Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About dindu
dindu
Contributor
Member since:
10-28-2019
09-13-2021
Community Statistics
| Posts | 76 |
| Solutions | 10 |
| Karma Given | 1 |
| Karma Received | 18 |
| Member Since | 10-28-2019 |
Activity Feed
- Got Karma for Re: Logging Out of Splunk. 05-06-2024 03:47 PM
- Got Karma for Re: Change Index and Sourcetype. 09-13-2021 07:15 AM
- Got Karma for Re: How to fill empty field values to 0 in Splunk ?. 07-16-2020 05:03 AM
- Got Karma for Re: Any suitable option for collecting data from HP, Dell switches using Universal Forwarder. 06-05-2020 12:51 AM
- Got Karma for Re: Logging Out of Splunk. 06-05-2020 12:51 AM
- Karma Re: Submit button not working in drop down for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: Field Extraction. 06-05-2020 12:50 AM
- Got Karma for Re: How split up a sentence string into multiple words. 06-05-2020 12:50 AM
- Got Karma for Re: Loading base query by token. 06-05-2020 12:50 AM
- Got Karma for Re: Loading base query by token. 06-05-2020 12:50 AM
- Got Karma for Re: Alert setup. 06-05-2020 12:50 AM
- Got Karma for Re: recommended way to rename a kvstore collection that is not empty ?. 06-05-2020 12:50 AM
- Got Karma for Re: Creating a table from diff source. 06-05-2020 12:50 AM
- Got Karma for Re: How to convert similar rows to adjacent column. 06-05-2020 12:50 AM
- Got Karma for Re: How to compare two CSV files with multiple rows. 06-05-2020 12:50 AM
- Got Karma for Re: Can we have a dash in the generated rex field name?. 06-05-2020 12:50 AM
- Got Karma for Re: Use Date String in Search. 06-05-2020 12:50 AM
- Got Karma for Re: Looping a "forecasting" column using stats. 06-05-2020 12:50 AM
- Got Karma for Re: Looping a "forecasting" column using stats. 06-05-2020 12:50 AM
- Posted Re: Issue sending events to nullQueue. on Getting Data In. 05-28-2020 11:03 AM
Topics I've Started
No posts to display.
01-30-2020
11:16 AM
Hi,
You could try something like below during the search time by using the spath command
Please rename the fields and use table command to display the fields better,
|makeresults
|eval _raw="<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
<RequestInformation
Hostname='1.2.3.4'
HostAddress='5.6.7.8'
HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
ReferringPage=''
RequestType='POST'
ContentLength='505'
RawUrl='/dir/subdir/filename.asmx'>
<Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
<Cookies>
</Cookies>
<Form>
</Form>
</RequestInformation>
<Exception Message='ORA-01017: invalid username/password; logon denied'>
<StackTrace>
<![CDATA[
at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleConnection.Open()
at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
]]>
</StackTrace>
</Exception>
</ErrorMessage>"
|spath input=_raw
You could also add KV_MODE = xml in the props.conf and breaking the lines appropriately
KV_MODE = xml
... View more
01-30-2020
09:28 AM
Hi,
Please try the below cron .
Update us once done.
15-59/30 * * * *
... View more
01-29-2020
09:33 AM
Hi,
For numeric conversion you could use convert function.
|your_search
|convert num(your_string_field)
In your case do all the arithmetic operations and append the % as the last step.
| your_base_search
|arithmetic_perations
| eval perc_col_a = round(datafield / totfield)*100)."%"
|rename perc_col_a as "Column A"
... View more
01-28-2020
12:40 PM
1 Karma
Hi,
Splunk forwarder can forward any files on the host machine.
Configure the forwarder to monitor the files in your network switches and route to the indexer.
Also, check Splunk base for any in-built apps like as below.
Dell Monitoring - https://splunkbase.splunk.com/app/3098/#/overview
... View more
01-28-2020
12:27 PM
Hi,
I think your issue is mainly due to port associated with snmp.
Splunk user does NOT normally have access to operate ports below 1024.
Check inputs.conf, whether the trap port is set to a value below 1024.
If so re-assign a free port in range of 80**
Modify input.conf in the apps local and assign trap_port = 80**
Please let us know whether this helped or not.
... View more
01-28-2020
11:37 AM
Hi,
Yes - the Splunk indexer will treat each input as different and index the same data.
... View more
01-28-2020
10:29 AM
Hi,
You need to go with load balancing to address HF failovers.
The below documentation will help.
https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Setuploadbalancingd
https://docs.splunk.com/Documentation/Forwarder/8.0.1/Forwarder/Configureloadbalancing
... View more
01-21-2020
11:34 AM
Hi,
You could use the delta command to achieve to calculate the difference.
Please use the below query and let us know whether this helped.
The difference between the adjacent records is evaluated using the delta command.
|source="c:\\program files (x86)\\xxxx" "PLogger" TV earliest=-2d@d latest=now PA = Low
|stats max(VAL) by host, TV, LED, PA , _time
|fields "host" "LED","PA", "TV", "max(VAL)"
|rename max(VAL) as max_value
|delta max_value as power_delta p=1
|eval delta_perc=round(power_delta*100/(max_value-power_delta),2)
|where delta_perc>5
... View more
01-21-2020
07:50 AM
Hi,
You could get some information from the Splunk internal logs.
Use the below query to fetch the details.
index=_internal source="/opt/splunk/var/log/splunk/scheduler.log" savedsearch_name="your_search_name".
If it does not return any result - remove the conditions and try searching again like below.
index=_internal "your_search_name"
The details you will get depends on the retention of the saved search logs.
Please let us know whether this helped.
... View more
01-16-2020
01:40 PM
Hi,
Please try the below workarounds and let us know.
Just choose None in option and try as in the attachment.
If it did not work remove the username and password as well and try again.
... View more
01-16-2020
06:51 AM
Hi,
Could you please provide the sample data for this.
Also, please try the below SPL
Please try and update us whether this works.
| source="C:\\QS1\\WF_LD.CSV"
|table ROUTE
|where isnotnull(ROUTE)
|stats count as route_count by ROUTE
... View more
01-14-2020
01:00 PM
Hi,
You could use the eval command to achieve this.
I assume the values are hardcoded as in the question.
Please try and let us know.
|your_search
|eval "Project Update"=if(Clients="PPN","v0.1342",'Project Update')
|eval "Number of users"=if(Clients="PPN","2546",'Number of users')
|table Clients,"Project Update","Number of users"
... View more
12-13-2019
06:17 AM
Hi,
it was similar to an arithmetic progression.
I just solved the equation and tested it for a few values.
... View more
12-12-2019
10:55 AM
1 Karma
Thanks, Woodcock!!!
I am glad to be mentioned by you.
... View more
12-12-2019
07:52 AM
1 Karma
Hi,
You could use the below method to calculate the no of iterations.
Need to supply the increment value for the score. I am taking it as one here.
Please test and let us know.
|makeresults
|eval _raw="
score,met,missed,percentage,minimum,forecast
5,3,2,60,90"
|multikv forceheader=1
|rename COMMENT AS "The below code is the actual query"
|eval required_score=(100*missed)/(100-minimum)
|eval increment=1
|eval forecast=ceil((required_score-score)/increment)
|table score,met,missed,percentage,minimum,required_score,forecast
... View more
12-11-2019
11:48 AM
1 Karma
Hi,
You could give the below conf to achieve the functionality.
Please try and let us know.
Cron : 0-59/15 * * * * [Runs a search every 15 min,round the clock - 00,15,30,45 ]
Earliest : -15m@m [ Give the window of search for the past 15 min ]
Latest : now
... View more
12-11-2019
11:25 AM
Hi,
You could add a multi-select input in the dashboard. This will allow you to choose multiple values and use them anywhere on the dashboard.
Click on the "Edit" button on the Top Right corner. Then click on "Add Input" and choose Multiselect.
Give token a name like multi_input. The value can be retrieved anywhere in the dashboard by calling the variable $mulit_input$.
Give static values and view the preview to add delimiters or so.
... View more
12-11-2019
08:30 AM
Hi,
You might be hitting the max character limits.
The default is near to 10K characters.
Please update the limits.conf.
Do create a limits.conf in your app local directory otherwise it will update the entire Splunk environment
Path - /splunk_home/etc/apps/your_app/local/limits.conf
Please try and let us know the outcome,
**limits.conf**
maxchars = <integer>
... View more
12-10-2019
11:04 AM
Hi Govind,
You need to parse the JSON logs to achieve this.
To parse the logs - you need to trim down the events to make it as exact JSON Splunk expects.
Use regex or replace functionality for that.
You could use the below query after that.
|your_query
|search documentType="ANNUAL_STATEMENT"
|stats list (reference),list(name),list(mimeType),list(documentType),list(creationDate)
|where mvcount(documentType)>1
... View more
12-10-2019
06:21 AM
Hi,
There should be two colons. Sorry, it was a typo error.
Try the regex in regex101 and see it is outputting the desired results.
Please restart once making the changes.
... View more
12-09-2019
01:13 PM
Hey Harish,
Assuming you want everything in between responseMessage and orderId.
You could use the below SPL.
Replace your query in the line before the rex command.
Please try and let us know
|makeresults
|eval _raw ="2019-12-03 17:31:27.633 INFO ,aabbe872bbf3f848,aabbe872bbf3f848,false] 15 --- [nio-8080-exec-5] c.u.f.p.api.impl.: InfoLogging Operation=MakePayment, RequestSourceCode=ZBL, PaymentResponse=class PaymentResponse { responseCode: AB0000 responseMessage: Declined - Do not Honor orderId: 269107641 }"
|rex field=_raw "responseMessage:(?P<response_message>.+)orderId"
| table response_message
... View more
12-09-2019
08:15 AM
Hi,
Could you please try after modifying the init as below. Defining plannedColor in init as well.
Please try and let us know.
<init>
<set token="PlannedColor">0x5eb246</set>
<set token="Prio1Color">0xff0000</set>
<set token="Prio2Color">0xffc000</set>
<set token="Prio3Color">0x00b050</set>
<set token="Prio4Color">0x2e75b6</set>
<set token="Prio5Color">0x548235</set>
</init>
... View more
12-09-2019
07:50 AM
Hey,
Automatic XML extraction will work if the input XML is in the format of
<field>value<field>
This is the reason why KV_MODE=xml does not parse as we expect.
You have multiple options to parse the xml.
Please TRY and let us know.
Method1)You could parse it at the search time by using a regex like below.
| makeresults
| eval _raw="
<properties>
<property name=\"autosync\" value=\"true\" />
<property name=\"synctime\" value=\"1440\" />
<property name=\"lastsync\" value=\"2019-12-09T11:16:12\" />
<property name=\"nextsync\" value=\"2019-12-10T11:16:28\" />
</properties>
</logstore>"
|rex field=_raw autosync\"\svalue=\"(?P<auto_sync>.+)\"\s\/\>
|rex field=_raw synctime\"\svalue=\"(?P<sync_time>.+)\"\s\/\>
|rex field=_raw lastsync\"\svalue=\"(?P<last_sync>.+)\"\s\/\>
|rex field=_raw nextsync\"\svalue=\"(?P<next_sync>.+)\"\s\/\>
|table auto_sync,sync_time,last_sync,next_sync
Method2)Use spath and multikv to extract the values
Method 3)If you want to extract it at the time of indexing modify the property file as below.The transforms will extract the field and value. Modify the regex if the format is different.
**props.conf**
[Logstore_XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<logstore>)
MUST_BREAK_AFTER = \</logstore\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
FIELDALIAS-rootfields = logstore.properties.property{@name} as PropertyID logstore.properties.property as ProperyValue
TRANSFORMS-extract_xml = extract_xml
**transforms.conf**
[extract_xml]
regex=property\sname="(.+)"\svalue(.+)\s\/>
format=$1:$2
... View more
12-06-2019
09:05 AM
Hi Daniel,
The field extracted is shown in the list of fields on the sidebar which implies the naming should satisfy the condition.
Whereas the eval is just happening on the front end Splunk UI.
Please accept if this helped.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-13-2021
03:39 PM
|
Karma from
