Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About prakash007
prakash007
Builder
Member since:
11-27-2018
06-01-2022
Community Statistics
| Posts | 220 |
| Solutions | 13 |
| Karma Given | 2 |
| Karma Received | 39 |
| Member Since | 11-27-2018 |
Activity Feed
- Posted Re: Configure Universal forwarder 8.1.0 to send data over HTTP on Splunk Enterprise. 06-01-2022 11:14 AM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 11-03-2021 09:28 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 08-25-2021 10:29 PM
- Got Karma for Re: Splunk Dashboard autorefresh all panels. 08-20-2021 12:56 AM
- Got Karma for Re: What are your Splunk t-shirt ideas?. 07-07-2020 02:47 AM
- Got Karma for Do we need a license for Heavy forwarder..?. 06-24-2020 01:28 PM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 06-05-2020 12:51 AM
- Karma Re: Can you help us with the following "expandtoken" error?: "field larger than field limit (131072)" for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Defining Timestamp for HEC Input. 06-05-2020 12:50 AM
- Got Karma for Re: can't read "splunkdestinationip_withrd": no such variable. 06-05-2020 12:50 AM
- Got Karma for Re: How do I set dashboard to fast mode?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use regex on 2 fields and combine them into one field for an xyseries?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?. 06-05-2020 12:50 AM
- Got Karma for Re: How to push out an indexer bundle after rebuilding a server?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me extract the information I want from the following JSON data (mvzip, mvindex, split)?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 |
01-28-2016
07:59 PM
I have a search scheduled to send an email alert when count > 10 in an hour timespan.
index=webserver sourcetype=web_logs loglevel=error | stats count by user | where count > 10
let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?
If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?
... View more
01-21-2016
07:21 PM
Check your splunkd.logs and metrics.log if you can find any errors.
... View more
01-21-2016
12:17 PM
I would definitely try this on a Indexer, i thought we also have this ability to do on Heavy forwarder. Appreciate your help..!!
... View more
01-21-2016
11:41 AM
Thanks much Jplumsdaine and skoelpin...it's working
index=main sourcetype=server.log | rex field=_raw (?P(?<=product_name=)\".*(?=quantity)) max_match=0 | table Products _raw
can you please let me know how i can break this events using props.conf on a heavy forwarder...?
... View more
01-21-2016
10:22 AM
nope it's not separate event, it's a single multiline event.
... View more
01-21-2016
09:21 AM
1 Karma
This regex is working fine, but i'm having the same issue, it's just looking up the first product_name in the entire log.
The raw log which i have is a single log under a single timestamp, it's only capturing the first product leaving the rest of the products bought by the single customer.
... View more
01-21-2016
08:52 AM
1 Karma
This has a pretty good explanation....
https://answers.splunk.com/answers/238355/what-are-the-definitions-of-tag-and-eventtype-and.html
... View more
01-21-2016
08:42 AM
1 Karma
somehow it's not working and also the actual format is
product_name="jersey T shirt, black"
I'm sorry i have made some changes to raw log(given product instead product_name)due to confidentiality. Do we need to make any tweaks for the above format...?
... View more
01-21-2016
07:55 AM
1 Karma
Thanks skoelpin, this regex is creating a new filed product, but it's displaying the entire log starting form product
"Crochet Pencil, Blush" quantity="1" service_code="XXX" gift_wrap_code="" price_each="XXX.00" tax_each="XX.XX" other_each="0.00" freight_each="0.00" duty_each="0.00" markdown_each="," arrive_by_date="" buy_now_gift_later_flag="N" promotion_code="," promotion_key="XXXXX," gift_message1="" gift_message2="" gift_message3="" gift_message4="" gift_message5="" current_status="" current_status_date="" tracking_number="" giftcard_email="" store_fulfill_flag="N" reporting_code="" pickup_store_number="" selected_replenishment_interval="" replenishment_contract_id="" shipto_store_number="" dynamic_image_url="" facility_ID="" line_discount_amount="" employee_store_call="" special_instruction_flag="" special_instruction_price="" selection_set_id="" bogo_proration=""/>
... View more
01-21-2016
07:18 AM
yes i'm referring to auto field discovery which splunk applies....i have the raw log if you can help me with regex...
<line_item registry_id="" transaction_type="A" item_id="" item_id="56 7h78789" sku_id="skuxxxxx" catalog_id="HJH78" catalog_item="KJDN78" Ksku_id="xxxxxxxxx" product="Crochet Pencil, Blush" quantity="1" service_code="XXX" gift_wrap_code="" price_each="XXX.00" tax_each="XX.XX" other_each="0.00" freight_each="0.00" duty_each="0.00" markdown_each="," arrive_by_date="" buy_now_gift_later_flag="N" promotion_code="," promotion_key="XXXXX," gift_message1="" gift_message2="" gift_message3="" gift_message4="" gift_message5="" current_status="" current_status_date="" tracking_number="" giftcard_email="" store_fulfill_flag="N" reporting_code="" pickup_store_number="" selected_replenishment_interval="" replenishment_contract_id="" shipto_store_number="" dynamic_image_url="" facility_ID="" line_discount_amount="" employee_store_call="" special_instruction_flag="" special_instruction_price="" selection_set_id="" bogo_proration=""/>
<line_item registry_id="" transaction_type="A" item_id="" item_id="56 7h7980" sku_id="skuxxxxx" catalog_id="HJH78" catalog_item="KJDN78" Ksku_id="xxxxxxxxx" product="Jersey T-Shirt, Black" quantity="1" service_code="XXX" gift_wrap_code="" price_each="XXX.00" tax_each="XX.XX" other_each="0.00" freight_each="0.00" duty_each="0.00" markdown_each="," arrive_by_date="" buy_now_gift_later_flag="N" promotion_code="," promotion_key="XXXXX," gift_message1="" gift_message2="" gift_message3="" gift_message4="" gift_message5="" current_status="" current_status_date="" tracking_number="" giftcard_email="" store_fulfill_flag="N" reporting_code="" pickup_store_number="" selected_replenishment_interval="" replenishment_contract_id="" shipto_store_number="" dynamic_image_url="" facility_ID="" line_discount_amount="" employee_store_call="" special_instruction_flag="" special_instruction_price="" selection_set_id="" bogo_proration=""/>
<line_item registry_id="" transaction_type="A" item_id="" item_id="56 7h78876" sku_id="skuxxxxx" catalog_id="HJH78" catalog_item="KJDN78" Ksku_id="xxxxxxxxx" product="T-shirt, Blue" quantity="1" service_code="XXX" gift_wrap_code="" price_each="XXX.00" tax_each="XX.XX" other_each="0.00" freight_each="0.00" duty_each="0.00" markdown_each="," arrive_by_date="" buy_now_gift_later_flag="N" promotion_code="," promotion_key="XXXXX," gift_message1="" gift_message2="" gift_message3="" gift_message4="" gift_message5="" current_status="" current_status_date="" tracking_number="" giftcard_email="" store_fulfill_flag="N" reporting_code="" pickup_store_number="" selected_replenishment_interval="" replenishment_contract_id="" shipto_store_number="" dynamic_image_url="" facility_ID="" line_discount_amount="" employee_store_call="" special_instruction_flag="" special_instruction_price="" selection_set_id="" bogo_proration=""/>
... View more
01-20-2016
09:29 AM
Thanks for the reply, i didn't extract this field using props.conf, it's auto key-value pair which is shown in the fields. in this situation it's showing only first 2 items under product
... View more
01-20-2016
08:54 AM
2 Karma
I need some help to figure out how to extract or make sure all the products were shown.
index=main sourcetype=appserver custid=xbhfhsls | table products
It's showing only a couple of products, but in the log, we see the customer has purchased multiple products.
... View more
01-05-2016
11:17 AM
Got it.. Thanks much..!!
... View more
12-05-2015
07:29 AM
I have a Heavy Forwarder installed which sends the logs to Splunk Cloud. Here's the workflow, please shed some light on this....
UFs-----> HWF ----->Splunk clould indexers
-data is flowing into the cloud and searchable, but when I tried to place some filtering on the HWF using props.conf and transforms.conf, it's not filtering.
-I want to drop the events which contain keyword POST...
Here're the configs I have used...
HWF=========
outputs.conf
indexAndFoward = false (not sure if I have to make it true for filtering and i don't want to index data locally/ filtering didn't work though even when it's true)
props.conf
[source::/path/to/my/apache/logs/access*.log] or I also tried with sourcetype in here [apache_access]
TRANSFORMS-null = filter_diagnose, filter_scalars
transforms.conf
[filter_diagnose]
REGEX =`\"POST\s\/.*diagnoseMonitor`
DEST_KEY = queue
FORMAT = nullQueue
[filter_scalar]
REGEX = `\"POST\`s\/.*`Scalar.html
DEST_KEY = queue
FORMAT = nullQueue
=====================================================================
I have also tried this way using key words to filter.
props.conf
[source::/path/to/my/apache/logs/access*.log] or I also tried with sourcetype in here [apache_access]
TRANSFORMS-set= setnull, setparsing
transforms.conf
[setnull]
REGEX = POST
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue
... View more
12-02-2015
05:16 PM
Thanks for the explanation...i still have a question..
for the search below, you said it's extracting substring out of uri_path..here're the field values for uri_path.
/viewcart , /updatecart, /updateitem...etc
Is it necessary to extract a substring, if it's how does it work...can you please explain..
| eval action=substr(uri_path,2)
create a new field action by extracting a substring out of the field uri_path from the second char
... View more
11-30-2015
08:44 PM
Can anyone please explain this search? It's for average request execution:
index=main sourcetype=access_combined OR sourcetype=log4j
| eval action=substr(uri_path,2)
| eval action=lower(if(isnull(action),requestType,action))
| eval JSESSIONID=if(isnull(JSESSIONID),sessionId,JSESSIONID)
| transaction threadId, JSESSIONID, action maxspan=1m
| stats avg(duration) AS Avg_Request_Execution_Time
... View more
11-27-2015
08:52 AM
I have given this query and it's just giving me avg(count) in the output, i'm looking for both count and avg(count) per day in the output.. any help would be appreciated. Thanks.
index=main host=src* source=ihs* | stats count by date_mday | stats avg(count)
... View more
- Tags:
- splunk-cloud
11-25-2015
12:50 PM
index=main host=wrs* domain=zzz* | stats count as daycount by date_mday | eventstats avg(daycount)
when i use run the above command for past 7days...i see different values for daycount which is expected, but i'm getting same values for avg(daycount) for all 7 days....can you explain me how it works...??
... View more
11-22-2015
05:34 AM
I got the expected output. Thanks much jedatt01.
... View more
11-21-2015
10:17 PM
Any help would be much appreciated here..
Here's my search:
index=main host=host1* source=*server.log* "exception" | stats count, values(instance) by host
I'm getting this output:
host count values(instance)
host1 1073 ins1
ins2
ins3
host2 1021 ins2
ins3
I'm looking for output with unique values for each instance, your help would be appreciated:
host count values(instance)
host1 1000 ins1
70 ins2
3 ins3
host2 1000 ins2
21 ins3
... View more
- « Previous
- Next »
