About gcusello

gcusello

Hi @Adevill, let me understand: you inverted the positions in props.conf command, you restarted HF, you continue to receive all the lines from the HF; is it correct? One quick question: you have a multi line event or a single line event? The above approach is correct in single lines events, if instead you have a multi line events and you want to take only a part of the event, it's different. Could you share a sample of your logs (both lines to take and likes to discard)? Ciao. Giuseppe

gcusello

Hi @Adevill, please try inverting the commands in props.conf [dcs_event] TRANSFORMS-routing = dcs_drop, dcs_allow You have to put before the one containing all the logs (dcs_drop) and then the one to take the selected logs (dcs_allow) as described at https://docs.splunk.com/Documentation/Splunk/8.1.3/Forwarding/Routeandfilterdatad#Keep_specific_events_and_discard_the_rest the problem is only on props.conf, instead it isn't relevant in transforms.conf. Ciao. Giuseppe

gcusello

Hi @rahul2gupta, this is a strange behaviour of the installation procedure because the documented procedure says to stop Splunk before to start upgrading, but when you run the upgrade command, Splunk gives an error message that the system isn't running! In other words that item ("confirm ...") is related to the point that Splunk must be stopped for upgrade, and you could have (and you have to check this) an automatic restart deamon, that I never saw in my experience. Ciao. Giuseppe

gcusello

Hi @rahul2gupta, yes you have to install the Readiness App on your Search Head and also on Indexer and Heavy Forwarder if you have apps on these servers. The app gives you a report about compatibility of the installed apps with the new version of Splunk (and Python3) so you can know which apps you have to upgrade to work on the new Splunk version. About the Splunk upgrade, after you did a backup, you have to: copy the Splunk installer on the server to upgrade, run the command to update the files, if you usually use rpm it's rpm -U splunk-8.......rpm launch Splunk: /opt/splunk/bin/splunk start --accept-license the installation procedure will ask you to confirm, then it works by itself. you can find this procedure at https://docs.splunk.com/Documentation/Splunk/8.1.3/Installation/UpgradeonUNIX Remember, at the end, to configure your Splunk to run with Python3: https://docs.splunk.com/Documentation/Splunk/8.1.3/Installation/Python3LowEffort Ciao. Giuseppe

gcusello

Hi @rahul2gupta, as @richgalloway said, you have a distributed environment, so at first see the documentation at https://docs.splunk.com/Documentation/Splunk/8.1.3/Installation/HowtoupgradeSplunk and at https://docs.splunk.com/Documentation/Splunk/8.1.3/Installation/UpgradeyourdistributedSplunkEnterpriseenvironment In few words: you can upgrade in one step for each machine from 7.1 to 8.1.x, the step to follo are these: check the compatibility of your apps with the new environment using the Splunk Platform Upgrade Readiness App (https://splunkbase.splunk.com/app/4698/), backup the three machines, upgrade at first Search Head, upgrade apps; upgrade Indexer, upgrade Heavy Forwarder, test the new environment. Ciao. Giuseppe

gcusello

Hi @ibanez450, the easiest way is to use the stats command instead chart: source="hp printing" "printing" | stats eval(print_jobs) AS count by host | eval print_jobs = count/2 If the duplicated events have the same timestamp you could also use dedup before charting: source="hp printing" "printing" | dedup host _time | chart eval(print_jobs) AS print_jobs by host One final hint: use always index in your main search: your searches will be faster. Ciao. Giuseppe

gcusello

Hi @aditsss, you have to put the search for the condition out of the panel, so if you have results you display the panel , otherwise you display the html box. If you have more searches put all of them in the top of the dashboard creating a base search for each of them, eventually (if possible) grouping some of them. Ciao. Giuseppe

gcusello

Hi @MeMilo09, about the first problem there's a comma at the end of an eval command: | eval HRofstage=case(stage="SentStatus", HRStamp), About the second question, you can put the token in the part of search where you need to insert, it's better in the main search so you have less results. In addition it isn't correct to have in the secondary search <query> search | eval ... you cannot have search without arguments. Ciao. Giuseppe

gcusello

Hi @aditsss, I did it for the first panel, but you can follow my approach also for the others: <search id="my_search"> <query> index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ | fields OrgFolderName LicenseName SalesforceOrgId TotalLicenses UnusedLicensesUsedLicenses </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <progress> <condition match="'job.resultCount' == 0"> <set token="show_html">foob</set> </condition> <condition> <unset token="show_html"></unset> </condition> </progress> </search> <row> <panel> <chart rejects="$show_html$"> <title>Overall Salesforce User Licenses</title> <search base="my_search"> <query> | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ | dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">Count</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.maximumNumber">999999</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.axisY.scale">log</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">top</option> <option name="height">400</option> <option name="refresh.display">progressbar</option> </chart> <html depends="$show_html$"> No data: in search results </html> </panel> </row> Anyway, see in the Splunk Dashboard Examples App how to do this. Ciao. Giuseppe

gcusello

Hi @arusoft, sorry, no other way! If this answer solves your need, please accept it for the other people of Community. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉

gcusello

Hi @arusoft, You can view the content of a lookup: in every app, if it's shared a Global level, in its own app, if it's shared at App level. No other ways. If you can access the lookup in the app, you could export the content in your pc and upload it in your own version of the lookup, but ot's only manual. Ciao. Giuseppe

gcusello

Hi @arusoft, you have to give to your Lookup and Lookup Definition (remember of it otherwise it doesn't run!) a Global sharing and you'll see it in all your apps. Ciao. Giuseppe

gcusello

Hi @aditsss, you have to do something like the following example: <dashboard> <label>Your dashboard</label> <search id="your_search"> <query> your_search | fields your_fields </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' == 0"> <set token="show_html">foob</set> </condition> <condition> <unset token="show_html"></unset> </condition> </progress> </search> <row> <panel> <table rejects="$show_html$"> <title>Process</title> <search base="your_search"> <query> | table your_fields </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <html depends="$show_html$"> No data: in search results </html> </panel> </row> </dashboard> In few words you have to: put your search as a base search; add to the main search the condition to visualize panel or html; add the condition to your table/chart "rejects"; add the html with your message in the panel. You can find an example of this application in the Splunk Dashboard Eamples App (https://splunkbase.splunk.com/app/1603/) in the dashboard "In page drilldown with perma-linking". Ciao. Giuseppe

gcusello

Hi @termcap, as @ITWhisperer said, t he dates are in chronological order, but probably in the second search they are displayed in the order of your ingestion csv file. You can check this analyzing your csv file, probably the order that you see in you second search is the same of the csv file. If you want to order them, you can sort them. If instead you use the current timestamp, obviously they will be in index order, but if you index using current time as timestamp and you display _time and timestamp, probably you'll have the _time column ordered by time and the timestamp column in the sare order of now. Ciao. Giuseppe

gcusello

HI @arushi, could you better describe your need? if you're speaking of license comparison you can see at https://www.splunk.com/en_us/software/features-comparison-chart.html Here you can have a first idea of pricing https://www.splunk.com/en_us/software/pricing/enterprise-and-cloud.html The first question is: are you speaking of Cloud or On-premise installation? Anyway, the features are always the same, the license costs depends only one the volume of the daily indexed logs. The hardware costs (for on-premise solutions) depends on the volume of indexed logs and on the requirements of your infrastructure (HA or not, number of users, etc...). Then there could be additional costs for the Premium App if you need them (Enterprise Security or ITSI, etc...). There isn't any additional cost for the agents (universal Forwarders) and for the apps from Splunkbase. Ciao. Giuseppe

gcusello

Hi @arusoft, what do you mean with lookup from another index? lookups aren't related to index! if you're speaking of a lookup of another app, you have only to define the app and the app definition as global. could you better describe your question? Ciao. Giuseppe

gcusello

Hi @ekenne06, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉

gcusello

Hi @imam99, you if you restart the Indexers the queues will be empty and indexing will restart, but it doesn't resolve the problem. But anyway, open a case to Splunk Support at P1 level (blocked system) they usually answers in 30-60 minutes. Ciao. Giuseppe

gcusello

Hi @Dalador, if you share your search I could be more prefice. Anyway, you have to manage the absence of a field at search level, e.g. putting a fixed value for the missing fields (e.g. | fillnull arguments value="-"). Otherwise commands as stats or dedup don't consider in the search the events with a missing field. Ciao. Giuseppe

gcusello

Hi @PickleRick, these are ingest time lookups, not indexes, they are different! Anyway, consider my hint about indexes. Ciao. Giuseppe

Posts	5810
Solutions	974
Karma Given	78
Karma Received	1300
Member Since	‎01-02-2019

Online Status	Offline
Date Last Visited	5 hours ago

Hardware reference for Stream App

Integrate FireEye logs in Enterprise Security

App Developers Gadgets

more than 50,000 rows in a KV Store

using lookup editor is missing the central part

Splunk Platform Upgrade Readiness App

parsing syslogs from Tiesse systems

Host overriding on syslogs

Eventgen: is it possible to create events taking p...

break a json log

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Re: Upgrade Splunk from 7.1.x to 8.x

Re: Upgrade Splunk from 7.1.x to 8.x

Re: Upgrade Splunk from 7.1.x to 8.x

Re: Return the Count of events divided by 2

Re: How to Display a custom Message instead of "No...

Re: Creating a base search for dashboard

Re: How to Display a custom Message instead of "No...

Re: How can I use lookup csv from another Index?

Re: How can I use lookup csv from another Index?

Re: How can I use lookup csv from another Index?

Re: How to Display a custom Message instead of "No...

Re: _time being treated as a string when run with ...

Re: Need pricing and feature comparison details

Re: How can I use lookup csv from another Index?

Re: How do you handle "near real-time" alerting in...

Re: The monitor input cannot produce data because ...

Re: How to return all results if field is not exis...

Re: EVAL-based index redirection?