Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About rajgowd1
rajgowd1
Communicator
Member since:
10-06-2016
06-05-2020
Community Statistics
| Posts | 144 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 14 |
| Member Since | 10-06-2016 |
Activity Feed
- Got Karma for Re: How can we find size of events in a particular duration?. 10-18-2024 09:58 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 10-18-2022 05:09 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 08-04-2022 10:11 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 01-06-2022 03:49 PM
- Got Karma for Re: How can we find size of events in a particular duration?. 11-22-2021 03:37 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 03-10-2021 03:57 PM
- Got Karma for How to write a validation expression for a macro?. 07-22-2020 03:56 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 06-29-2020 05:02 AM
- Got Karma for Any search examples for displaying a flame graph visualization?. 06-05-2020 12:48 AM
- Got Karma for Re: How to write a regular expression to extract key value pairs from my sample event?. 06-05-2020 12:48 AM
- Got Karma for Re: What is the regular expression for my sample events?. 06-05-2020 12:48 AM
- Got Karma for Re: How to write a search to find the the 90th and 99th percentile for response time?. 06-05-2020 12:48 AM
- Got Karma for How can we find size of events in a particular duration?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we find size of events in a particular duration?. 06-05-2020 12:48 AM
- Posted Re: Help extracting a value from this log? on Splunk Search. 11-08-2017 02:37 PM
- Posted Help extracting a value from this log? on Splunk Search. 11-08-2017 11:23 AM
- Tagged Help extracting a value from this log? on Splunk Search. 11-08-2017 11:23 AM
- Posted Re: how to connect to SPLUNK server from SPLUNK ODBC driver using LDAP authenticated user on Splunk Dev. 02-21-2017 10:26 AM
- Posted how to connect to SPLUNK server from SPLUNK ODBC driver using LDAP authenticated user on Splunk Dev. 02-20-2017 01:41 PM
- Posted Re: How to display column chart based on events count and display events size in bytes, KB, MB, and GB? on Splunk Search. 02-08-2017 12:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-22-2016
10:26 AM
1 Karma
thank you.you are genius.regular expression and extract both are working as expected
... View more
11-22-2016
09:31 AM
Hi Sundaresh,
when i try index=myindex | rex "([^"]+)":"([^"]+)
getting error like Mismatched ']'. but the same expression is working in regex101
am i missing any here?
... View more
11-22-2016
08:47 AM
Hi,
We have events which contain key value pairs separated by a colon : .
Here is the sample event:
<6>2016-11-22T16:29:37Z v26l5klvoo3 doppler[21]: {"cf_app_id":"19351f6f-d125-4322-88ed-926e8f578e16","cf_app_name":"nam-rds-gpu-drag-payment-mq","cf_org_id":"d58e8896-6150-4f89-806b-c28464ba7e22","cf_org_name":"NAM-US-verizon","cf_origin":"firehorse","cf_space_id":"52223ed6-a3c5-4955-a6f8-be6c9649e215","cf_space_name":"RDS-DEV1","event_type":"LogMessage","level":"info","message_type":"OUT","msg":"[2016-11-22 16:29:37,017] DiscoveryClient-CacheRefreshExecutor-0 (DiscoveryClient.java:1064) DEBUG - Got delta update with apps hashcode UP_45_","origin":"rep","source_instance":"0","source_type":"APP","time":"2016-11-22T16:29:37Z","timestamp":1479832177017862007}
Key value pairs are with in curly brackets { }
Example: cf_space_name":"RDS-DEV1" this is one key value pair
Can you please help us to write a regular expression for the above sample event.
... View more
11-21-2016
11:08 AM
Hi,
thank you.can you please provide steps to implement using [batch://] option.
... View more
11-21-2016
09:12 AM
Hi,
we have a forwarder installed in different VM's and have log files like 2016-11-01 to 2016-11-21 and all them are indexed.
every month's end, i need to clean up logs from date 01 to 15.
how can i achieve this in Splunk? do we need write a custom script and configure cronjob in Splunk machine?
it would be great, if you provide any different thoughts to achieve this.
... View more
11-17-2016
08:14 PM
Thank you.actually i am extracting Time from events.
i am able to make it work and here is the search
index=myindex source="/logs/app/" host="$drophost$" | reverse | rex field=_raw "^(?[^,]+),(?[^,]+),(?.)" | search Time="$timerange$" | stats list(Contents) as Contents by Host Time | table Time Host Contents
... View more
11-17-2016
03:24 PM
Hi,
i have created dashboard with 2 dropdowns based on host and based on Time Range. When select host it is working but not Time Range.
i am populating values by using this search and i can see the values in search
index=myindex source="/logs/app/*" | rex field=_raw "^(?[^,]+)" | dedup Time | table Time
and here the main using for displaying results in table format
index=myindex source="/logs/app/*" host="$drophost$" Time="$timerange$" | reverse | rex field=_raw "^(?[^,]+),(?[^,]+),(?.*)" | eventstats latest(Time) as current | where current=Time |stats list(Contents) as Contents by Host Time |table Time Host Contents
any help is appreciated.
... View more
11-17-2016
01:50 PM
Thanks Sundaresh i used reverse function,now events are displaying properly
... View more
11-17-2016
10:07 AM
Hi,
with the search you provided,i am able to get the latest events.
when i do difference manually i see like below
Thu Nov 17 08:30:44 2016,vm-b1fc-d5b5,51d50
Thu Nov 17 08:30:44 2016,vm-b1fc-d5b5,< #HAOnly = 1;
but
when i run the search in splunk with in table,i see it in reverse order like below
Thu Nov 17 08:30:44 2016 vm-b1fc-d5b5 < #HAOnly = 1;
51d50
do you have any thoughts on this
... View more
11-17-2016
05:22 AM
Hi,
thank you.i can use top command to display but i am not sure whether latest events are like 10 lines or 5 lines.
here is the sample events
this is difference stored in a file sometime ago
Tue Nov 16 16:23:45 2016,dm-a1fc-d5d3, VirtualToken00Label = CABOL-HA;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 16:23:45 2016,dm-a1fc-d5d3,VirtualToken = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 16:23:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 16:23:45 2016,dm-a1fc-d5d3, ServerHtl01 = 0;
here is the difference stored in a same file recently
Tue Nov 16 18:20:45 2016,dm-a1fc-d5d3, CBOL-HA = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 18:20:45 2016,dm-a1fc-d5d3,HASynchronize = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 18:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 18:20:45 2016,dm-a1fc-d5d3, VirtualToken00Members = 157803010,155322014;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 16 18:20:45 2016,dm-a1fc-d5d3, VirtualToken00SN = 1157803010;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
... View more
11-16-2016
08:27 PM
1 Karma
Thank you,i am able do field extraction using delimiter and i will try this also
... View more
11-16-2016
08:23 PM
Hi,
we have 2 configuration files like spg.conf and spg.conf.1162016 and we written perl program to find the difference between these 2 files and perl program is running under cron.
we are storing the difference in one file and indexing it. i would like to display recent changes to configuration files and show them in table format.
below is the sample data
this is difference stored in a file sometime ago
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00Label = CABOL-HA;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,VirtualToken = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, ServerHtl01 = 0;
here is the difference stored in a same file recently
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, CBOL-HA = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,HASynchronize = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00Members = 157803010,155322014;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00SN = 1157803010;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
i would like to show only recent data in table format. any help is appreciated
... View more
11-16-2016
03:38 PM
HI,
i am trying to extract the last field using field extractor but its not working. can anyone help me to write regex for below sample events?
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, HAOnly = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, haLogStatus = enabled;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, logLen = 10485760;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, haLogPath = /logs/luna;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,HAConfiguration = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, CBOL-HA = 1;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,HASynchronize = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00Members = 157803010,155322014;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00SN = 1157803010;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, VirtualToken00Label = CBOL-HA;
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,VirtualToken = {
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3,}
host = dm-a1fc-d5d3 source = /logs/conf/2016-11-15 sourcetype = systemdefault:hdmapp
Tue Nov 15 19:20:45 2016,dm-a1fc-d5d3, ServerHtl01 = 0;
... View more
11-15-2016
10:00 AM
hi,
I have data like below and extracted fields hostname ,logname and data. By using these and existing defaults fields, I'm trying to create a dashboard with good representation.
Mon Nov 14 23:51:31 2016,vm-a1fc-d5f5,/var/log/messages,key,Nov 14 23:23:59 vm-21dd-d4f2 ssh-server-g3: 702 Auth_methods_completed, Username: kal, Auth methods: publickey, Src IP: xxx.xxx.xxx.xxx, Src Port: 53370, Ver: SSH-2.0-OpenSSH_5.8, Session-Id: 70
I used the searches below to create some tables. It would be great if someone help with dashboard searches:
index=pub_cto_luna_hsm | stats list(data) by hostname logname |rename list(data) as Data
index=pub_cto_luna_hsm | chart values(data) by hostname logname
... View more
11-08-2016
08:39 AM
Hi Giuseppe,
when use the search index=changemgmt sourcetype=config_file | diff diffheader=true | highlight +,-
sometimes showing modified changes but sometimes not.do you have any idea why its behaving like this.
... View more
11-08-2016
08:38 AM
Hi Giuseppe,
when use the search index=changemgmt sourcetype=config_file | diff diffheader=true | highlight +,-
sometimes showing modified changes but sometimes not.do you have any idea why its behaving like this.
... View more
10-17-2016
10:01 AM
I am trying to search /var/log/messages log with keywords like shutdown or Error and storing it in message.log
and doing index on message.log
I have a log around at 5 mins ago like 11:30 AM EST says system is shutdown and I displayed this error log in a table format.
Around at 11:40 AM EST, when I ran search command in a table format, I see SYSTEM is Shutdown, but we already knew that system is down at 11:30 AM EST and now I don't want to see this message again.
How can we achieve this?
... View more
10-17-2016
08:43 AM
Hi Ravan,
i tried your suggestions and when i try to search and getting below error
index=netstat [|hsmsys]
Error in 'hsmsys' command: Cannot find program 'hsmsys' or script 'hsmsys'.
... View more
10-16-2016
10:27 AM
Hi Ravan,
i implemented custom search command and followed steps u mentioned in your comments.
here is my script which retrieve IP's and store it it file
!/bin/bash
configPath="/home/splunk/config"
cat ${configPath}/sample.conf | grep ServerName | awk '{print $3}' | cut -f1 -d';' > ${configPath}/devices.txt
cat devices.txt
169.172.202.13
poc-citi-luna1.nam.ns
169.172.202.14
i placed this script under $SPLUNK_HOME/etc/your_app/bin and created commands.conf file under local directory
cat commands.conf
[hsmsys]
file = txt2csv.sh
and refresh the app via mentioned url by changing hostname in url
when i run index=netstat [|hsmsys]
getting error like
Error in 'hsmsys' command: Cannot find program 'hsmsys' or script 'hsmsys'.
not sure if i miss any here.
i have fewdoubts here
how to update my script in future or day to day basis to load new IP's?
whatever the script i have,will it work here?
... View more
10-15-2016
11:12 AM
Hi Ravan,
thanks for your response.
my requirement is how to pass host names or IPADDRESS to search query
i have 3 hostnames names in my txt file and it might more like 6 to 7 IP's
169.172.202.123
169.172.202.124
169.132.202.114
something like
index=test_idx source=/var/log/messages ERROR OR Error OR error OR IP1 OR IP2 OR IP3
... View more
10-15-2016
07:31 AM
i am trying to search some strings like Error OR WARNING and IPADDRESS or HOSTNAME from /var/log/messages file and display the content as events
index=test_idx source=/var/log/messages ERROR OR Error OR error
i have host names and IPADDRESS are available in txt file called hostnames.txt and is available under /home/splunk
169.182.202.153
169.152.202.143
i am retrieving these IP's from config file and storing it in text file.there is a chance to add Ip's on daily basis.
how to pass IPADDRESSES to search command including with Error OR Warning
... View more
- Tags:
- splunk-enterprise
10-14-2016
10:31 AM
HI Giuseppe,
I just tried this search below, it says Unknown search command 'index' .
index=test_index source=/home/splunk/config/simple.conf [index="test_idex" sourcetype=conf | diff diffheader=true]
So then I tried this search:
index=test_index source=/home/splunk/config/simple.conf [search index=test_index source=conf| diff diffheader=true]
but it is not showing any results.
[subsearch]: command="diff", pos1=1 is out of bounds
... View more
10-14-2016
09:24 AM
HI Giuseppe,
Thank you so much. I tried the configuration which you provided and tried all search commands. Everything is working as expected.
Do I need to restart the Splunk instance if I make any changes in inputs.conf file?
When I try this command
index=changemgmt sourcetype=config_file | diff diffheader=true | highlight +,-
it is showing the events like below
--- fschangemonitor
+++ /home/splunk/config/Chrystoki.conf
@@ -1 +1,8 @@
-Fri Oct 14 12:07:01 2016 action=update, path="//home/splunk/config/Chrystoki.conf", isdir=0, size=1627, gid=500, uid=500, modtime="Fri Oct 14 12:06:25 2016", mode="rw-rw-r--", hash=F6D1B2512F5F32A1357A1CE7B16888A54C26CDC6AA7C0A17EFE6FF3DC3130AFE, chgs="modtime hash "
+Luna = {
+ DefaultTimeOut = 200000;
+ PEDTimeout1 = 100000;
+ PEDTimeout2 = 100000;
+ PEDTimeout3 = 10000;
+ KeypairGenTimeOut = 2700000;
+ CloningCommandTimeOut = 300000;
+}
is it possible to show only the content with good representation?
... View more
10-13-2016
11:08 AM
Yes I am new to splunk and just got trained 1 week back.and I am trying to explore and reading more.
Actually I have written a script to find the latest file which is modified recently and from the same script I am calling another script which gives you difference between new and old files.and then redirecting to sample text file.
So I am just trying is there a way to implement the same in splunk.
Sorry for the trouble if my question is wrong.
... View more
10-13-2016
10:55 AM
sorry for the confusion.
my question is
is it possible to monitor the file on file SAVE.
and once the file is saved,is it possible to find the difference between old and new file.
and
finally i want to show the difference in XML format.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
