization and authentication? Does the REST API support MFA, or are there other mechanisms available, with or without SAML? Is token generation the only secure way to make these API calls, or are there alternative methods? Thanks  Manish Kumar  
@ITWhisperer  After apply your suggested command I also replaced lookup command and now search is taking 10.5 seconds to complete the results. Thanks for your help.
I have this exact same issue, i can prove that it works fine matching the linux os but does not match windows. in fact windows will get matched as linux
I've downloaded latest Splunk installation package, extracted app files and replaced old files in my installation. But it does not hepl.
@ITWhisperer  Although this method is correct, it takes one second longer than the dedup command. Thanks in advance.