Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About dailv1808
dailv1808
Path Finder
Member since:
07-15-2016
08-11-2022
Community Statistics
| Posts | 76 |
| Solutions | 1 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 07-15-2016 |
Activity Feed
- Karma Re: Error while executing scripted input deployed from universal forwarder. for PavelP. 08-11-2022 02:24 AM
- Karma Re: How do I set _time with collect _raw? for yurykiselev. 07-17-2022 09:46 PM
- Karma Re: How do I set _time with collect _raw? for VatsalJagani. 07-17-2022 09:46 PM
- Karma Re: Copy (not move) events into another index? for shaa. 07-17-2022 09:44 PM
- Posted Re: Splunk DB Connect 3.6 Duplicate, Miss Data when sync a larger table around 1000 TPS on Splunk Search. 10-14-2021 02:23 AM
- Posted Re: Splunk DB Connect 3.6 Duplicate, Miss Data when sync a larger table around 1000 TPS on Splunk Search. 10-12-2021 08:07 PM
- Posted Splunk DB Connect 3.6 Duplicate, Miss Data when sync a larger table around 1000 TPS on Splunk Search. 10-12-2021 03:50 AM
- Tagged Splunk DB Connect 3.6 Duplicate, Miss Data when sync a larger table around 1000 TPS on Splunk Search. 10-12-2021 03:50 AM
- Tagged Splunk DB Connect 3.6 Duplicate, Miss Data when sync a larger table around 1000 TPS on Splunk Search. 10-12-2021 03:50 AM
- Posted Re: Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 09-07-2021 12:44 AM
- Posted Re: Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 09-06-2021 04:36 AM
- Posted Re: Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 09-06-2021 02:50 AM
- Posted Re: Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 09-06-2021 02:49 AM
- Posted Re: Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 08-31-2021 06:44 AM
- Posted Why are DBconnect 3 sometime unable to write records, read timed out, unable_to_write_batch on All Apps and Add-ons. 08-26-2021 12:59 AM
- Posted Re: Heavy forwarder does not forward right index from db connect 3 on Splunk Enterprise. 08-20-2021 02:43 AM
- Posted Re: Heavy forwarder does not forward right index from db connect 3 on Splunk Enterprise. 08-20-2021 12:47 AM
- Posted Re: Heavy forwarder does not forward right index from db connect 3 on Splunk Enterprise. 08-20-2021 12:17 AM
- Posted Re: Heavy forwarder does not forward right index from db connect 3 on Splunk Enterprise. 08-20-2021 12:15 AM
- Posted Re: Heavy forwarder does not forward right index from db connect 3 on Splunk Enterprise. 08-19-2021 11:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-07-2019
07:36 PM
Hi,
I have created a alert action and call to smgSend.c file.
i compiled smgSend.c to smgSend
When I run this script manually "**/bin/smgSend "hello" 01234567789**" , it works fine.
In bin directory have 2 files: smgSend.c and smgSend
content of commands.conf file in local directory below:
[smgSend]
filename = smgSend
generating = true
streaming = false
is_risky = false
i tried to run this from search:
| smgSend "hello" 01234567789
The error appear "Unknown search command 'smgsend'. "
So how can i running external C script from search, does splunk support .c script?
... View more
08-06-2019
03:34 AM
Hi everybody,
We have search result like this:
And SMS server
IP="10.10.10.1"
Port=8080
So how can we send an sms to each PHONE number
Ex message content:
HOST01 - 80% --> will send sms to 123456
HOST02 - 90% ---> will send sms to 234567
HOST03 - 90% ---> will send sms to 345678
HOST04 - 95% ---> will send sms to 456789
Thanks in advance!
... View more
01-22-2019
08:49 AM
Hi @woodcock ,
i got the same problem and solved it by set throughput maxKBps = unlimit in litmits.conf file.
So Can you explain why the throughput make loss data?
https://imgur.com/a/BUmw9z2
... View more
01-22-2019
07:39 AM
I see following INFO notice in splunkd.log
"INFO ThruputProcessor - Current data throughput (262 kb/s) has reached maxKBps. As a result, data forwarding may be throttled. Consider increasing the value of maxKBps in limits.conf."
Then, i set maxKMps=unlimit, the problem have solved.
But I dont know why. Can y explain for me?
More info: The UF is monitoring the file is rotate. filename.log have new content added to them and rotate around 5-10 minute to filename.log.1, filename.log.2, vv...
... View more
01-21-2019
10:46 PM
Hi,
I checked the log file in the directory of the host installed UF. Some events have not been collected to splunk.
Data generated on UF is very large and continuous. I don't know exactly how much per day.
... View more
01-21-2019
08:34 PM
Thank for your reply.
I want to know the exact source of the problem when I do not use the Index ACK. Why lost data?
Did Forwarder get too much data, cause a queue to overflow make lost data? OR other reason vv....
... View more
01-21-2019
03:08 AM
Hi Splunker!
i am using a universal forwarder to monitor and forward data (log file) to my Splunk. i have observed a loss of data...I.e. certain events are missing.
What is recommended to avoid any data loss during this period?
is there is any way to acknowledge whether complete data is being sent by the forwarder ??
... View more
06-12-2018
12:42 AM
Yes. Thank you so much!
... View more
06-08-2018
10:09 PM
I have a sample event log below:
2018-05-04 06:59:50 AAA="1", BBB="2", CCC="3", XXX="70029", ZZZ="2018-05-04 00:00:00"
Splunk will automatically get "2018-05-04 06:59:50" for _time field. But i want the _time field will be created by XXX and ZZZ fields.
like this: _time = "2018-05-04 7:00:29"
Note that I haven't permission to access to props.conf file. So how can i do it.
Any suggestion is welcomed!
Thank for advance!
... View more
05-29-2018
11:37 PM
It did work, thank you so much.
Now back to the original problem, do you know how to calculate bandwidth for each interface.
I refer to this link: https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/8141-calculate-bandwidth-snmp.html
How to calculate the formula in splunk?
... View more
05-29-2018
11:32 PM
it just split ifName field, not for ifName ifIn ifOut ifSpeed fields. I use the way of @kamlesh_vaghela and the problem is solved. Anyway, thank your help.
... View more
05-29-2018
07:11 PM
Thank you so much, i replaced and it work fine.
And I want to add new collunm for bandwidth of each interface. like this:
time | ifName |ifIn | ifOut | ifSpeed | bandwidth_in | badwidth_out
2018-05-30 08:41:45 | Ethernet1/42 |123434342 |3123 | 100000000| 1212|789
I refer to this link,
https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/8141-calculate-bandwidth-snmp.html
How to calculate the formula in splunk?
... View more
05-29-2018
04:36 AM
Thank so much!
... View more
05-29-2018
04:35 AM
Thank @kamlesh_vaghela,
i tried, now result like this:
Ethernet1/1
Ethernet1/1
Ethernet1/1
Ethernet1/1
..........
Ok, But this problem is not really too serious.
Now i want to calculate bandwidth of each interface use ifName ifIn ifOut ifSpeed fields. Do you know how to do it? i get snmp log with interval = 1m.
... View more
05-29-2018
03:51 AM
yes, thank you. LINE_BREAKER did work fine when created props.conf file for sourcetype. Now timestamp is incorrect, how can i config to correct timestamp?
... View more
05-29-2018
03:22 AM
Many thank FrankVI
I tried again but it still not work i dont know why. You can check my screenshot image link below:
https://imgur.com/a/3ByhMTn
... View more
05-29-2018
03:18 AM
oh, y understood wrong my mind because my english is not good. so i mean, listed by order appears interfaces in the log, not sort by interface name. example:
I want to be like:
Ethernet1/1
Ethernet1/2
Ethernet1/3
Ethernet1/4
Ethernet1/5
Ethernet1/6
Ethernet1/7
Ethernet1/8
Ethernet1/9
Ethernet1/10
Ethernet1/11
Ethernet1/12
Not like this.
Ethernet1/1
Ethernet1/10
Ethernet1/11
Ethernet1/12
..........
Ethernet1/19
Ethernet1/2
Ethernet1/21
Ethernet1/22
....vv
... View more
05-29-2018
02:45 AM
1 Karma
why are you so smart. yeah, it's work. But it doesn't arranged in the correct order of the interface list. so What need i to do to sort by interface name as order in log.
https://imgur.com/a/QN89Jqg
... View more
05-29-2018
01:56 AM
nice idea, i tried but it didn't work
https://imgur.com/a/Fu3hGbv
... View more
05-29-2018
01:36 AM
i used snmp input to collect. screenshot of raw event at link below.
https://imgur.com/a/4AJLy0m
I think need to split event to multi event first
... View more
05-29-2018
01:20 AM
1 Karma
I have the following search result which has multiple values in a cell:
I would like to split table to raws. look like:
Time | ifName | ifIn | ifOut | ifSpeed
2018-05-29 15:0514 | mgmt0 | 2725909466 | 445786495 | 1000000000
2018-05-29 15:0514 | Vlan1 | 2739931731 | 807226632 | 1000000000
2018-05-29 15:0514 | Vlan30 | 925889480 | 694417752 | 1000000000
2018-05-29 15:0514 | Vlan100 | 925889308 | 694418432 | 1000000000
v.v
Thanks,
... View more
05-29-2018
12:35 AM
i extracted field using this command on search
| rex max_match=0 "IF-MIB::ifName.\"\d+\"\s=\s\"(?\S+)\""
| rex max_match=0 "IF-MIB::ifInOctets.\"\d+\"\s=\s\"(?\w+)\""
| rex max_match=0 "IF-MIB::ifOutOctets.\"\d+\"\s=\s\"(?\w+)\""
| rex max_match=0 "IF-MIB::ifSpeed.\"\d+\"\s=\s\"(?\w+)\""
| table _time, ifName, ifOutOctets, ifInOctets, ifSpeed
... View more
05-29-2018
12:33 AM
my screenshot image https://imgur.com/a/rsRA7fb
... View more
05-29-2018
12:33 AM
Thank a lot for your reply. I understood your idea, but there are many interface in each event. So how can i calculate bandwidth on each interface on 1 event? OR how to split 1 event into multi event with just one interface ? sorry my english really not good. plz see my screenshot to understand my meanning. !
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-11-2022
06:10 AM
|
