×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sarnagar
Contributor
Member since: ‎03-20-2015
‎06-05-2020
Community Statistics
Posts 95
Solutions 1
Karma Given 36
Karma Received 20
Member Since ‎03-20-2015
Activity Feed
Topics I've Started
View All

Splunk Add-on for Kafka: How to resolve multiple ...

by in All Apps and Add-ons
‎12-15-2016 04:36 AM
‎12-15-2016 04:36 AM
I can see soo many errors in splunkd.log. I am not understanding these. Could someone please guide? 12-15-2016 07:15:37.574 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic tesco-usage-demo partition 0 12-15-2016 07:15:37.576 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic jsontest partition 0 12-15-2016 07:15:37.576 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic tesco-usage-demo partition 0 12-15-2016 07:15:37.578 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic jsontest partition 0 12-15-2016 07:15:37.578 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic tesco-usage-demo partition 0 12-15-2016 07:15:37.580 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic jsontest partition 0 12-15-2016 07:15:37.580 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic tesco-usage-demo partition 0 12-15-2016 07:15:37.580 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic tesco-usage-demo partition 0 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.conn:Unable to connect to kafka broker at 10.109.136.210:9092 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" Traceback (most recent call last): 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/conn.py", line 220, in reinit 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" self._sock = socket.create_connection((self.host, self.port), self.timeout) 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/lib/python2.7/socket.py", line 571, in create_connection 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" raise err 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" error: [Errno 111] Connection refused 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:Error sending request [1] to server 10.109.136.210:9092, trying next server 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" Traceback (most recent call last): 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/client.py", line 136, in _send_broker_unaware_request 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" conn = self._get_conn(host, port) 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/client.py", line 59, in _get_conn 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" timeout=self.timeout 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/conn.py", line 64, in __init__ 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" self.reinit() 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/conn.py", line 223, in reinit 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" self._raise_connection_error() 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" File "/opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka/conn.py", line 82, in _raise_connection_error 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" raise ConnectionError("Kafka @ {0}:{1} went away".format(self.host, self.port)) 12-15-2016 07:15:39.573 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ConnectionError: Kafka @ xx.xxx.xxx.xxx:9092 went away 12-15-2016 07:15:39.575 -0500 ERROR ExecProcessor - message from "python /opt/applocal/asts/vendor/splunk/forwarder/etc/apps/Splunk_TA_kafka/bin/kafka_mod.py" ERROR:kafka.client:No leader for topic jsontest partition 0 @ ... View more

Can I generate the HTTP Event Collector token on t...

by in Dashboards & Visualizations
‎12-15-2016 04:28 AM
‎12-15-2016 04:28 AM
Where to set Splunk HTTP Event collector on which instance of Splunk? Can I generate this HTTP Event Collector token on the Heavy Forwarder or Search Head? When the application writes the data to splunk, will it write to the Heavy Forwarder? ... View more

What's the difference between Splunk Add-on for Ka...

by in All Apps and Add-ons
‎12-12-2016 02:50 AM
1 Karma
‎12-12-2016 02:50 AM
1 Karma
I saw this Kafka Connect Splunk in GitHub here below: https://github.com/jcustenborder/kafka-connect-splunk What's the difference between this and The Splunk Add-on For Kafka app? I'm pretty new to Kafka but we got this request from customers where the requirement was to push topic messages from Kafka to Splunk. How can I achieve this?? I was just researching and found these two ideas. Kindly guide as I'm a newbie to Kafka but not to Splunk. ... View more

Re: What are the licensing differences between Spl...

by in All Apps and Add-ons
‎12-07-2016 02:52 AM
‎12-07-2016 02:52 AM
Oh..!! So as per my knowledge, Splunk enterprise comes along with Hunk/Splunk analytics for Hadoop. Extra licensing is incurred only if we import data from Hadoop to Splunk. We have licensed splunk Enterprise 6.3.2 in our organization, Why is that I cant see "Virtual Indexes" in Splunk Search head UI ?? I don't wanna import data from Hadoop.I wanna use to view/analyse Hadoop data. So with my current license, without incurring additional cost I can analyse Hadoop Data right? But I don't see option for "Virtual Indexes" in our Splunk Web SH UI. Please correct me if I'm wrong. ... View more

Re: What are the licensing differences between Spl...

by in All Apps and Add-ons
‎12-04-2016 10:03 PM
‎12-04-2016 10:03 PM
so does it cost when I use Splunk Hadoop connect for Hadoop Data Analytics? What exactly is the parameter on which Splunk Hadoop Connect licensing is based? ... View more

What are the licensing differences between Splunk ...

by in All Apps and Add-ons
‎12-02-2016 03:22 AM
1 Karma
‎12-02-2016 03:22 AM
1 Karma
I understand Splunk Hadoop Connect is a free app and Hunk License depends on the no of Tasktrackers. We have Splunk Enterprise in our organisation and the goal is to perform analytics on Hadoop data and send archived data to Hadoop from Indexes. I can achieve this via both Splunk Hadoop Connect and Hunk, but my doubt is what's the difference between these two w.r.t licensing, other than the bidirectional data movement that Hadoop Connect provides? Now if I get Splunk Hadoop Connect app, then the licensing will depend on what parameters? ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-10-2016 06:43 AM
‎11-10-2016 06:43 AM
Hi @lukejadamec @somesoni2 , Thankyou for all your inputs and help. I really appreciate all your support and help and it was really helpfull. I used the SEDCMD and modified the format as required. But the team doesn't want to get this done during index-time due to the complications involved. Is there a possibility of getting it done during search-time?? ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-04-2016 07:29 AM
‎11-04-2016 07:29 AM
Wow..Thats great..!! Please post the configs and I will try it DEV first .. Thankyou soo much for your help 🙂 1) Also after I use these configs , I will be unable to use the query that @somesoni2 provided since the events format gets changed before its indexed right?? 2) Infact I modified query to view it in a format I wanted. Below is my query: my base query | rex mode=sed "s/\"tag\":\"([^\/]+\/[^\/]+)\/([^\/]+)\/([^\"]+)/\n\"container-image\":\"\1\",\n\"container-service\":\"\2\",\n\"container-id\":\"\3/ s/\"line\":\"/\"/ s/{// s/}// s/\",\"s/\"\n\"s/" ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-03-2016 11:32 PM
‎11-03-2016 11:32 PM
Hi @lukejadamec , Thankyou so much for your time and efforts for helping me with this problem. The Splunk support advised us to use search-time rather than index-time which would affect splunk performance although I'm not aware of the problems caused by index-time extractions. It would be great if you could help me for a solution on this.. ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-03-2016 03:04 AM
‎11-03-2016 03:04 AM
Adding the screenshot since the REGEX ain't captured correctly in comment section: ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-03-2016 02:59 AM
‎11-03-2016 02:59 AM
Hi @lukejadamec I tried these two configs and none worked. PROPS [ _json ] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=json SHOULD_LINEMERGE=true category=Structured disabled=false pulldown_type=true TIMESTAMP_FIELDS=line EXTRACT-fields = (\"source\":\")(?\w+)\",\"tag\":\"(?.\/{1}.)\/(?.)\/(?.)\" 2. PROPS [ _json ] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=json SHOULD_LINEMERGE=true category=Structured disabled=false pulldown_type=true TIMESTAMP_FIELDS=line REPORT-transform = fields TRANSFORMS [fields] REGEX = (\"source\":\")(?\w+)\",\"tag\":\"(?.\/{1}.)\/(?.)\/(?.)\" ... View more

Completely Newbie to REGEX

by in Splunk Search
‎11-02-2016 07:30 AM
‎11-02-2016 07:30 AM
I'm completely new to REGEX. Started off learning by going through some videos and splunk docs. Can someone please provide further resource to get hands-on on these REGEXs. 1) When I use the regex developed from Splunk Field extractor in my props config it doesnt seem to work . What is that I need to tweak after I get the REGEX from Splunk?? If I'm not wrong splunk captures from the starting of the line instead of field-value pair. 2) I have events like below. I want three different REGEX extracting the fields as highlighted below: I tried quite a few but in vain. Can someone please help in configuring the 3 different REGEX for these 3 fields: {"line":"[ERROR ] CWWKG0031E: The value jdbc/actionateDB specified for unique attribute jndiName is already in use.","source":"stderr","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"} {"line":"[WARNING ] CWWKG0076W: The previous configuration for jndiReferenceEntry with id customDataSourceFactoryEntry is still in use.","source":"stdout","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"} {"line":"","source":"stdout","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"} {"line":"++ dirname /config/configDropins/defaults/keystore.xml","source":"stderr","tag":"itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25/Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6/a078f70a8338"} I want to extract 3 fields from the above italicised line like below: image=itec-artifactory.dis.com:6555/com.dis.pl000123.demo.actionate:0.0.1-25, service=Actionate_DEV_ACTIONATE.1.5tv4m4ckohx526muwvkcyo0v6,id=a078f70a8338 Greatly appreciate your help on this. Thankyou ... View more

Re: Modify the format of events in splunk UI

by in Splunk Search
‎11-02-2016 05:59 AM
‎11-02-2016 05:59 AM
Hi @somesoni2 , I want to thank you so much for your efforts and time trying to help me out with my problem. This is exactly what I was looking for. As @lukejadamec said , Is there a way to get this done via configs without running the special search everytime? Highly appreciate your help on this. ... View more

Modify the format of events in splunk UI

by in Splunk Search
‎10-26-2016 03:52 AM
‎10-26-2016 03:52 AM
Hi All, I have JSON Logs like below: SAMPLE EVENT: "line":" 2016-10-21 19:16:00 INFO [CollectorAccess] Updating peer collector list: [172.17.0.6:9998, 172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.8.9of6d5ylz2g8yc22wioksjhek.ingress:9998|10.255.0.13:9998|10.255.0.15:9998, 10.255.0.20:9998|172.18.0.4:9998|dynatrace_collector_dev-wlp_wlp.5.04w8s09obp9pwe2mu1s9elq7i.ingress:9998|10.255.0.13:9998, 172.17.0.9:9998, 172.17.0.3:9998, 172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.1.0bs4sokp2fpkkz0nfh4mo4xsc.ingress:9998|10.255.0.13:9998|10.255.0.16:9998, 172.17.0.8:9998, dynatrace_collector_dev-wlp_wlp.7.3hvzd4e5b5zdby4blgu1v8rm8.ingress:9998|172.18.0.4:9998|10.255.0.13:9998|10.255.0.22:9998, dynatrace_collector_dev-wlp_wlp.6.5huzo8ot2fnzavm9ji5it4p9d.ingress:9998|172.18.0.4:9998|10.255.0.13:9998|10.255.0.21:9998, 172.17.0.5:9998, 172.17.0.7:9998, 172.18.0.3:9998|10.255.0.13:9998|10.255.0.17:9998|dynatrace_collector_dev-wlp_wlp.2.5a4bbjtne3hxm3i3f0a0xj7lv.ingress:9998, 10.255.0.18:9998|172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.3.4tr7zjjhgqqtn0fh9hd0l7qoo.ingress:9998|10.255.0.13:9998, 172.17.0.4:9998, 10.255.0.19:9998|172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.4.ep9fshp8i94rdz7p7cpwi9v77.ingress:9998|10.255.0.13:9998", "source":" stdout", "tag":" itec-artifactory.hec.com:6555/com.hec.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11/Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8/5125046f7489 " I WANT TO MODIFY THE LAST ITALICISED LINE IN ABOVE EVENT TO SOMETHING LIKE BELOW : ( CHANGES HIGHLIGHTED AS BOLD) source=stdout, container-image=itec-artifactory.hec.com:6555/com.hec.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11,container-service=Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8,container-id=5125046f7489 Basically I want to create field value pairs from the events and also modify its appearance in the UI. How can I achieve this?? ... View more

Re: Few parts of JSON logs as separate fields and ...

by in Splunk Search
‎10-26-2016 02:58 AM
‎10-26-2016 02:58 AM
Hi @hardikJsheth, I did that but it didn't help 😞 Is there a way to extract fields from the extracted field tag like below?? container-image=itec-artifactory.fmr.com:6555/com.fmr.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11,container-service=Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8,container-id=5125046f7489 ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-25-2016 11:18 PM
‎10-25-2016 11:18 PM
@sdaniels, Thankyuo . But I believe I don't wanna lose data from tag and source. Else is there a way to extract more fields from the tag values like below? ORIGINAL: ","tag":"itec-artifactory.fmr.com:6555/com.fmr.pl000123.demo.actionate:0.0.1-14/Actionate_DEV_ACTIONATE.1.385y3873nb5k4m7xsmwxokgum/92e6e10df174" MODIFIED: container-image=itec-artifactory.fmr.com:6555/com.fmr.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11,container-service=Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8,container-id=5125046f7489 ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-25-2016 12:34 AM
‎10-25-2016 12:34 AM
Hi @sdaniels, Basically, earlier we had indexed the Dynatrace collector logs for monitoring and these logs appeared in normal format in splunk. Now these(above images) are the Dynatrace collectors running in the Docker containers. So after these collectors are dockerized, these collector logs appear in json format. We are trying to see if we can make this json appear like the old regular non-json collector logs. Is that possible? ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-24-2016 12:26 AM
‎10-24-2016 12:26 AM
Hi @sdaniels , Could'nt attach an image in comments section so responding here in the answers section. Thankyou for the response. But I believe that doesn't solve our customer's requirement completely. Like you said , I can use SEDCMD to remove the word "line:" . But I want only the below highlighted ones to appear in _raw events. Is that possible? How do we achieve that? When I perform the search, the values of source and tag should not appear in _raw events but they should appear as only extracted fields. I tried the below props and transforms but it doesn't seem to work. Could you please help? PROPS [httpevent] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none SHOULD_LINEMERGE=true category=Structured disabled=false pulldown_type=true TRANSFORMS-fields = field1,filed2 TRANSFORMS [field1] REGEX = (?:[^"\n]*"){7}(?P[^"]+) FORMAT = source::$1 [field2] REGEX = (?:[^,\n]*,){2}"\w+":"(?P[^"]+) FORMAT = tag::$1 ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-21-2016 10:06 AM
‎10-21-2016 10:06 AM
Hi @sdaniels , I did that. But I don't want source and tag to be displayed in events. They should be as only fields on the left side. Is that possible? ... View more

Few parts of JSON logs as separate fields and rema...

by in Splunk Search
‎10-21-2016 05:08 AM
‎10-21-2016 05:08 AM
Hi All, I have JSON Logs like below: SAMPLE EVENT: { [-] line: 2016-10-21 19:16:00 INFO [CollectorAccess] Updating peer collector list: [172.17.0.6:9998, 172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.8.9of6d5ylz2g8yc22wioksjhek.ingress:9998|10.255.0.13:9998|10.255.0.15:9998, 10.255.0.20:9998|172.18.0.4:9998|dynatrace_collector_dev-wlp_wlp.5.04w8s09obp9pwe2mu1s9elq7i.ingress:9998|10.255.0.13:9998, 172.17.0.9:9998, 172.17.0.3:9998, 172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.1.0bs4sokp2fpkkz0nfh4mo4xsc.ingress:9998|10.255.0.13:9998|10.255.0.16:9998, 172.17.0.8:9998, dynatrace_collector_dev-wlp_wlp.7.3hvzd4e5b5zdby4blgu1v8rm8.ingress:9998|172.18.0.4:9998|10.255.0.13:9998|10.255.0.22:9998, dynatrace_collector_dev-wlp_wlp.6.5huzo8ot2fnzavm9ji5it4p9d.ingress:9998|172.18.0.4:9998|10.255.0.13:9998|10.255.0.21:9998, 172.17.0.5:9998, 172.17.0.7:9998, 172.18.0.3:9998|10.255.0.13:9998|10.255.0.17:9998|dynatrace_collector_dev-wlp_wlp.2.5a4bbjtne3hxm3i3f0a0xj7lv.ingress:9998, 10.255.0.18:9998|172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.3.4tr7zjjhgqqtn0fh9hd0l7qoo.ingress:9998|10.255.0.13:9998, 172.17.0.4:9998, 10.255.0.19:9998|172.18.0.3:9998|dynatrace_collector_dev-wlp_wlp.4.ep9fshp8i94rdz7p7cpwi9v77.ingress:9998|10.255.0.13:9998] source: stdout tag: itec-artifactory.fmr.com:6555/com.fmr.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11/Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8/5125046f7489 } I WANT TO MODIFY THE LAST ITALICISED LINE IN ABOVE EVENT TO SOMETHING LIKE BELOW : ( CHANGES HIGHLIGHTED AS BOLD) source=stdout, container-image=itec-artifactory.fmr.com:6555/com.fmr.pl000123.ezpaas.ezpaas-dynatrace-collector:6.3-11,container-service=Dynatrace_Collector_DEV-WLP_WLP.7.3hvzd4e5b5zdby4blgu1v8rm8,container-id=5125046f7489 Basically I want to create field value pairs from the events and also modify its appearance in the UI. How can I achieve this?? ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-20-2016 09:07 AM
‎10-20-2016 09:07 AM
Someone kindly help me write the regex for source n tag .. I'm finding it very difficult to frame since it's new to me.. ... View more

Re: Extract fields in JSON during index time

by in Getting Data In
‎10-20-2016 03:33 AM
‎10-20-2016 03:33 AM
RAW DATA: {"line":"[ERROR ] CWWKS9660E: The orb element with the defaultOrb id attribute requires a user registry but no user registry became available within 10 seconds. As a result, no application will start. Ensure that you have configured an appropriate user registry in the server.xml file.","source":"stderr","tag":"itec-artifactory.fmr.com:6555/com.fmr.pl000123.demo.actionate:0.0.1-14/Actionate_DEV_ACTIONATE.1.385y3873nb5k4m7xsmwxokgum/92e6e10df174"} {"line":"[AUDIT ] CWWKS4104A: LTPA keys created in 1.184 seconds. LTPA key file: /opt/ibm/wlp/output/defaultServer/resources/security/ltpa.keys","source":"stdout","tag":"itec-artifactory.fmr.com:6555/com.fmr.pl000123.demo.actionate:0.0.1-14/Actionate_DEV_ACTIONATE.1.385y3873nb5k4m7xsmwxokgum/92e6e10df174"} {"line":"[AUDIT ] CWWKZ0058I: Monitoring dropins for applications. ","source":"stdout","tag":"itec-artifactory.fmr.com:6555/com.fmr.pl000123.demo.actionate:0.0.1-14/Actionate_DEV_ACTIONATE.1.385y3873nb5k4m7xsmwxokgum/92e6e10df174"} {"line":"[ERROR ] CWWKG0074E: Unable to update the configuration for jndiReferenceEntry with the unique identifier customDataSourceFactoryEntry because of the exception: The value jdbc/actionateDB for attribute jndiName is not unique.","source":"stderr","tag":"itec-artifactory.fmr.com:6555/com.fmr.pl000123.demo.actionate:0.0.1-14/Actionate_DEV_ACTIONATE.1.385y3873nb5k4m7xsmwxokgum/92e6e10df174"} ... View more

Extract fields in JSON during index time

by in Getting Data In
‎10-20-2016 03:14 AM
1 Karma
‎10-20-2016 03:14 AM
1 Karma
Hi , I'm a newbie to splunk in field extractions. Appreciate any help on this. I have JSON Format logs like below: I want source and tag as a field i.e it should not appear in events instead as separate fields like the way default fields appear on the left hand side in UI. Also I want the word "line:" to be removed. so basically only my line event should appear in splunk. How can I achieve this? I believe props.conf and transforms should be a solution. But I dont know how to approach that. My transforms should contain a regex to capture what? I'm not understandin what my regex should do? ... View more

Which instance is installed on a server?

by in Deployment Architecture
‎10-09-2016 11:45 PM
1 Karma
‎10-09-2016 11:45 PM
1 Karma
Hi Team, Im new to the splunk team in my organisation and they have servers A , B , C, D etc. There are splunk instances installed on the server like deployer , clustermaster , deployment-server etc. From their docs I know A - Clustermaster B- Deployer C - License master D - Deployment server etc.. But How do I know find out which instance is installed on any particular server? Is there any configuration file that corresponds to what instance is installed on the server? Could you help me in differentiating these? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
Karma given to