About nmohammed

nmohammed · ‎01-23-2017

Thanks. I tried hunters approach and referenced only one stanza ,but still doesn't work. [sm] TRANSFORMS-hostextract=hostextract arkadzy1 - we are assigning sourcetypes based on the respective sources - inputs.conf [monitor:\\share\sm\sm-expt] disabled = false whitelist = .txt$|.log$ index = sm sourcetype = sm-expt [monitor:\\share\sm\sm-impt] disabled = false whitelist = .txt$|.log$ index = sm sourcetype = sm-impt [monitor:\\share\sm\sm-plat] disabled = false whitelist = .txt$|.log$ index = sm sourcetype = sm-plat [monitor:\\share\sm\sm-vend] disabled = false whitelist = .txt$|.log$ index = sm sourcetype = sm-vend Not really sure , where we're going wrong. The regex looks fine when tested and the logs are using log4net type of logging format. we have just assigned different sourcetypes for ease in identifying different applications.

nmohammed · ‎01-20-2017

we're trying to set the host fields by extracting the name from the events, but it doesn't seem to work and would appreciate if someone can guide through - example events - 2017-01-20 14:18:55,816 [31] ep7mmn001 ERROR SMS.Shared.ApiCommon.Attribute.smapiAuthorizeAttribute at System.Convert.FromBase64_Decode(Char* startInputPtr, Int32 inputLength, Byte* startDestPtr, Int32 destLength) at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength) at System.Convert.FromBase64CharArray(Char[] inArray, Int32 offset, Int32 length) at Newtonsoft.Json.JsonTextReader.ParseString(Char quote) at Newtonsoft.Json.JsonTextReader.ParseValue() 2017-01-20 14:18:55,816 [31] ep8mmn002 ERROR SMS.Shared.ApiCommon.Attribute.smApiAuthorizeAttribute Invalid length for a Base-64 char array or string. 2017-01-20 14:18:55,816 [31] ep8mmn006 ERROR SMS.Shared.ApiCommon.Attribute.smApiAuthorizeAttribute Invalid length for a Base-64 char array or string. props.conf [sm-plat] TRANSFORMS-hostextract=hostextract [sm-expt] TRANSFORMS-hostextract=hostextract [sm-impt] TRANSFORMS-hostextract=hostextract [sm-vend] TRANSFORMS-hostextract=hostextract transforms.conf [hostextract] REGEX = ^[^\]\n]*\]\s+(\w+) FORMAT = host::$1 DEST_KEY = _MetaData:Host Thanks

nmohammed · ‎01-06-2017

There is no event between 1/6/17 2:47:47.263 PM and 1/6/17 3:02:45.401 PM . So if you're running timechart with average on QUEUE_COUNT, there's no value for QUEUE_COUNT in your events during the above time frame, hence it is showing no values. This could be the case every time you running the search that timechart misses some values due to missing data/events during a time frame.

nmohammed · ‎01-06-2017

try using this - | rex field=_raw "^(?[^|].+)|(?[^|].+)|" | table f01, f02

nmohammed · ‎01-06-2017

hi Vikram_m, can you try using the extension event-publisher extension ... https://www.appdynamics.com/community/exchange/extension/event-publisher-extension/

nmohammed · ‎01-06-2017

try to delete the registry entry for the universal Forwarder on the server - should be here... HKEY_CLASSES_ROOT\Installer\Products\ look at each entry and you should see the product Name as Universal Forwarder, right click on the entry and delete it. that should uninstall the Forwarder.

nmohammed · ‎01-05-2017

You're seeing the old data from that IP ? what kind of data is it , syslog and Is it sending data continuously ?

nmohammed · ‎12-28-2016

Thanks Avsnarayan, this solution worked fort me as well. Splunk DB connect is installed on a RHEL 6.7 server and was trying to connect to MS SQL server on Windows. the jTDS driver worked over the driver available from Microsoft (still giving errors).

nmohammed · ‎06-29-2016

Was able to get the desired results. First I changed the field name in the DC-Clients.csv lookup file from clientid to Enc.clientid and saved it. So the new DC-Clients.csv file contents look like this: contents of DC-Clients.csv Actual Clientid,Enc.clientid 018587,018587 033839,033839 Then the in the search, I used the field Enc.clientid that matches the field in the data model as follows ... New search: | tstats count FROM datamodel=Enc groupby _time span=1d, Enc.clientid | search [| inputlookup DC-Clients.csv | fields + Enc.clientid] tstats produces results much faster than the original search I was using. Thanks..!!!

nmohammed · ‎06-29-2016

I am trying to produce report to get total usage based on time and clientid from a lookup. Here is the regular tstats search: | tstats count FROM datamodel=Enc groupby _time span=1d, Enc.clientid The above search gives results for all the clientids in the particular index, but I need results for only a list of clientids which is in the DC-Clients.csv I tried the following, but doesn't produce any results: | tstats count FROM datamodel=Enc groupby _time span=1d, Enc.clientid | search [| inputlookup DC-Clients.csv | fields + clientid] Example contents of DC-Clients.csv Actual Clientid,clientid 018587,018587 033839,033839 I need to filter results to produce a report for only the clientids in the CSV file. Any suggestions appreciated. Thanks..!!!

nmohammed · ‎05-10-2016

I have two drop-downs: one for clientid and another one for the host. While I am running a regex real-time to pull the host field, as it is not extracted due to the log inputs being from a single shared location. The host field should get populated based on the clientid selected in the first drop-down, also doesn't restore the defaults. I am attaching the XML. Encompass Service Review Dashboard Application and Infrastructure Performance <input type="time" token="time" searchWhenChanged="false"> <label>Select Time Range</label> <default> <earliestTime>-15m</earliestTime> <latestTime>now</latestTime> </default> </input> <input type="dropdown" token="clientid"> <label>Select Client ID</label> <choice value="*">All</choice> <search> <query>| inputlookup clientid.csv | dedup clientid | eval c = clientid+" - "+client_name | table c, clientid | sort c</query> <earliest>-1d@d</earliest> <latest>@d</latest> </search> <fieldForLabel>c</fieldForLabel> <fieldForValue>clientid</fieldForValue> </input> <input type="dropdown" token="span" searchWhenChanged="false"> <label>Select Time Intervals</label> <choice value="5m">5 Minutes</choice> <choice value="15m">15 Minutes</choice> <choice value="30m">30 Minutes</choice> <choice value="1h">1 Hour</choice> <choice value="1d">1 Day</choice> <choice value="30d">1 Month</choice> <choice value="1m">1 Minute</choice> <choice value="30s">30 Seconds</choice> <choice value="1s">1 Second</choice> </input> <input type="dropdown" token="host" searchWhenChanged="true"> <label>Server</label> <search> <query>index="e_logs" clientid=1111111 earliest=-1d@d | rex field=source "Server.[A-Za-z0-9]*.(?P<host>[^\.]+)" | stats count by hostr</query> <earliest>0</earliest> <latest></latest> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <choice value="*">All</choice> </input> <panel> <chart> <title>CPU Utilization</title> <search> <query>index="perfmon" sourcetype="Perfmon:CPUTime" host=$host$ | bucket _time span=$span$ | timechart avg(Value)</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> <panel> <chart> <title>Memory Utilization</title> <search> <query>index=perfmon sourcetype="Perfmon:Memory" counter="Committed Bytes" host=$host$ | eval AMB=Value/(1024*1024) |bucket _time span=$span$ | stats avg(AMB) as "Used(MB)" by _time | appendcols [search index=perfmon sourcetype="Perfmon:Memory" counter="Available MBytes" host=$host$ | bucket _time span=$span$ | stats avg(Value) as "AvailableMem(MB)" by _time] | table _time, AvailableMem(MB), Used(MB)</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> <panel> The second drop-down is the server field, which is not working. Based on this the : <label>Server</label> <search> <query>index="e_logs" clientid=111111 earliest=-1d@d | rex field=source "Server.[A-Za-z0-9]*.(?P<host>[^\.]+)" | stats count by host</query> <earliest>0</earliest> <latest></latest> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <choice value="*">All</choice> </input> <panel> The charts for CPU and Memory are based on this "host" field that gets populated in the drop-down. I am unable to get it dynamically passed in the CPU and Memory charts , as the perfmon data is from a different index and the host field is coming from a different index. Please advise on this. Appreciate your help.!!!

nmohammed · ‎05-10-2016

HI Cramasta, Sorry was out for while, But I did try this, still not working.

nmohammed · ‎04-28-2016

tried this.. still doesn't work [hostFromSource] SOURCE_KEY = MetaData:Source REGEX=EmpServer.[A-Za-z0-9]*.([^.]+) FORMAT = host::$1 DEST_KEY= MetaData:Host

nmohammed · ‎04-28-2016

I tried this.. did not work. transforms.conf [hostFromSource] SOURCE_KEY = MetaData:Source REGEX=EmpServer.[A-Za-z0-9]*.([^.]+) FORMAT = $1 DEST_KEY= MetaData:Host Let me try the updated one

nmohammed · ‎04-28-2016

I tried this out, but did not work in props and transforms settings with regex. It works with rex in search though. Props.conf: [source::/emp_logs*/.../*.log] TRANSFORMS-hostFromSource=hostFromSource transforms.conf : [hostFromSource] SOURCE_KEY = MetaData:Source REGEX=EmpServer.\w+.(\w+) FORMAT = $1 DEST_KEY= MetaData:Host and here is the rex search which worked in over-riding the host field index="emp_logs" | rex field=source "EmpServer.[A-Za-z0-9]*.(?P[^.]+)"

nmohammed · ‎04-22-2016

Thanks cramasta, all my log files are of the same format. the clientid and hostname in the source changes. /emp_logs-sc9/loaner/DE123456/EmpServer.DE123456.SC9VEABE1092.2014-04-13-11.log. DE123456 is actually the clientid but in the fourth segment "EmpServer.DE123456.SC9VEABE1092.2014-04-13-11.log" the hostname is SC9VEABE1092. This is what we want to replace the host field with.

nmohammed · ‎04-22-2016

Hi, I am trying to extract the field from the log file path which includes the actual host. currently, the host field is populated with the third segment of the log file path that is the clientid field. But what we want is the actual host name . we are currently indexing from a shared mount which is the reason not able to capture the actual host name Example source field with log file name /emp_logs-sc9/loaner/DE123456/EmpServer.DE123456.SC9VEABE1092.2014-04-13-11.log. current host field - DE123456 expected host field - SC9VEABE1092 can someone guide me, how to achieve this? Thanks

nmohammed · ‎04-07-2016

I am running in the same issue. But we have the logs written on the CIFS share which are mounted onto Linux servers. I am running Splunk UF on these servers, that are monitoring the logs from this mount. we are seeing a great delay in the events being searchable (~3 hours delay until the data is searchable) Not sure where the delay is happening, either on Splunk UF monitoring the files or Indexing by indexers. can you please advise what can be done in this scenario? CIFS ---> Mount on Linux ---> Splunk UF ---> indexers ---> Data Searchable in SH

nmohammed · ‎03-25-2016

can we use the Vormetric Security Intelligence app for splunk 6.3.x ? I don't see any updates since 2013.

nmohammed · ‎03-10-2016

Awesome ..!! worked as expected. Thanks again SomeSoni2.

nmohammed · ‎03-10-2016

SomeSoni2, I tried this filter with other query using tstats.. the filter just doesn't work when I am trying to get results for entire day .. | tstats count(ABC.SlowCalls) as SlowCalls count(ABC.Calls) as Calls count(ABC.Errors) as Errors count as Total FROM datamodel=ABC where (sourcetype=info OR sourcetype=error) ABC.clientid=1122337 ABC.transaction_name=* groupby _time span=1h | eval qual = round(((Total-Errors)/Total)*100, 3) | eval Perf = round((1-(SlowCalls/Calls))*100, 3) | eval date_hour=tonumber(strftime(_time,"%H")) | eval date_wday=lower(strftime(_time,"%A")) | where NOT (_time=22) OR ((date_wday="wednesday" OR date_wday="friday") AND date_hour<2) OR ((date_wday="saturday") AND date_hour>=16) OR ((date_wday="sunday") AND date_hour<4))) SlowCalls, Calls, Errors are a calculated fields of the datamodel "ABC" . It works perfectly if I use span=1h at with tstats , but If I change to span = 1d from span=1h , it doesn't filter the events for maintenance windows. This is a report for one client, but I will do it for multiple clients and would essentially run daily with data in a day and not per hour. Is there any other way to specify span or override it ? Thanks

nmohammed · ‎03-09-2016

We are trying to run our monthly reports faster , for that we are using data models and tstats . This is my original query, which would take days to run if I want monthly reports .. \ (sourcetype=error OR sourcetype=info client=*) |bucket _time span=1h | stats count as Total count(eval(sourcetype=="info")) as Calls count(eval(sourcetype=="error")) as Errors count(eval(exec_time_ms > 3000)) as Heavy by _time, client | eval QoS = round(((Total-Errors)/Total)*100, 3) | eval Perf = round((1-(Heavy/Calls))*100, 3) we have implemented data models with acceleration and I have re-written the query using tstats : | tstats count(ABC.exec_time) as exec_time FROM datamodel=ABC WHERE (sourcetype=error OR sourcetype=info) ABC.client=11222333 groupby _time span=1h |bucket _time span=1h | stats count as Total count(eval(sourcetype=="info")) as Calls count(eval(sourcetype=="error")) as Errors count(eval(exec_time > 3000)) as SlowCalls by _time | eval Performance = round((1-(SlowCalls/API_Calls))*100, 3) | table _time, Performance The above query does not display any results for performance column in the table. Can someone help me identify, if something is wrong and needs correction?

nmohammed · ‎03-07-2016

Actually, I pasted it wrong in the reply.., I was using the filer correctly, but had to change eval date_wday = (strftime(_time,"%A")) to eval date_wday = lower(strftime(_time,"%A")) and it worked. |tstats avg(ABC.exec_time) as exec_time FROM datamodel=ABC where sourcetype=abc groupby ABC.transaction, ABC.client, _time span=1h | eval date_hour=tonumber(strftime(_time,"%H")) | eval date_wday = lower(strftime(_time,"%A")) | where NOT NOT (_time=22) OR ((date_wday="wednesday" OR date_wday="friday") AND date_hour<2) OR ((date_wday="saturday") AND date_hour>=16) OR ((date_wday="sunday") AND date_hour<4))) | bucket _time span=1h |stats avg(exec_time) as "Response Time" by _time, ABC.transaction, ABC.client

nmohammed · ‎03-07-2016

SomeSoni2, I tried to work this out with tstats and data models . But it again doesn't exclude filters. I am able to see all the hours. |tstats avg(ABC.exec_time) as exec_time FROM datamodel=ABC where sourcetype=abc groupby ABC.transaction, ABC.client, _time span=1h | eval date_hour=tonumber(strftime(_time,"%H")) | eval date_wday = strftime(_time,"%A") | where NOT (_time=22) OR ((date_wday="wednesday" OR date_wday="friday") AND date_hour<2) OR ((date_wday="saturday") AND date_hour>=16) OR ((date_wday="sunday") AND date_hour<4))) | bucket _time span=1h |stats avg(exec_time) as "Response Time" by _time, ABC.transaction, ABC.client

nmohammed · ‎02-22-2016

Ran the report again with the new updated query (NOT) condition . It worked perfectly, validated the results. Thank you so much Somesoni2.

Posts	156
Solutions	10
Karma Given	6
Karma Received	27
Member Since	‎03-02-2015

Online Status	Offline
Date Last Visited	‎07-10-2025 11:23 AM

Split JSON array into individual events on HF

timestamp assignment not working ELB logs Splunk A...

Splunk query to find amount of data purged based o...

distsearch.conf is overridden after updating throu...

Regex in props.conf doesn't work

How do you mask values using SEDCMD in payload emi...

Why is tstats command with eval not working on a p...

How do you create an alert for different cron sch...

Help with Masking data

whitelist directories inputs.conf

Re: How to configure setting the host field during...

How to configure setting the host field during ind...

Re: Why does using "timechart" result in missing v...

Re: Split pipe delimited line into named columns

Re: SplunkWeb and Splunkd monitoring

Re: Why am unable to uninstall Splunk universal fo...

Re: I can't see my logs in splunk(linux)

Re: Splunk DB Connect 2: Why am I getting "This dr...

Re: How to combine tstats with inputlookup?

How to combine tstats with inputlookup?

Drop-down not populating with right values based o...

Re: extract field from the source's file path and ...

Re: extract field from the source's file path and ...

Re: extract field from the source's file path and ...

Re: extract field from the source's file path and ...

Re: extract field from the source's file path and ...

extract field from the source's file path and make...

Re: Splunk reindexing files when using remote shar...

can we use the Vormetric Security Intelligence app...

Re: tstats and using timechart not displaying any...

Re: tstats and using timechart not displaying any...

tstats with stats eval condition not displaying an...

Re: Run a monthly Performance report excluding mai...

Re: Run a monthly Performance report excluding mai...

Re: Run a monthly Performance report excluding mai...

Are you a member of the Splunk Community?