Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About JDukeSplunk
JDukeSplunk
Builder
Member since:
07-28-2015
09-29-2022
Community Statistics
| Posts | 240 |
| Solutions | 24 |
| Karma Given | 19 |
| Karma Received | 61 |
| Member Since | 07-28-2015 |
Activity Feed
- Got Karma for Re: How to search for failed login attempts?. 11-18-2022 06:33 AM
- Got Karma for Re: Skipped Searches on SHC. 11-17-2022 09:24 PM
- Got Karma for Re: How to combine savedsearches.conf from default and local folders to just the local folder?. 06-20-2022 11:21 PM
- Got Karma for Re: How to get the forwarder IP address reproting to splunk. 12-16-2021 12:15 PM
- Got Karma for Re: How can I tell if a heavy forwarder or universal forwarder was installed on a box?. 12-08-2021 02:39 PM
- Got Karma for Re: How can we include a link to another dashboard to redirect to another dashboard ?. 09-13-2021 01:26 PM
- Karma Re: Some time questions. for to4kawa. 06-05-2020 12:51 AM
- Got Karma for Re: Field Extraction regex, stop at word or $. 06-05-2020 12:51 AM
- Got Karma for Re: Some time questions.. 06-05-2020 12:51 AM
- Karma Re: Why does our Indexer show that the receiving port is open but OS does not? for echalex. 06-05-2020 12:50 AM
- Got Karma for Nest App, Google Migrated Account, 406 errors.. 06-05-2020 12:50 AM
- Got Karma for Re: How come the LDAP config is not picking up users directly under OU?. 06-05-2020 12:50 AM
- Karma Re: I can't search the logs due to overused for adonio. 06-05-2020 12:49 AM
- Karma Re: How do I monitor input on Windows machine with a wild card character? for 493669. 06-05-2020 12:49 AM
- Karma Re: How can I forward data in Windows Universal Splunk Forwarder 6.5.0 and a CentOS Splunk Entreprise 6.5.0? for myitlab1000. 06-05-2020 12:49 AM
- Karma Re: How to append results of an alert to output file instead of overriding each time alerts is triggered? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Trying to blacklist event code with accesses for sbbadri. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to deduplicate data by date?. 06-05-2020 12:49 AM
- Got Karma for Re: What are your Splunk t-shirt ideas?. 06-05-2020 12:49 AM
- Got Karma for Re: Client stopped indexing as hostname, can only be found by IP now.. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
10-26-2016
08:43 PM
Either the cloud server rule will now allow traffic from your forwarder, or the Windows box local firewall will not allow it out.
Try to telnet to your host.
telnet X.x.x.x 9997
I'm guessing somewhere in the cloud setup you must allow hosts to forward to the server. I've only ever used on-premise systems.
... View more
10-26-2016
08:36 PM
For what it's worth, I had success using XMLKV on one of my JSON feeds.
https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Xmlkv
... View more
10-21-2016
10:18 AM
1 Karma
It might be overkill, but something like this might get it. Try this in a search
..youbase search |rex field=_raw "(?i)parm=mobileNetworkCode=(?P<NEWFEILDNAME>\d+)"
Assuming this line is always formatted like this, and is alwasy a number.
... View more
10-21-2016
10:09 AM
I'll start with a raw event. This is basically a Java stack dump.
2016-10-20 13:23:20,828 [p-bio-8001-exec-1866] [TABTHREAD1] [ ] [ PegaRULES:07.10] (ngineinterface.service.HttpAPI) ERROR ttapppegacc01.alere.com|10.171.166.102 Administrator@pega.com - 10.171.166.102: com.pega.pegarules.pub.PRRuntimeError
com.pega.pegarules.pub.PRRuntimeError: PRRuntimeError
at com.pega.pegarules.session.internal.mgmt.base.ThreadRunner.runActivitiesAlt(ThreadRunner.java:712)
at com.pega.pegarules.session.internal.mgmt.PRThreadImpl.runActivitiesAlt(PRThreadImpl.java:461)
at com.pega.pegarules.session.internal.engineinterface.service.HttpAPI.runActivities(HttpAPI.java:3358)
at com.pega.pegarules.session.external.engineinterface.service.EngineAPI.processRequestInner(EngineAPI.java:385)
at sun.reflect.GeneratedMethodAccessor156.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.performTargetActionWithLock(PRSessionProviderImpl.java:1270)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.doWithRequestorLocked(PRSessionProviderImpl.java:1008)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.doWithRequestorLocked(PRSessionProviderImpl.java:841)
at com.pega.pegarules.session.external.engineinterface.service.EngineAPI.processRequest(EngineAPI.java:331)
at com.pega.pegarules.session.internal.engineinterface.service.HttpAPI.invoke(HttpAPI.java:852)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl._invokeEngine_privact(EngineImpl.java:315)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl.invokeEngine(EngineImpl.java:263)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl.invokeEngine(EngineImpl.java:240)
at com.pega.pegarules.priv.context.JNDIEnvironment.invokeEngineInner(JNDIEnvironment.java:278)
at com.pega.pegarules.priv.context.JNDIEnvironment.invokeEngine(JNDIEnvironment.java:223)
at com.pega.pegarules.web.impl.WebStandardImpl.makeEtierRequest(WebStandardImpl.java:574)
at com.pega.pegarules.web.impl.WebStandardImpl.doPost(WebStandardImpl.java:374)
at sun.reflect.GeneratedMethodAccessor153.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethod(PRBootstrap.java:370)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethodPropagatingThrowable(PRBootstrap.java:411)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethodPropagatingThrowable(AppServerBridgeToPega.java:223)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethod(AppServerBridgeToPega.java:272)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doPost(WebStandardBoot.java:121)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doGet(WebStandardBoot.java:92)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
at com.googlecode.psiprobe.Tomcat70AgentValve.invoke(Tomcat70AgentValve.java:38)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Caused by: com.pega.pegarules.pub.runtime.IndeterminateConditionalException: Executable.evaluateWhen-FUAFailed
at com.pega.pegarules.session.internal.mgmt.Executable.evaluateWhen(Executable.java:4247)
at com.pega.pegarules.session.internal.mgmt.Executable.evaluateWhen(Executable.java:4128)
at com.pega.pegarules.exec.internal.basic.dictionary.AccessInfoConclusion.evaluateConditions(AccessInfoConclusion.java:936)
at com.pega.pegarules.exec.internal.basic.dictionary.AccessInfoConclusion.evaluate(AccessInfoConclusion.java:797)
at com.pega.pegarules.session.internal.authorization.access.AccessEvaluator.haveAccess(AccessEvaluator.java:179)
at com.pega.pegarules.session.internal.authorization.Authorization.haveAccess(Authorization.java:1822)
at com.pegarules.generated.activity.ra_action_wbtoolbarddsettings_9a469343ff55b48369ec8575895d72dc.step13_circum0(ra_action_wbtoolbarddsettings_9a469343ff55b48369ec8575895d72dc.java:1468)
at com.pegarules.generated.activity.ra_action_wbtoolbarddsettings_9a469343ff55b48369ec8575895d72dc.perform(ra_action_wbtoolbarddsettings_9a469343ff55b48369ec8575895d72dc.java:275)
at com.pega.pegarules.session.internal.mgmt.Executable.doActivity(Executable.java:3505)
at com.pega.pegarules.session.internal.mgmt.Executable.invokeActivity(Executable.java:10563)
at com.pegarules.generated.activity.ra_action_onbeforedisplay_73be703c71638484f9e536ae97ee89b6.step2_circum0(ra_action_onbeforedisplay_73be703c71638484f9e536ae97ee89b6.java:506)
at com.pegarules.generated.activity.ra_action_onbeforedisplay_73be703c71638484f9e536ae97ee89b6.perform(ra_action_onbeforedisplay_73be703c71638484f9e536ae97ee89b6.java:86)
at com.pega.pegarules.session.internal.mgmt.Executable.doActivity(Executable.java:3505)
at com.pega.pegarules.session.internal.mgmt.Executable.invokeActivity(Executable.java:10563)
at com.pegarules.generated.activity.ra_action_wbopen_636ddc8d3c8d3933fb470ef82428b1d6.step24_circum0(ra_action_wbopen_636ddc8d3c8d3933fb470ef82428b1d6.java:2225)
at com.pegarules.generated.activity.ra_action_wbopen_636ddc8d3c8d3933fb470ef82428b1d6.perform(ra_action_wbopen_636ddc8d3c8d3933fb470ef82428b1d6.java:537)
at com.pega.pegarules.session.internal.mgmt.Executable.doActivity(Executable.java:3505)
at com.pega.pegarules.session.internal.mgmt.Executable.invokeActivity(Executable.java:10563)
at com.pegarules.generated.activity.ra_action_douiaction_e7228a040c3bf89efe31545c6149a3d4.step28_circum0(ra_action_douiaction_e7228a040c3bf89efe31545c6149a3d4.java:2860)
at com.pegarules.generated.activity.ra_action_douiaction_e7228a040c3bf89efe31545c6149a3d4.perform(ra_action_douiaction_e7228a040c3bf89efe31545c6149a3d4.java:526)
at com.pega.pegarules.session.internal.mgmt.Executable.doActivity(Executable.java:3505)
at com.pega.pegarules.session.internal.mgmt.base.ThreadRunner.runActivitiesAlt(ThreadRunner.java:646)
... 50 more
Caused by: com.pega.pegarules.pub.generator.RuleNotFoundException: Failed to find a 'RULE-ACCESS-WHEN' with the name 'NODEVELOPERACCESS' that applies to 'Data-Admin-System-Settings'. There were 2 rules with this name in the rulebase, but none matched this request. The 2 rules named 'NODEVELOPERACCESS' defined in the rulebase are:
2 related to applies-to class 'Data-Admin-System-Settings', but were defined in rulesets which are not in your rulesetlist: {phsBusTier:01-31-45, :01-01-01}.
We have a regex that will grab the first instance in the exception.
| rex field=_raw "\.(?<Mother_Exception>[^\.\:]+(Exception|Error))\:"
We also have some logic that will grab the "Caused By" line, and then break that up to get the first Daughter Exception.
| rex field=_raw "Caused by:(?<CausedBy>.+)"
| eval cb=split(CausedBy,":")
| eval Daughter_Exception = mvindex(cb,0)
I think there is some way to grab all "Mother" and "Daughter" exceptions. I just don't know how.
Ideally the first match for [^\.\:]+(Exception|Error))\:" would be Mother. Then any further matches of [^\.\:]+(Exception|Error))\:" would be named Daughter1,Daughter2,..etc. They rarely go beyond 2, if ever.
Does this make sense?
... View more
10-18-2016
07:15 PM
Whenever I run into this ceiling, I have to split up the timechart into larger buckets using span .
For instance, I span hours by minute; days by hours, weeks by days, and months by week.
..earliest=-1h |timechart span=1m count by host
..earliest=-1d|timechart span=1h count by host
..earliest=-1w|timechart span=1d count by host
..earliest=-30d|timechart span=1w count by host
... View more
10-18-2016
10:23 AM
Sundareshr put me on the right track, and I am interested on playing with foreach a little more.
Here is what I ended up with. This is for a dashboard with time exclusion logic for maintance windows, which is why there is a eval hours and |where (NOT hours=.
index=application (host=TTAPPPEGACC*) sourcetype="apollo:prod:tomcat_access"
|eval hours=strftime(_time, "%H")
|where (NOT hours=25 AND NOT hours=12 AND NOT hours=1 AND NOT hours=2)
|rangemap field=httpcode http_200=200-299,http_300=300-399,http_400=400-499,http_500=500-599
|bucket _time span=1h
|chart count over _time by range
|addtotals
|timechart span=1h values(eval(http_400*100/Total)) AS 400s, values(eval(http_500*100/Total)) AS 500s
Which, if anyone is curious looks like this.
... View more
10-18-2016
10:01 AM
I figured out what was wrong with the numbers. Because the range names were numbers themselves, splunk was taking the range name as a string.
So... Total / 200 * 100 =
Which in the case of the previous example is
1023 / 200 * 100 = 19.55....
... View more
10-18-2016
07:34 AM
So this brings back results, I yanked out the round logic. But the numbers are very wrong.
index=application (host=TTAPPPEGACC*) sourcetype="apollo:prod:tomcat_access" httpcode=*
| rangemap field=httpcode 200=200-299,300=300-399,400=400-499,500=500-599
|bucket _time span=1m
| chart count over _time by range
| addtotals
| foreach *00 [ eval perc_<<MATCHSTR>>00=(<<FIELD>>/Total)*100 ]
We see here that 500 for the range is 0, but the percentage shows as 39%
200 300 400 500 perc_200 perc_300 perc_400 perc_500 Total
1009 14 0 0 19.550342 29.325513 39.100684 48.875855 1023
... View more
10-18-2016
07:13 AM
Thanks for the response Sundareshr,
The foreach , eval logic is failing, maybe it cannot identify the field *00 since it is generated by rangemap and does not show as standalone fields, but as values of a field named "range".
"Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression"
I'd like to get it working, since I have never used foreach before, and would like to use it to shorten some of my longer searches with repeating eval logic.
I've used something similar in the past to generate percentages, that involved inserting a stats command, and then multiple eval's to generate the percentages. It was basicly lifted from this Answer here.
https://answers.splunk.com/answers/301823/how-to-search-the-percentage-and-count-of-total-by.html
... View more
10-18-2016
06:11 AM
I used "Eval Case" to replace the values similar to this. We ended up using a lookup table, since there were 70 possible values and the query was thus very long.
Here's a snippet of my code that you could adapt. In my case, I wanted to add the more verbose value. So PEGA0001 was replaced with the longer version after the comma. The 1=1, "Google It.." at the end is a catch all, for any value not defined in the case string.
|eval PegaAlertV=case(PegaAlert="PEGA0001","PEGA0001-HTTP interaction time exceeds limit",
PegaAlert="PEGA0002","PEGA0002-Commit operation time exceeds limit",
PegaAlert="PEGA0003","PEGA0003-Rollback operation time exceeds limit",
PegaAlert="PEGA0004","PEGA0004-Quantity of data received by database query exceeds limit",
PegaAlert="PEGA0056","PEGA0056-Defragmentation of the table associated with class System-Locks takes too long",
1=1,"Google It..")
-JD
... View more
10-17-2016
12:49 PM
I am trying to display the percentage of a rangemap as related to the total events while excluding the httpcode=200 from the chart.
I don't have to use a rangemap, but it would help to make the chart a little cleaner. Basically, I want to do this, without the 200's, in a timechart.
So far, what I have is this.
index=application (host=TTAPPPEGACC*) sourcetype="apollo:prod:tomcat_access"
| rangemap field=httpcode 200=200-299,300=300-399,400=400-499,500=500-599
|bucket _time span=1m
|eventstats count(httpcode) as Total by _time
... View more
10-03-2016
07:31 AM
I've never seen nulls crop up in timechart unless there was some value, either in the data or generated by an eval producing it.
I know stats is not showing your nulls, and I think you already tried level=*. The only thing I can think of is to see if running a subsearch after the timechart (or chart) might work, with a |search level=null and see if you get a result.
... View more
09-30-2016
07:04 AM
I think you're going to have to use timechart instead of chart.
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Timechart
Maybe..
...|timechart span=1d count(Opened) by "Assignment group"
... View more
09-30-2016
06:54 AM
1 Karma
You will need to save it as a dashboard panel first of all. Once there, you can edit the charting options to define the colors.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/Chartcustomization#Chart_colors
You may also want to use rangemap to break down the days into the sizes you want.
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Rangemap
Ive only ever done rangemap inline, so something similar to this. You're going probably going to have to tweak this to make it work.
index=level3 host=Test |rangemap AgeRange=count(Age) Under_3=0-3 4to7=4-7 Over=8-9999| chart count by AgeRange
... View more
09-29-2016
09:07 AM
I see it here.
https://www.splunk.com/en_us/download/universal-forwarder-2.html#tabs/linux
... View more
09-29-2016
07:22 AM
My first stab at it would be something like this. This will give you 14 days, including yesterday, but not today.
index=level3 host=Test earliest="-14d@d" latest="-0d@d" | timechart span=1d limit=20 count Opened by "Assignment group"
Then in the visualations tab change the format to Column, and Format, stacked.
... View more
09-29-2016
07:16 AM
You can redefine time in the search by adding/subtracting seconds. E.G.
youbasesearch | eval _time=_time-10800
or +10800
... View more
09-29-2016
07:09 AM
1 Karma
If you could post some sample data that would help the community help you.
... View more
09-27-2016
11:55 AM
One more, to find hosts with low C:\
index=perfmon sourcetype="Perfmon:Free Disk Space" counter="Free Megabytes" (instance!="HarddiskVolume*") (instance!=_Total) instance=C: Value < 5000 |dedup host | eval FreeSpace=(Value/1024)| eval GB=tostring(FreeSpace,"commas") | table host instance GB | sort + host instance | rename instance as "Drive Letter" GB as "GigaBytes Free"
... View more
09-27-2016
11:53 AM
1 Karma
Here's what we use. We just tacked this into Splunk_TA_Windows /local/inputs.conf
[perfmon://CPU Load]
index = perfmon
counters = % Processor Time;% User Time
instances = _Total
interval = 60
object = Processor
[perfmon://Available Memory]
index = perfmon
counters = Available Bytes
interval = 60
object = Memory
[perfmon://Free Disk Space]
index = perfmon
counters = Free Megabytes;% Free Space
instances = C:;D:;E:;F:
# 15 minutes
interval = 900
object = LogicalDisk
[perfmon://Network Interface]
index = perfmon
counters = Bytes Received/sec;Bytes Sent/sec
instances = *
interval = 60
object = Network Interface
[perfmon://LocalPhysicalDisk]
index = perfmon
# 5 minutes
interval = 300
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time ;Avg. Disk Bytes/Read; Avg. Disk Bytes/Transfer; Avg. Disk Bytes/Write; Avg. Disk Queue Length; Avg. Disk Read Queue Length; Avg. Disk Write Queue Length; Avg. Disk sec/Read; Avg. Disk sec/Transfer; Avg. Disk sec/Write
instances = *
disabled = 0
Then this is the search we use.
index=perfmon sourcetype="Perfmon:Free Disk Space" counter="Free Megabytes" (instance!="HarddiskVolume*") (instance!=_Total) |dedup host
| eval FreeSpace=(Value/1024)
| eval GB=tostring(FreeSpace,"commas")
| table host instance GB
| sort + host instance
| rename instance as "Drive Letter" GB as "GigaBytes Free"
... View more
09-27-2016
11:48 AM
Bummer. I dug through as many search engines as i could find looking for maybe a hidden FTP mirror for Splunk downloads. Nothing.
Maybe you could use SNMP to offload the NT4 traffic elsewhere and then Splunk that? I don't know what you would be able to capture for it. Personally, I'd keep searching or maybe post a new question here "Looking for universal forwarder install older than 4.3".
... View more
09-27-2016
11:40 AM
I remember now. I believe that blacklist works for the WinEvent log as well as it does due to the nature of the TA_Windows APP. I think that generally in inputs.conf blacklist only applies to filenames. Might be worth a look at that app to see how it enables event-level blacklisting.
So your method of using props and transforms would be something like this. Being that cs-method is generally GET POST HEAD PUT DELETE something like this might work.
HOWEVER. I think doing this will nullQueue the entire event because of the match.
[iis*]
TRANSFORMS-set = dropcsmethod
Then I have /etc/system/local/transforms.conf like this:
[dropcsmethod]
REGEX = (GET|POST|HEAD|PUT|DELETE)
DEST_KEY = queue
FORMAT = nullQueue
I used something similar to this to nullQueue traffic with loadbalancer noise in it, and it /dev/null's the whole line.
So..I am converting my answer to a comment.. and watching for someone smarter to come along and bang out a 1 line answer for you.
... View more
09-27-2016
06:52 AM
So I'm guessing the 4.3 universal forwader on the site is not old enough?
https://www.splunk.com/page/download_track?file=4.3/windows/splunkforwarder-4.3-115073-x86-release.msi&platform=Windows&architecture=x86&version=4.3&product=universalforwarder&typed=release&name=windows_installer
... View more
09-27-2016
06:45 AM
It might not solve for the WHY but it will fix the issue. If you are not concerned with what the null's are.
index=main | timechart count by level usenull=f
If you are not concerned with what the null's are.
... View more
09-25-2016
09:17 AM
We basically use the methods described here
http://blogs.splunk.com/2013/10/18/iis-logs-and-splunk-6/
Might you be able to simply blacklist cs-method in the inputs, once the field is identified and named?
blacklist1=cs-method=*
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-29-2022
02:03 PM
|
