Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About omuelle1
omuelle1
Communicator
Member since:
08-26-2015
03-26-2024
Community Statistics
| Posts | 79 |
| Solutions | 6 |
| Karma Given | 22 |
| Karma Received | 6 |
| Member Since | 08-26-2015 |
Activity Feed
- Posted Mask a field in props.conf on Knowledge Management. 03-19-2024 07:15 AM
- Got Karma for Re: Why is my Azure Event Hub not sending data?. 04-18-2023 04:45 PM
- Posted Re: Why is my Azure Event Hub not sending data? on Getting Data In. 04-18-2023 08:37 AM
- Posted Why is my Azure Event Hub not sending data? on Getting Data In. 04-04-2023 07:36 AM
- Got Karma for Restart Splunk Inputs through API Call. 11-04-2020 01:43 AM
- Posted Restart Splunk Inputs through API Call on Splunk Dev. 07-22-2020 08:22 AM
- Karma Re: Sourcetype on SH overwriting config on HF for solarboyz1. 06-05-2020 12:50 AM
- Karma Re: Splitting up one data source into two indexes in O365 for gcusello. 06-05-2020 12:50 AM
- Karma Re: Splitting up one data source into two indexes in O365 for oscar84x. 06-05-2020 12:50 AM
- Got Karma for Re: How to pass variable or token from subsearch to search. 06-05-2020 12:50 AM
- Karma Re: Why is the O365 add-on failing to refresh access tokens? for ehollima. 06-05-2020 12:49 AM
- Karma Re: Subsearch to sum two fields by a common field for elliotproebstel. 06-05-2020 12:49 AM
- Karma Re: How to break multiple values into a new row ? for harsmarvania57. 06-05-2020 12:49 AM
- Karma How to break multiple values into a new row ? for rsokolova. 06-05-2020 12:49 AM
- Karma Re: How to index data where the timestamp is not on every line or at the the beginning of a line? for gcusello. 06-05-2020 12:48 AM
- Karma Re: Moved indexed data to different mount - not seeing it for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to display the first 3 lines of an event that has triggered an alert? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to display the first 3 lines of an event that has triggered an alert? for MattZerfas. 06-05-2020 12:48 AM
- Karma Re: When making changes to .conf files in a distributed environment, how do I make sure changes get pushed to indexers and forwarders? for esix_splunk. 06-05-2020 12:48 AM
- Karma Re: Reindex Duplicates / Reindex duplicate data for nabeel652. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
05-11-2017
06:13 AM
1 Karma
We figured it out, we are using regex for the field and put in spaces, which breaks everything up just like we need it:
| stats list(size) as "size" list(ship_qty_btls) AS "ship_qty_btls" list(ord_qty_btls) AS "ord_qty_btls" list(ShortQty) as "short_qty" list(item_description) as "ITEM_DESCRIPTION" delim=":" by invoice,ship_to, email, Cust#
| rex mode=sed field=ITEM_DESCRIPTION "s/:/\n/g" | rex mode=sed field=ord_qty_btls "s/:/\n/g" | rex mode=sed field=size "s/:/\n/g" | rex mode=sed field=ship_qty_btls "s/:/\n/g" | rex mode=sed field=short_qty "s/:/\n/g"
| rex mode=sed field=ITEM_DESCRIPTION "s/ /_/g"
... View more
05-05-2017
09:37 AM
I have not, but it is correct in the Splunk WebUI also as PDF attachment, just in the HTML email body Splunk seems to screw it up.
... View more
05-05-2017
08:50 AM
1 Karma
Hi Splunkers and Happy Friday
I am trying to put together an email that looks something like this:
However when I have several ITEMs for an Invoice the QTYs and other fields do not go to a new line like in the my original search in Splunk but look like this:
The underlying search is this:
| fields - _raw, _time
| stats values(ITEM) values(ITEM_DESCRIPTION) list(SHIPPED_QTY_BTLS) list(ORDER_QTY_BTLS) list(PACKQTY) list(SHIPPED_DATE) by INVOICE_NUMBER,SALESPERSON,EMAIL,SHIP_TO
| rename "values(ITEM)" AS "ITEM" "values(ITEM_DESCRIPTION)" AS "ITEM_DESCRIPTION" "list(SHIPPED_QTY_BTLS)" AS "SHIPPED_QTY_BTLS" "list(ORDER_QTY_BTLS)" AS "ORDER_QTY_BTLS" "list(PACKQTY)" AS "PACKQTY" "list(SHIPPED_DATE)" as "SHIPPED_DATE"
Would anybody know how to get this to have any value in the their own row and not right after each other?
Thank you very much guys,
Oliver
... View more
02-21-2017
08:35 AM
I know, just made typo..
... View more
02-21-2017
08:10 AM
Sorry I did mean index.conf, so I want to create a new index and have it index that data?
... View more
02-21-2017
07:50 AM
Hi,
I was running out of space due to large volume of vmware data that we are indexing and I had to move the data to a different mount. I changed in index.conf where the data is being indexed and moved all the db folders (hot,warm,cold) and hot folders to the new mount as well. However when running a search the old data is being ignored, can you somehow force the index to reindex data it already indexed before?
Oliver
... View more
02-10-2017
11:34 AM
Could you guys also help to me how get the *O (It can be any 2 characters) but always at that same position. I tried the same thing you guys told me, but the skipping doesn't work, I assume because there is space in between.
00012220 *O082017020900024800000000q0025047000011000000009000000009000000001000000000000000000
... View more
02-10-2017
06:59 AM
Thank you guys, I will need to improve my regex skills since the Field Extractor barely works.
How would I modify the regex if there is white space after the 6 digits?
Like it doesn't match for this case:
00012220 *O082017020900024800000000q0025047000011000000009000000009000000001000000000000000000
... View more
02-10-2017
06:41 AM
Got you, check out this. Seems like they had a similar problem as you have right now:
https://answers.splunk.com/answers/69820/search-to-only-include-business-hours-and-exclude-weekends.html
... View more
02-10-2017
06:08 AM
If you want this as an alert and just during working hours why not use the crontab function and there define the hours you need?
... View more
02-10-2017
06:01 AM
Hi,
you need to use inputs.conf to define the source of data that is being ingested. I see how the naming there can be confusing. If your data for that Linux firewall is forwarded, you should have inputs.conf with the source on the forwarders and the indexer.
In inputs.conf you then specify the sourcetype, so you don't have to use it again in in props.conf.
Inputs.conf:
[source::/var/log/firewall.log]
sourcetype = firewall
index = (if you don't use an index here, it will go to main)
props.conf:
[firewall]
SHOULD_LINEMERGE = True
...
..
... View more
02-10-2017
05:50 AM
Hi,
I am trying to extract a field in Splunk but the field extraction doesn't work and throws this error
"The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings."
Therefore I am trying to write the regex myself but I am not really good at regex, so I would you guys help.
I want to skip the first two number in this string and extract the upcoming 6:
0035373112473B CC002017020809521700000001r200000432 SYSTEM 201702081437521
So in this case I want my Field to contain 353731.
This is my current regex but I don't know how I can get it to skip the first two numbers.
(?<ITEM>\s*\s*K\^[0-9][0-9][0-9][0-9][0-9][0-9])
Thank you,
Oliver
... View more
- Tags:
- regex
01-19-2017
07:30 AM
Thank you, I went crcSalt = which also seems to reindex duplicates.
... View more
01-18-2017
06:34 AM
HI Splunkers,
I got a little complicated issue I cannot figure out.
Everyday I receive a host file that we index that contains 80% of that data is duplicate from the days before (same timestamp everything). Splunk goes ahead and only indexes the non duplicates, which I would usually appreciate.
However, for a specific report I need to find a setting where Splunk overwrites the old events and indexes a duplicate from the latest source.
For example:
I get event 1111 - timestamp 1-17 on 1/17 in logfile1_17.txt
on 1-18 I have the event 1111 - timestamp 1-17 in logfile1_18.txt
Now when I look for this event 1111 , I find as source logfile1_17.txt but I would need it indexed again and have source logfile1_18.txt
Is there a setting that the event 1111 is shown in splunk with the latest indexed file as source or is indexed again ?
Thanks.
Oliver
... View more
11-30-2016
06:19 AM
Thank you, I did this but it was still was indexing. Turns out the problem was on a different end:
File will not be read, seekptr checksum did not match. Last time we saw this initcrc, filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.
Once I added crcSalt to the index.conf, the files were being indexed
... View more
11-29-2016
05:50 AM
Hi,
I have an issue with data I am trying to index. I checked and the files are being monitored but I am still not seeing any data. I guess this has to with the way the data is organized.
For example not every line has a time stamp and the time stamp is not at the beginning of the line.
rum.rndcsalesforce.com - - [28/Nov/2016 07:28:03] "GET / HTTP/1.1" 200 -
LOG: -ZOMBIE: PkTaskMgmtS (exitcode:-11) pid:29053 status:starting
cleanup factories: ['TaskMgmtIFFactory:29053']
LOG: STARTED PkTaskMgmtS (#1) pid:27319 status:starting
-QUEUED: PkTaskMgmtS #Listeners:1
Started Factory TaskMgmtIFFactory via program PkTaskMgmtS
CLS Assertion failed: rc == 0, File /opt/manhattan64/coreservices/cls/5.0.11.rhel564/include/ClsLock.hpp, Line 578, TID 47196679497472, PID 22144
How would I go ahead and make my sourcetype to index this kinda data?
Thank you,
Oliver
... View more
11-29-2016
05:34 AM
HI,
I got a question about how to most efficiently change .conf settings in a distributed environment.
For example: I just made a change in my inputs.conf file for an app on my search head in the deployment apps folder. From what I remember, the indexers and forwarders should recognize that a change was made and pull the new file over. However, only the files are being changed on the forwarders, the indexers do not update the files. Any idea how to change that?
Oliver
... View more
11-03-2016
07:00 AM
Would Splunk be able to assign a timestamp based on when the data was indexed ?
... View more
11-03-2016
06:50 AM
Thank you so much for this answer, this is definitely the way I will use to ingest data from now on.
I try and figure out if there is a way to get a date into the logs from the owner of the application.
... View more
11-03-2016
05:21 AM
Good morning,
I have an issue with a new file that I am trying to index:
I see that it is being monitored but I am not getting any events from it.
Monitored Files:
/opt/tibco/scripts/nohup.out
I looked at the file and saw that it has a very odd timestamp and I think it might have to do with Splunk not being able to break that up correctly:
^[[0m^[[0m11:43:06,113 INFO [org.jboss.as] (MSC service thread 1-3) JBAS015950: JBoss EAP 6.3.0.GA (AS 7.4.0.Final-redhat-19) stopped in 1124ms
My question is what would I need change in my props.conf file to get events? Could someone maybe provide the regex and line of code I need?
Thank you,
Oliver
... View more
11-02-2016
04:51 AM
Thank you!
... View more
11-01-2016
06:26 AM
Splunkers,
I have a question regarding a report:
We made a report with 15 searches that is being to delivered to a different team once a day as a PDF. However, often times, all the searches in the report don't have any results, so we are wondering if the report can also be triggered like an alert only if it has at least one result?
So far I only came up with the idea to just make 15 individual alerts instead of a report. Is there an easier way to do this? I cannot combine all searches into one alert since I use Splunk DB Connect and query different schemas and databases in the searches.
Thank you,
Oliver
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-26-2024
01:50 PM
|
Karma from
Karma given to
