Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About joesrepsolc
joesrepsolc
Communicator
Member since:
12-11-2018
10-19-2020
Community Statistics
| Posts | 110 |
| Solutions | 0 |
| Karma Given | 17 |
| Karma Received | 13 |
| Member Since | 12-11-2018 |
Activity Feed
- Got Karma for Re: What are the differences between append, appendcols, and join search commands?. 12-14-2021 08:13 PM
- Got Karma for Re: What are the differences between append, appendcols, and join search commands?. 08-03-2021 06:41 PM
- Posted Re: Timeline- Custom Visualization: How do I apply colors using the resource_field bins? on All Apps and Add-ons. 10-19-2020 10:18 AM
- Posted Re: Timeline- Custom Visualization: How do I apply colors using the resource_field bins? on All Apps and Add-ons. 10-19-2020 10:17 AM
- Posted Setting host value from DB Connect SQL statement results on Getting Data In. 10-09-2020 04:17 PM
- Posted Re: Why would INDEXED_EXTRACTIONS=JSON in props.conf be resulting in duplicate values? on Getting Data In. 10-06-2020 01:46 PM
- Karma Re: Why would INDEXED_EXTRACTIONS=JSON in props.conf be resulting in duplicate values? for mattymo. 10-06-2020 01:45 PM
- Posted Re: Which properties are available for a Universal Forwarder in Props/Transforms ? on Getting Data In. 10-06-2020 01:08 PM
- Posted Re: Renaming the 'range' field from rangemap on Splunk Search. 09-24-2020 12:44 PM
- Posted Re: IP ranges in server class on Deployment Architecture. 08-10-2020 09:55 AM
- Posted Re: How to see a list of files that Splunk is currently monitoring? on Getting Data In. 07-31-2020 09:09 AM
- Posted Re: Filtering events using NullQueue on Getting Data In. 07-03-2020 12:50 PM
- Posted Re: Chart will not show all the values from my search on Splunk Search. 07-03-2020 12:45 PM
- Karma Re: Chart will not show all the values from my search for rmmiller. 07-03-2020 12:44 PM
- Posted How to eliminate x axis chart time options on Dashboards & Visualizations. 06-15-2020 08:39 AM
- Got Karma for Adding dimensions to my entities in Splunk App for Infrastructure (SAI). 06-05-2020 12:51 AM
- Karma Health warning - The percentage of small of buckets created (40) over the last hour is very high ... for goran_epl. 06-05-2020 12:50 AM
- Karma Re: Is there a way to delay splunk universal forwarder from monitoring specific files? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How to set time zone dynamically based on host name? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Monitoring for a log file - nix* for skoelpin. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-17-2019
07:54 AM
1 Karma
That worked perfectly! Thanks so much for the help, and the link. I will definitely check this out. Regex skills definitely need to be improved, but this is awesome!
... View more
07-16-2019
01:48 PM
Looking to find this value for "java.net.SocketException" and populate a new field in Splunk's interesting fields. Getting better at regex but still missing the final pieces to make this work. How to i take the string "Too many open files" and create a new interesting field named "SocketException". Could have many different values. There is also a character return after this line, so I need the value after the colon and space, to the end of the line. Should be "Too many open files" in this example
EXAMPLE OF LOG
at java.lang.Thread.run(Thread.java:748)
Caused by: java.net.SocketException: Too many open files
at java.net.Socket.createImpl(Socket.java:460)
WHAT I HAVE SO FAR:
>regex: java\.net\.SocketException:\s
Thanks so much! - Joe
... View more
06-21-2019
08:46 AM
awesome info! Thanks! Joe
... View more
06-20-2019
02:37 PM
Issues still resolved simonq?
I have this very issue on my indexer warnings... haven't dealt with it yet as I dont have a good enough understanding of the real issue. Sounds like its confusing to a lot of people too. Is increasing the maxHotBuckets on the index listed in the error the correct way to address this?
I can' change the time setting of the incoming log, and the props.conf is fine.
... View more
06-18-2019
09:11 PM
how to you get the lines in your comments/responses to start with 1., 2., 3. etc on the splunk answers site? I've tried several methods... I must be missing something.
Thanks!
... View more
06-18-2019
08:59 PM
Thank you for the full props.conf. I need to understand all these settings better and know when to use them to successfully ingest data.
Thank you again guys!
... View more
06-18-2019
08:58 PM
This worked great! Man, I really got to put the time in on regex and understand these ingestion settings in props.conf.
Datasets have been very well formatted/predefined sourcetypes lately. Out of practice.
So appreciate the help everyone.
... View more
06-18-2019
08:53 PM
,cmerriman, trying to use this solution for my dates that are already in epoch time (start and end dates). Unexpected results. Data is coming in from .csv files and date columns are a string (like “06/14/2019”) with no times. Which i am just converting to epoch time to do some math between dates. Struggling to avoid the weekend dates though. Data brought in through forwarder have all the additional date_ fields in Splunk, but not from the .csv file.
WHAT I HAVE SO FAR (calculates the days just fine, but not sure how to eliminate the weekends, and only use business days (Mon-Fri) in the results):
index=testdata
| eval TriggerDateX = strptime(TriggerDate,"%m/%d/%y")
| eval MailDateX = strptime(MailDate,"%m/%d/%y")
| eval Diff = round((MailDateX-TriggerDateX)/86400,0)
Appreciate the help. Joe
... View more
06-14-2019
07:13 AM
New data source we're bringing in from an application. Default line breaking not working correct. All of these entries are in a single event, which should be 8 events. Every new events starts with a ">" character in the 1st position. I cannot figure out what to enter in the Add Data area of the GUI for line breaks / new events. Any help would be great. Thank You!
EXAMPLE (currently 1 event, should be 8):
>Informational June 14, 2019 8:09:59 AM CDT
Transaction "Blah Blah": Job ended
>Debug June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": Directory changed to /
>Debug June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": Filtered directory listing for Directory: /
>Informational June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": Added to the pending run queue
>Informational June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": Timer created for CDTto repeat every 4 hours
>Informational June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": File moved: \secret.seq
>Informational June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": The size of the destination file secret.seq was successfully verified
>Debug June 14, 2019 8:10:00 AM CDT
Transaction "Blah Blah": Primary archiving skipped
... View more
06-10-2019
01:34 PM
Appreciate all the feedback everyone. Awesome help on the Splunk Answers site.
... View more
06-10-2019
09:58 AM
UPDATE:
The regex assistance may have helped but the issue was resolve with a Splunk support call. Evidently the props.conf/transforms.conf in my app needed to be in the /opt/splunk/etc/master-apps/ folder... not one level lower in the /opt/splunk/etc/master-apps/_cluster folder. I moved the app I had built "up" one level, and instantly started to work.
WORKED:
/opt/splunk/etc/master-apps/newApp/local/props.conf
NOT WORKED:
/opt/splunk/etc/master-apps/_cluster/newApp/local/props.conf
... View more
06-05-2019
11:03 AM
So i put the props.conf and transforms.conf in the /opt/splunk/etc/master-apps/_cluster/diplomat/local folder. and did the apply-cluster-bundle command. I see the "app" was pushed out to the indexers in the cluster (under /opt/splunk/etc/slave-apps/_cluster/diplomat/local). And even restarted the indexers manually.
Still nothing when i run this command:
/opt/splunk/bin/splunk btool props list diplomat:server --debug
And still getting the unwanted ">Debug" events ingested. What am I missing??? thanks!
Joe
... View more
06-05-2019
10:53 AM
sourcetype is case-correct. Tried that btool command, and got nothing back. I see the props/transforms on the indexers now after running apply cluster-bundle command. Maybe not restarted though... doing a rolling-restart cluster-peers now. I'll report back on outcome. Thanks!
... View more
06-05-2019
10:52 AM
Trying this now... was not aware of the special character issue with REGEX line. Thank you.
... View more
06-04-2019
03:38 PM
Trying to eliminate logs that start with ">Debug". Must be missing something with my logic.
All the data has a sourcetype=diplomat:server which I believe I've done correctly in the props, and trying to utilize the nullqueue.
I did an apply cluster-bundle after creating the new apps, see it on the indexers, and even did a rolling restart of the indexers to make sure this was in effect. Still getting the logs that start with ">Debug" though,
what did I miss???
props.conf
[diplomat:server]
TRANSFORMS-null= setnull
transforms.conf
[setnull]
REGEX = ^>Debug
DEST_KEY = queue
FORMAT = nullQueue
... View more
05-24-2019
12:50 PM
So I'm trying to build a transaction based on events I am getting from a log. I'm struggling how to set the transaction command to look for the "jobname" and grab all the events between a "Job started" event and "Job ended" event. this can vary from 2 to 12 unique event logs. So how can I tell Splunk whenever you see a "Job started" in the event, create a transaction including the events all the way up to a "Job ended" event?
|transaction jobname ?????
based on the example, jobname = "JobName ABC" (created with regex)
(event 5)Informational May 24, 2019 2:42:47 PM CDT Transaction "JobName ABC": Job ended
(event 4)....
(event 3)....
(event 2)....
(event 1)Informational May 24, 2019 2:40:17 PM CDT Transaction "JobName ABC": Job started
Thanks for any help. Joe
... View more
05-20-2019
08:35 AM
Awesome help renjith.nair
Follow-up question, how would I make a RESET function, that basically clears the dashboard and resets the tokens (like when you first load the dashboard?). Trying to add a reset link at the top of the dashboard.
Thanks in advance!
Joe
... View more
05-08-2019
09:35 AM
1 Karma
In my case, there is no separate column with this data. No ID or date/time column in the table (great...) . I have to extract that data from a column and create a new value in the SQL statement, but then I can't seem to use that new field as the column for the DB connect rising column. Is this a limitation of DB Connect's rising column feature?
Example:
select column1, column2, column3, SUBSTRING(right(column3,17)) as "DateTime"
from blahblah
where DateTime > ?
order by DateTime asc
Splunk Enterprise 7.2, DB Connect 3.13
Error:
java.sql.SQLException: Parameter #1 has not been set.
... View more
04-30-2019
11:42 AM
Working on a new data input in DB Connect with SQL Server. Date column is called "start_time" and is a 19 digit format for a date/time.
Example:
start_time = 20190206170328159
Definitiion Breakdown:
2019 02 06 17 03 28 159
yyyy MM dd HH mm ss SSS
Need it converted to a normal date/time format that Splunk can use for the timestamp. Anyone able to help with correct convert SQL statement?
Help
Thanks! Joe
... View more
04-09-2019
03:32 PM
it is case sensitive... so ALL CAPS on that _TCP_ROUTING part.
... View more
03-29-2019
07:41 AM
1 Karma
I had to editthe pass4SymmKey and restart on the deplyer.
[shclustering]
pass4SymmKey = yourKey
But I also had to do do that on the search heads too (and restart). There was no pass4SymmKey value under the shclustering stanza. There was in other parts of the file, but not under that stanza. I added that value and restarted, my apply shcluster bundle command worked just fine.
Put the apps in the /opt/splunk/etc/shcluster/apps directory on the Deployer and identify which search head is the current captain. Then run:
/opt/splunk/bin/splunk apply shcluster-bundle -target https://currentCaptain:8089
... View more
03-20-2019
07:33 AM
Thanks for the quick response. And THIS WORKED. Super cool. Thank you everyone.
... View more
03-20-2019
07:06 AM
Trying this now, but hoping that it works! Reading thru the regex you posted... interesting stuff.
Question: Why do I need the "(" and ")" parenthesis around the statement? I missed that on one of my attempts. I also missed the "$" at the end, but was doing that on the end of each file name. Hmmm. Clearly I don't know regex well enough.
... View more
