Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About shangshin
shangshin
Builder
Member since:
04-20-2012
02-14-2022
Community Statistics
| Posts | 179 |
| Solutions | 0 |
| Karma Given | 45 |
| Karma Received | 28 |
| Member Since | 04-20-2012 |
Activity Feed
- Got Karma for sort by Time desc. 09-06-2023 08:20 AM
- Posted Re: SAML SSO on Splunkv8.2.4 on Security. 02-14-2022 10:43 AM
- Posted SAML SSO on Splunkv8.2.4 on Security. 02-10-2022 10:46 AM
- Posted Re: Role: Limit access to one host of one index on Security. 02-04-2021 06:14 AM
- Karma Re: Is there a REST API to get info in Splunk Web Access Controls » Authentication method » LDAP strategies » LDAP Groups ? for fdi01. 06-05-2020 12:47 AM
- Karma Re: Cluster info from master using REST API for dxu_splunk. 06-05-2020 12:47 AM
- Karma Re: DBQUERY correlation -- How to join results from DB for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to get LDAP group name by using query or REST API? for MuS. 06-05-2020 12:47 AM
- Karma Re: Is there a way to access the Splunk Web UI using curl? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Add-on Debug Refresh: Is there a command to only refresh a certain endpoint? for MuS. 06-05-2020 12:47 AM
- Karma Re: Report v.s. Alert, what's the difference? for jrodman. 06-05-2020 12:47 AM
- Karma Re: How to configure props.conf to filter out events with CTRL-M (^M)? for jeremiahc4. 06-05-2020 12:47 AM
- Karma Re: How to configure props.conf to filter out events with CTRL-M (^M)? for jrodman. 06-05-2020 12:47 AM
- Karma Re: Is it possible to have multiple alert conditions for one saved search? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Cluster info from master using REST API. 06-05-2020 12:47 AM
- Got Karma for DBQUERY correlation -- How to join results from DB. 06-05-2020 12:47 AM
- Got Karma for Splunk query discrepancy. 06-05-2020 12:47 AM
- Got Karma for Report v.s. Alert, what's the difference?. 06-05-2020 12:47 AM
- Got Karma for Report v.s. Alert, what's the difference?. 06-05-2020 12:47 AM
- Got Karma for Report v.s. Alert, what's the difference?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 1 |
05-29-2012
01:49 PM
I have 2 fields, start_time and end_time in the search result. When I change the time window in the search bar, it only takes effects on the start time because splunk thinks start_time is the event time.
Simply put, if the eventdata has 2 timestamps, how can I ask splunk search to use the second one as the event time?
Thanks!
... View more
05-29-2012
01:31 PM
here is the complete sample roq in web access log
10.39.208.2 - clinet_user_id [29/May/2012:14:04:10 -0400] "POST /amazon.com/view.do HTTP/1.1" 200 1214 "google.com" "Java/1.5.0_06"
As you can, the field of method, url and protocol can be extracted out as a single value using the first stanza (my_fields). However, the second stanza (method_url_protocol) is unable to parse the value. I guess I didn't set it up properly...
... View more
05-29-2012
01:15 PM
yes, that's right. In props.conf,
[access_log_reg]
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-myfields = my_fields
... View more
05-29-2012
01:05 PM
1 Karma
[my_fields]
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user_id]]\s++[[sbstring:req_time]]\s++[[qstring:method_url_protocol]]\s++[[nspaces:status]]\s++[[nspaces:bytes]]\s++[[qstring:referer_url]]\s++[[qstring:useragent]]
[method_url_protocol]
DELIMS = " "
FIELDS = method, url, protocol
Hi,
I define these 2 stanzas above in transforms.conf and expect to extract some info from web access log. As you can see the sample quoted string below, it contains 3 fields. However, these 3 fields are not extracted our successsfully. Can you shed some light on it?
"POST /amazon.com/view.do HTTP/1.1"
... View more
- Tags:
- transforms.conf
05-22-2012
12:36 PM
Cool. Thanks!
One last question -- Where can I find the definition of the reg strings. e.g. nspaces, sbstring, etc
REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++[[nspaces:user]]\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]
]\s++[nspaces:bytes]?[[al
l:other]]
... View more
05-22-2012
09:51 AM
Can the script take parameters?
e.g.
foo.sh arg_1 arg_2 arg_3
Splunk runs the script from $SPLUNK_HOME/bin/scripts/
... View more
- Tags:
- script
05-21-2012
01:48 PM
Thank you! I probably didn't ask my question properly. Let me try to rephrase my question. When I installed splunk, I can see 2 sourcetypes for common apache log files -- acceess_common and access_combined_cookie.
Since my apache log format is coutomized, I have to create the regular expression myself.
This part is time consuming and it will be great if I can reuse old transforms.conf.
My sample eventdata
[21/May/2012:11:50:16 -0400] 10.39.208.3 "my-user-id" "libwww-perl/5.77" GET HTTP/1.1 "http://www.amazon.com" "?search-alias%3Daps&field-keywords=ipad+3&sprefix=ipad%2Caps%2C210" 200 495 0
... View more
05-18-2012
11:15 AM
I noticed there are 2 default sourcetype for apache log. However, we are using a different format in out apache web server. (see Logformat below). I assume I need to use regular expression in transforms.conf. Is that correct? If yes, where can I see the default sample so I can create the right kv fields in transforms.conf. Thanks!
%t %h \"%{Proxy-Remote-User}i\" \"%{User-Agent}i\" %m %H \"%U\" \"%q\" %>s %b %T
... View more
05-15-2012
11:46 AM
Thanks for the advice. I followed your instruction and see all the data is available on one server. I assume by adding a peer server, I am able to search data across distributed splunk server.
However, lookup fields or sourcetype created on distributed server won't be visiable on the local server. Is that correct?
... View more
05-15-2012
09:12 AM
Hi,
I installed splunk on 2 servers, e.g. abc and xyz and I am able to access it from http://abc:8000/ and http://xyz:8000/
So the question is how can I perform a search on http://abc:8000/ and the search universe including both abc and xyz.
I tried to enter splunk_server=xyz on http://abc:8000/ but no data is returned. Thanks!
... View more
- Tags:
- distribute
- search
05-15-2012
08:09 AM
good answer. Thanks!
... View more
05-15-2012
05:23 AM
I added a sourcetype, weblogic_access_log , with its customized field ( wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcat_access_log with a different customized field e.g. tomcat_kv_and_fields . How could I define it in transforms.conf? Hope I am understood. Thanks!
in props.conf
[weblogic_access_log]
REPORT-myfields = wl_kv_and_fields
in transforms.conf
DELIMS = "\t"
FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
... View more
- Tags:
- props
- transforms
05-08-2012
12:06 PM
I scheduled a report to email the result to my email address and have this line below:
Link to results: http://mylinuxhost:8000/app/search/@go?sid=scheduler__admin__search__Test_at_1336502700_b41e213b0b8a7dc0
However, I just realised I need to add the domain to make the link work. e.g.
http://mylinuxhost.domain.com:8000/
How can this be done?
I tried to change the splunk server name in general settings but the link in email doesn't change.
mylinuxhost -> mylinuxhost.domain.com
... View more
- Tags:
05-08-2012
07:58 AM
Good anwser. Thanks!
Assuming the lookup csv file contains the customer's associated firm. e.g.
customer_id, customer_name, customer_firm
jsmith,John Smith,Google
What will be the search string to see top 10 users' name and firm?
The search below will display name, count, percentage.
sourcetype="access_common" | top customer_name
... View more
05-07-2012
01:04 PM
Hi,
I would like to upload a csv file as a lookup table. what will be header format?
Assuming I have a search field called customer_id. So jsmith means John Smith.
Can you use this as an example to provide a one line csv file?
I trtied jsmith, John Smith
but didn't work out.
Thanks!
... View more
- Tags:
- lookup
05-01-2012
07:06 AM
Hi, thanks for the reply.
I entered the search string below but didn't find the result as a new field "myloc". I also clicked on the link "View all 14 fields" but still no luck.
sourcetype="sample_xml" | spath output=myloc path=vendorproductset.product.desc.locdesc{1}{@locale}
Can you upload a screenshot if possible?
Basically, we would like to use splunk to monitor a dynamic xml file and trigger the alert if the element value matches.
... View more
04-26-2012
01:26 PM
I am following the example to add the sample xml "vendorProductSet" as the new search data.
However, when I entered the string string
sourcetype="sample_xml" | spath path=vendorProductSet.product.desc.locDesc{4}{@locale}
I didn't not see it extracts the attribute of the 4th locDesc (ca)
Instead, I got the whole xml returned from search result.
Am I missing anything?
... View more
04-26-2012
11:39 AM
Hi, I would like to use Splunk to parse xml and json data files and trigger the alert if the element "checked" is false. I would appreciate if you can provide an example on how to set up the field extractors for these 2 data type. Thank You!
[{
"text": "Products",
"cls": "folder",
"expanded": true,
"children": [{
"text": "iPad",
"leaf": true,
"checked": true
},{
"text": "iPhone",
"leaf": true,
"checked": false
},{
"text": "iPod",
"leaf": true,
"checked": true
}
]
}]
... View more
04-24-2012
11:54 AM
This is exactly what we need!!! Many thanks.
Now the backend is set up. One quick question for the search operator:
When should I add the operator AND
Result is returned as expected:
sourcetype="weblogic_access_log" proxy_remote_user="my_user_id"
No result is returned:
sourcetype="weblogic_access_log" and proxy_remote_user="my_user_id"
... View more
04-24-2012
10:17 AM
Thanks a lot. field extractor for status code is GOOD! But strangely, time_taken doesn't seem to work because nothing is returned from the search.
I also tried to create the index for the user_id on column 4 using
EXTRACT-wl_userid = ^\S+\s+\S+\s+\S+\s+(? \S+)\s+
I would apprecaite if you can shed some light on this so we can demonstarte a usful product.
... View more
04-23-2012
09:25 AM
It's a weblogic access log file and the column headers are
date time c-ip cs(proxy-remote-user) cs(user-agent) cs-method cs-uri-stem cs-uri-query sc-status bytes time-taken
We would like to get alerts if status code (sc-status) is not 200 or time-taken is greater than 90 seconds. This is a real use case and I would appreciate if you can provide an example of field extractor.
... View more
04-23-2012
08:41 AM
Thanks -- Kristian.
I followed example in the docs page and tried to add a new error code field. However, I got the error message when hitting the save button. Can you shed some light on this or provide a sample for this real use case?
Encountered the following error while trying to save: In handler 'props-extract': cannot find transform name=device_id=[w+](?<err_code>[^:]+)
... View more
04-23-2012
08:06 AM
1 Karma
Hi, I would like to search status=304 or 500 in web server's access log but the search result is empty.
Here is one sample line in the access log. Any advice? Thanks in advance!
2012-04-23 10:56:51 10.39.19.101 "user_D" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; InfoPath.2)" GET /ask/faq.html - 304 0 0.0010
... View more
- Tags:
- search
04-23-2012
07:24 AM
problem solved. Thanks!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-14-2022
08:06 PM
|
Karma from
