Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sk314
sk314
Builder
Member since:
06-06-2013
07-15-2021
Community Statistics
| Posts | 206 |
| Solutions | 27 |
| Karma Given | 94 |
| Karma Received | 74 |
| Member Since | 06-06-2013 |
Activity Feed
- Got Karma for Re: LDAP authentication in Splunk is not working. 07-21-2021 04:56 PM
- Got Karma for Re: How to route and filter data on the Heavy Forwarder to separate indexer groups?. 11-04-2020 07:10 AM
- Karma Re: What are the best practices for defining source types? for jkat54. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: What are the best practices for defining source types? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: upgrade to 7.2 fails with "ERROR while running mongod-fix-voting-priority migration." for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Where can I download the Splunk Supporting Add-on for Active Directory 2.2.0?. 06-05-2020 12:50 AM
- Karma Re: How to differentiate between different redis hosts using Redis Add-on for Splunk? for xavierashe. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: How to differentiate between different redis hosts using Redis Add-on for Splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: Can Splunk Enterprise Security use macros from another app?. 06-05-2020 12:49 AM
- Karma Re: Why am I unable to generate a diag from an indexer cluster peer after upgrading to Splunk 6.4.0? for hexx. 06-05-2020 12:48 AM
- Karma Re: How to append a single value to multiple rows in my table? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can we exclude weekends from the count of the number of days for the age of a ticket? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Error rendering Clustered Single Value Map Visualization visualization for shaskell_splunk. 06-05-2020 12:48 AM
- Karma Re: Cluster bucket rebalancing: How long is too long? for twinspop. 06-05-2020 12:48 AM
- Karma Re: Mysterious data spike for mattymo. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I unable to see all LDAP users under Access Controls?. 06-05-2020 12:48 AM
- Got Karma for Re: How to troubleshoot Splunk 6 search performance issues?. 06-05-2020 12:48 AM
- Got Karma for Re: Can a Universal Forwarder be used to forward indexed data on a search head to an indexer?. 06-05-2020 12:48 AM
Topics I've Started
05-20-2015
04:20 PM
1 Karma
Do you want to have the old data replicated as well? This can be done but not usually recommended (As per Splunk Documentation).
However, if you just want the old data to be searchable in the new setup, you can add the old instance as a non clustered search peer on the search head.
... View more
05-08-2015
05:07 PM
I wasn't sure if you had any events with something following the keywords. So just to be safe, I included the * as the suffix.
... View more
05-08-2015
05:05 PM
It would be better if we knew why you think you broke it. perhaps.
... View more
05-08-2015
05:03 PM
what's the regex you used?
... View more
05-08-2015
04:58 PM
did you try searching for "*InvalidRemoteSessionException*" and "*InvalidSessionException*" ?
... View more
04-30-2015
10:41 AM
You could use rex on _raw field like so:
<your sourcetype> | rex field=_raw "RPT: (?<RPT>\w+)"
A better way would be to get your field extractions specified in props.conf and transforms.conf. Have a look at the documentation at the following link:
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Aboutfields
... View more
03-19-2015
03:36 PM
just checking, do you have the corresponding props.conf entry?
... View more
03-19-2015
02:50 PM
Could you try removing the name capture group and using the FORMAT line?
... View more
03-18-2015
03:37 PM
you have to have a capturing group within your regex. each capturing group would correspond to a field. You can specify the capturing groups in your transforms.conf like so:
[myformat]
REGEX = ^.*\[(?.*?)\]\s(?[A-Z]+)\s+(?\S+\s\S+)\s\-\s(?.+)$
FORMAT = field_1::$1 field_2::$2 field_3::$3 field_4::$4
edit: I assumued your regex works for you. (didn't check)
... View more
03-18-2015
12:05 AM
have you looked at mvexpand? http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Mvexpand
you could pipe an mvexpand command at the end of your rex extraction.
... View more
03-12-2015
08:37 AM
somesoni has a specific set of skills, he finds the questions and then he fixes them.
... View more
03-11-2015
10:57 AM
Have you tried | bucket _time span=1d |chart count(fieldA) over _time by fieldB
and run the search over last 30 days? I am sure there are better ways to do this.
... View more
02-26-2015
05:01 AM
@markthompson done and done.
... View more
02-24-2015
02:52 PM
1 Karma
you could post a few lines from your logs itself...
... View more
02-24-2015
12:49 PM
Have you tried this:
index=uv GUID="*" NOT "ERROR" | transaction GUID startswith="CalculateTaxRequest" endswith="CalculatetaxResponse"| table GUID duration | WHERE duration > 8 | sort duration desc
Also, switch the tab to visualization and select "column" or "line"
(I know. Kind of tacky.)
... View more
02-20-2015
04:07 PM
1 Karma
Break_only_before will break as soon as it finds whatever pattern you put in. If you put in a whole line, it will break a line before it finds the entire line. If you put in part of the line, as soon as it encounter that, it will break a line before that.
... View more
02-20-2015
03:49 PM
Try this:
sourcetype="WinEventLog:Security" | rex field=_raw "Process Name: (?<process_name>[^ ]+)" | search sourcetype="WinEventLog:Security" process_name !="c:\Windows\system32\svchost.exe"
... View more
02-18-2015
03:58 PM
1 Karma
you have questions too? 😄
... View more
02-17-2015
12:33 PM
Could you post a couple of sample events? You could try extracting the process name into a field and then searching for field_name != "c:\Windows\system32\svchost.exe"
Typically your search would be similar to ..
<your sourcetype> | rex _raw "Process Name: (?<process_name>[^ ]+)" | search <your sourcetype> process_name !="c:\Windows\system32\svchost.exe"
If you can post sample events, I can confirm the regular expression.
... View more
02-17-2015
10:00 AM
1 Karma
have you tried escaping the inner quotes like so \" ?
... View more
02-11-2015
12:31 PM
I think you can convert comment to answer, or upvote comment. (If it helped that is...)
... View more
02-09-2015
04:35 PM
AFAIK, having regex expression go to nullQueue will discard entire event, not just the matched pattern. You should be looking for a SEDCMD.
Try this:
props.conf
[your_sourcetype]
SEDCMD-null = s/(?s)<Header>.*(?=<\/Header>)<\/Header>//
Having said so, proceed with caution as this works directly at index time and there is no way to get back lost data. I suggest you try the command on sample data before putting it into production.
... View more
01-29-2015
03:01 PM
2 Karma
I suggest you try SHOULD_LINEMERGE = True, BREAK_ONLY_BEFORE = {Heap before GC
Also, remove TIME_PREFIX = ^ and MAX_TIMESTAMP_LOOKAHEAD = 32 and LINE_BREAKER = ([\r\n]+){Heap before GC (remove these three)
... View more
01-29-2015
12:52 PM
Try SHOULD_LINEMERGE = True.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-15-2021
10:20 AM
|
Karma given to
