About gajananh999

gajananh999 · ‎07-14-2014

Which App?

gajananh999 · ‎07-11-2014

Yes if the event doesn't come in 2 hour then i have fire a alert.

gajananh999 · ‎07-11-2014

Whenever i am scheduling alert the option for time range is 1) Every hour 2) every day kind of thing but there is no every two hour option where i have to do this conf files?

gajananh999 · ‎07-11-2014

Thanks Renems. Can you elaborate this i am not able to get the | eval appserver="WebSphere" | sort num(gap) D | head 1 | rangemap field=gap low=0-300 default=severe

gajananh999 · ‎07-11-2014

Thanks for your reply but when there is alert we can schedule for 2 hours in splunk.?

gajananh999 · ‎07-11-2014

Dear All, We are using splunk for monitoring purpose. We are pulling data from multiple application We want fire an alert suppose if i wont get the one statement in particular log file. I get a one event at every two hour so whenever i get that event i get a alert. But my requirement is different if i wont get this event in 2 hours then i have to get a alert . Can anybody help me how to get this done? Thanks Gajanan Hiroji

gajananh999 · ‎07-04-2014

Thanks Ayn.

gajananh999 · ‎07-04-2014

Hello Everyone, I have events like 02-Jul-2014 09:25:25 AM: ========== Finish Transmit Process ========== 02-Jul-2014 09:25:25 AM: AA Proc for AttachmentTransmission 02-Jul-2014 09:25:25 AM: AA Software (Axway Synchrony) version is not setup in ESM Schema in table EDI_TYPE_CD. Default version of EDI Software is 4.2 02-Jul-2014 09:25:25 AM: AA Service Login to 'AA' Database with UserID 'AA' Successfully 02-Jul-2014 09:25:23 AM: ========== Start Transmit Process ========== So i want to find out the Time which is take by process to complete its task. So here it will be 02.02 sec Thanks Gajanan Hiroji

gajananh999 · ‎06-19-2014

Hello Mus Sorry I am not getting (?i)(?P \w+-\d+:\s+\w+\s+\w+\s+\w+) this gives me ORA-1034: ORACLE not available ORA-28000: the account is this result which is giving wrong result and (? ORA-.+) its say invalid regex: syntax error Please guide me once again

gajananh999 · ‎06-19-2014

Thanks for reply This is working perfectly fine when we do using search but when trying to do using field extractor with this regex \s(? ORA-.+) its say invalid regex: syntax error

gajananh999 · ‎06-19-2014

Dear All, I have oracle error data i need to extract some fields from it here is the data [EntID: ] 17-Jun-2014, 07:55:39:586, [10], UserId: , Exception DetailsMessage ORA-1034: ORACLE not available Stack Trace [EnterpiseID: ] 17-Jun-2014, 07:55:25:373, [11], UserId: , Exception DetailsMessage ORA-28000: the account is locked Stack Trace Here i neeed to extract ORA-1034: ORACLE not available and ORA-28000: the account is locked but i am not able to get the proper regex for this. Thanks Gajanan

gajananh999 · ‎06-18-2014

Dear All, We have installed some forwarders on windows machine and made them as deployment client and we want to know all the reports of forwarder on deployment server (Including the version of the forwarder is installed) How to get these type of information. Thanks in Advance. Gajanan

gajananh999 · ‎06-18-2014

I have to put this into transform.conf file? and how about the 0 success, 0 failed, 1 skipped ? let me try this in putting into transform.conf file

gajananh999 · ‎06-18-2014

Dear All, I working on some oracle data logs. So i am able to extract some fields but i am not able to extract some of fields can anybody help on this. here is my data 17-Jun-2014, 07:42:02 >> General Email > MR: 9 Emails Processed. 0 Success, 9 Failed. 17-Jun-2014, 07:43:01 >> General Fax > CR: 0 Faxes Processed. 0 Success, 0 Failed. 17-Jun-2014, 07:47:02 >> Bulk Report E2b > E: 23 reports processed. 0 success, 0 failed, 23 skipped. 17-Jun-2014, 07:47:02 >> Bulk Report E2b > E: 1 reports processed. 0 success, 0 failed, 1 skipped. 17-Jun-2014, 07:51:11 >> Audit Log Update > "D:\a\s\p.exe AG Audit Log Update Audit Log Update" stopped. Here i want to extract below fields 1) No of Emails Processed. 2) No of Success 3) No of Failed 4) No of Fax processed 5) No of Reports Processed Thanks Gajanan

gajananh999 · ‎06-12-2014

But this will not show Server_IP on right side of the graph as agenda and x-axis values will get also changed it will show only _time not the actual value how it shows in timechart

gajananh999 · ‎06-10-2014

This is my log file Timestamp Event 5/22/14 10:32:15.000 AM [2014-05-22T05:02:15.000+00:00] [oracle] [NOTIFICATION:1] [] [] [ecid: 00^sq] [tid: 1604] [36007] Loading repository. Here it show Timestamp 5/22/14 10:32:15.000 AM But the actual timestamp is 2014-05-22T05:02:15.000+00:00 which should be 5/22/14 05:02:15.000 AM exactly 5.30 hours it is increasing for all the event what may be the reason behind this? Thanks Gajanan Hiroji

gajananh999 · ‎06-10-2014

This is my log file Timestamp Event 5/22/14 10:32:15.000 AM [2014-05-22T05:02:15.000+00:00] [oracle] [NOTIFICATION:1] [] [] [ecid: 00^sq] [tid: 1604] [36007] Loading repository. Here it show Timestamp 5/22/14 10:32:15.000 AM But the actual timestamp is 2014-05-22T05:02:15.000+00:00 which should be 5/22/14 05:02:15.000 AM exactly 5.30 hours it is increasing for all the event what may be the reason behind this? Thanks Gajanan Hiroji

gajananh999 · ‎06-10-2014

But when i try to do field extract with the same Regex it shows Regex does not extract any named fields. I tried removing last part of regex that is -\d{2}:\d{2} because it was not required for me. Am I going wrong somewhere?

gajananh999 · ‎06-10-2014

Dear all, I need your help to how to remove timestamp from this field. 2014-05-19T03:25:26.000-04:00 There is TO word in this so i want to remove that and remove the last -04:00 also. Can anybody help me on this on regular expression? Thanks Gajanan Hiroji

gajananh999 · ‎06-06-2014

Dear All, Hope Everyone is doing good. I have installed Splunk 6.0.2 earlier but as Splunk newer version is available so i want to upgrade the Splunk Its on windows machine. 1) What all things i have to do for upgrae? 2) What happenes when i upgrade Splunk 6.0.2. to 6.1? 3) What about the data will it still present on splunk? 4) What happened to users after upgrading? I need your help in this. Thanks Gajanan Hiroji

gajananh999 · ‎05-21-2014

Hello Everyone, I want to remove some lines from log file while indexing the data. my log file is like date time s-computername Client-IP cs-uri-stem cs-uri-query s-contentpath sc-status cs(Referer) sc-win32-status sc-bytes cs-bytes W3WP-PrivateBytes cs-username cs(User-Agent) time-local TimeTakenMS sc-substatus s-sitename s-ip s-port RequestsPerSecond s-proxy cs-version c-protocol cs-method cs(Host) EndRequest-UTC local date CPU-Utilization cs(Cookie) BeginRequest-UTC date BeginRequest-UTC local 10/5/2012 00:01.2 AEPLWEB2 66.249.73.41 /research/comparecars/compareAllFeatures.aspx car1=1587&car2=343&car3=&car4= E:\sites\carwale\research\comparecars\compareAllFeatures.aspx 200 - 0 8575 332 - - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) 30:01.2 9469 0 WWW.CARWALE.COM 192.168.1.15 80 0.9863 - HTTP/1.1 http GET www.carwale.com 10/5/2012 00:01.2 10/5/2012 59.09 - 10/5/2012 59:51.7 error..... 121 error......186 So Here i want to remove the lline which is starting with error and starting date which is first line . Please can anybody help me on this? Thanks Gajanan Hiroji

gajananh999 · ‎05-08-2014

Dear All, Hope Everyone is enjoying Splunking. I have one quick question. I had attended one interview morning they asked me what are different types of Searches in splunk. I didn't understood what it is can anybody tell me what is mean different types of searches? Thanks Gajanan Hiroji

gajananh999 · ‎12-17-2013

Dear All, Hope you are doing good. We are creating dashboard in splunk 6. we want to add combo-box filter on dashboard can anyone please tell me how to do this? Thanks & Regrads, Gajanan Hiroji

gajananh999 · ‎12-15-2013

Dear All, Hope you are doing good. We are creating one splunk. we need to create some forms for configuration the app. user will provide some information from where to get the data and what are fields present in it. Can anyone please tell me how to do this? Thanks Gajanan Hiroji

gajananh999 · ‎06-14-2013

Dear All I am getting the same error can anyone please help me out in this. Thanks Gajanan

Posts	138
Solutions	4
Karma Given	24
Karma Received	12
Member Since	‎12-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to get multiple Indexers Summary index data in...

How to search CSV data to filter out events with n...

Why am I not getting Dashboard in my custom naviga...

mis configure index values creating problem

What is the process to move an infrastructure from...

How to troubleshoot why a python script is running...

Splunk DB Connect: How to access data from an Orac...

Why Splunk DB Connect is not properly importing da...

How to use comparison operators in a search to mat...

Search peer USADC-xxxxx has the following message:...

Re: After downloading the "nmon" app, splunkd will...

Re: Splunk Alert

Re: Splunk Alert

Re: Splunk Alert

Re: Splunk Alert

Splunk Alert

Re: How to get the difference of time between 2 ev...

How to get the difference of time between 2 events

Re: Extract Field

Re: Extract Field

Extract Field

How to get detailed report of installed forwarder ...

Re: Not able to extract exact fields.

Not able to extract exact fields.

Re: Timechart WHERE clause not behaving as expecte...

Re: how to take timestamp from this

Re: how to take timestamp from this

Re: how to take timestamp from this

how to take timestamp from this

How to upgrade 6.0.2 to 6.1 Windows.

How to remove some event from log while indexing..

what are different types of Searches in splunk

How to add filter on dashboard

How to add configuration forms to splunk app

Re: Failed to decode 1 byte

Join the Conversation