Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Hemnaath
Hemnaath
Motivator
Member since:
03-15-2015
11-20-2025
Community Statistics
| Posts | 903 |
| Solutions | 12 |
| Karma Given | 1 |
| Karma Received | 55 |
| Member Since | 03-15-2015 |
Activity Feed
- Posted Re: How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 09:06 PM
- Posted How to create heatmap visualization in dashboard studio? on Dashboards & Visualizations. 11-20-2025 03:56 AM
- Got Karma for How to troubleshoot and fix the website input 504 Gateway Timeout Error while configuring an input ?. 01-12-2024 02:44 PM
- Posted Re: Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-29-2023 03:34 AM
- Posted Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Tagged Where I can get the Splunk Add-on for AWS 6.0.0 version documentation details on All Apps and Add-ons. 08-28-2023 04:58 AM
- Got Karma for Re: Splunk has found 1 orphaned searches owned by 1 unique disabled users.Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.. 06-13-2023 04:41 AM
- Posted What splunk precedence rules should be followed to upgrade splunk clustered environment ? on Splunk Enterprise. 01-26-2023 01:29 AM
- Got Karma for Unable to break the multi-line events into single event from kinesis log?. 11-07-2022 02:14 AM
- Posted Re: How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 11:13 PM
- Posted How to write a Splunk query to find the Splunk UF version for specific set of hosts in Splunk Enterprise on Splunk Enterprise. 10-31-2022 06:44 AM
- Got Karma for Re: ERROR: kvstore port [8191] - port is already bound. Splunk needs to use this port.. 10-13-2022 02:16 PM
- Posted Where can I get the release notes for Splunk enterprise v8.2.6.1 release notes ? on Splunk Enterprise. 07-26-2022 11:17 PM
- Posted How to fix this error: could not use the strptime to parse timestamp from “2022-26-05T11:29:57”? on Getting Data In. 05-26-2022 09:01 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 08:59 AM
- Posted Re: How to write a monitoring stanza to monitor the windows Event Viewer logs on Getting Data In. 05-12-2022 06:14 AM
- Posted How to write a monitoring stanza to monitor the windows Event Viewer logs? on Getting Data In. 04-29-2022 03:13 AM
- Posted Re: How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-16-2022 07:18 PM
- Posted How to write time format for 2022-04-07 20:40:03.360 -06:00 [XXX] XXXXX? on Splunk Enterprise. 04-14-2022 09:17 AM
- Posted Why is Splunk ingesting additional information from the source, when there is no actual data present in the source ? on Splunk Enterprise. 04-13-2022 05:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-09-2017
10:01 AM
Hi All, Currently I am facing an issue in an scheduled email alert. We have scheduled a search query to trigger an email alert whenever splunk process goes down. Splunk query is working fine and we are also getting an alert whenever the conditions are met, but we are also getting Message level Error along with the result. Message level Error display all the indexer instance along with the error message.
Not sure why/what is causing to trigger additional message.
Query Details :
index=_internal host=hsp* OR host=vspl* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "loader - Splunkd starting" OR "INFO ShutdownHandler - Shutting down splunkd" | eval message=if((message="Shutting down splunkd"),"failure","success") | rename message as status |eval Date_Time= readabledate + " " + readabletime | sort host | table host Date_Time status
Message Level: ERROR
1. [splunk01] Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'checkpoint:network:firewall' and lookup table 'checkpoint_vendor_info_lookup'.
2. [splunk02] Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'checkpoint:network:firewall' and lookup table 'checkpoint_vendor_info_lookup'.
Kindly guide me in how to fix this issue and where to start the troubleshooting steps.
thanks in advances.
... View more
06-08-2017
05:48 AM
thanks it worked, at same time could please tell me where we need to use OR operator and AND operator appropriately in SPL query. thanks in advance.
... View more
06-06-2017
04:19 AM
Hi All, I have used the below query to capture the splunk service status (Up or Down) via splunkd.log. This query is working fine, but we have added few more splunk instance to the current environment and we need to capture these splunk service status along with the old splunk instances. My requirement is to include the newly build splunk host details to pull their service status.
Newly build host starts with the letter vms , so how to add this host name along with host name hs
Query details :
index=_internal host=hs* sourcetype=splunkd source="/opt/splunk/var/log/splunk/splunkd.log" "ShutdownHandler - shutting down level" OR "TailingProcessor - Shutting down with*" | stats earliest(_time) AS Earliest, values(linecount) as Failures by host | convert ctime(Earliest)|addcoltotals label="Total" labelfield="Total_Number_of_Failures
thanks in advance.
... View more
05-26-2017
09:35 AM
1 Karma
Hi Dineshraj Good Evening, thanks for your effort on this, i have implemented the below stanza and it removed the blank space from the events.
[ibm:auth:identitymanagement]
SEDCMD-removeat =s/at .+//g
SEDCMD-removespaces = s/\s+\s+[\r\n]//g
... View more
05-25-2017
12:55 PM
Somesoni2, the above Regex worked and now we are not seeing any white space in the events. thanks a lot for guiding me on this.
... View more
05-24-2017
11:11 PM
Hi Somesoni2, thanks for your much need help on removing the word at and the white space from the event content, though the above regex helped to remove most of the events contained the letter at and the white space but still we could see some of the events are having the white space under the "show all lines details" as shown on below event data.
Log details:
5/25/17
2:10:00.487 AM
[2017-05-25T02:10:00.487-04:00] [itm_server1] [ERROR] [] [XELLERATE.AUDITOR] [tid: [ACTIVE].ExecuteThread: '12' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: itminternal] [ecid: 0000Lkg^grQ3JBc5TjO5yc1P8V12000002,0] [APP: itm#11.1.2.0.0] Processor (com.thortech.xl.audit.auditdataprocessors.UserProfileRDGenerator) failed to process successfully generated audit data[[
com.thortech.xl.audit.exceptions.AuditDataProcessingFailedException: Failed to insert form profile record in table UPA_UD_FORMS
Caused by: com.thortech.xl.orb.dataaccess.tcDataAccessException
... 39 more
Caused by: java.sql.SQLIntegrityConstraintViolationException: ORA-02291: integrity constraint (PRD_itm.FK_UPA_UD_UPA_RES) violated - parent key not found
... 41 more
]]
Collapse
kindly guide me on removing the space from events under the "show all lines details"
thanks in advance.
... View more
05-24-2017
11:06 PM
Hi Dineshraj, Good Morning. we have added props.conf file with the below mentioned stanza to remove the word "at" and the blank space from the event. Added customized app with the props.conf stanza and pushed to the indexer instances for parsing the events at index level.
Props.conf details :
[ibm:auth:identitymanagement]
SEDCMD-removeat =s/at .+//g
Though it worked on most of the events with the above criteria were removed, but still there are some more events which are having blank space into the events .
Could please guide me on how to get ride of the white space as show in the events below.
Log details.
5/25/17
1:57:49.522 AM
[2017-05-25T01:57:49.522-04:00] [itm_server1] [ERROR] [] [ibm.tam.platform.kernel.impl] [tid: [ACTIVE].ExecuteThread: '13' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxxxx] [ecid: 061bf930d1319f9b:-30072ed4:15c2c8bbbd3:-8000-00000000000bb488,0] [APP: itm#11.1.2.0.0] [J2EE_APP.name: spml-dsml] [J2EE_MODULE.name: spmlws] [WEBSERVICE.name: itmProvisioning] [WEBSERVICE_PORT.name: itmProvisioningPort] Kernel Information: {0}[[
ibm.tam.platform.kernel.ValidationFailedException: IAM-3030006:The following password policy rules were not met:Password must not be one of 8 previous passwords.
:
Caused by: ibm.tam.passwordmgmt.exception.InvalidPasswordException
thanks in advance
... View more
05-24-2017
12:53 PM
somesoni2 , we could see some of the events are still showing the blank space after updating the below props stanza in indexer instances.
Props.conf details :
[ibm:auth:identitymanagement]
SEDCMD-removeat =s/at .+//g
Log details:
5/24/17
3:39:30.000 PM
WatchData: DATE = May 24, 2017 3:39:30 PM EDT SERVER = itm_server1 MESSAGE = [ServletContext@1479415291[app:ibm.iam.console.identity.self-service.ear module:identity path:/identity spec-version:2.5 version:V2.0]] Root cause of ServletException.
java.lang.AssertionError: Assertion violated
SUBSYSTEM = HTTP USERID = SEVERITY = Error THREAD = [ACTIVE] ExecuteThread: '13' for queue: 'weblogic.kernel.Default (self-tuning)' MSGID = BEA-101017 MACHINE = hit01.xxxxx.com TXID = CONTEXTID = 061bf930d1319f9b:-30072ed4:15c2c8bbbd3:-8000-00000000000a715f TIMESTAMP = 1495654770087
WatchAlarmType: AutomaticReset
WatchAlarmResetPeriod: 30000
Kindly help me to remove the space from the events t which are under "show all lines details.
... View more
05-24-2017
11:59 AM
sure, thanks. I will update the below stanza in props,conf and validate it .
Props.conf details :
[ibm:auth:identitymanagement]
SEDCMD-removeat =s/at .+//g
... View more
05-24-2017
11:44 AM
somesoni2 thanks for your effort on this, could please correct me if the below stanza can be updated in props.conf in indexer instances.
Props.conf details :
[ibm:auth:identitymanagement]
SEDCMD-removeat = s/at \S .+//g
thanks in advance.
... View more
05-24-2017
11:09 AM
somesoni2, can I update above regx to the stanza in props.conf, as the user wants the data not to be injected into splunk. User wants only the events not the content shown in " show all 124 lines details " so in this case can I update the props stanza with above regex mentioned for a base search
Props.conf details :
[ibm:auth:identitymanagement]
SEDCMD-removeat = s/at \s .+//g
Log details :
5/24/17
12:40:55.515 PM
[2017-05-24T12:40:55.515-04:00] [itm_server1] [ERROR] [] [ibm.tam.platform.kernel.impl] [tid: [ACTIVE].ExecuteThread: '22' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxxxxx] [ecid: 061bf930d1319f9b:-30072ed4:15c2c8bbbd3:-8000-000000000009f634,0] [APP: itm#11.1.2.0.0] [J2EE_APP.name: spml-dsml] [J2EE_MODULE.name: spmlws] [WEBSERVICE.name: itmProvisioning] [WEBSERVICE_PORT.name: itmProvisioningPort] Kernel Information: {0}[[
ibm.tam.platform.kernel.ValidationFailedException: tam-3030006:The following password policy rules were not met:Password must not be one of 8 previous passwords.
:
Show all 124 lines
Kindly guide me on this as user needs only the events content not the data which are under "show all 124 lines details"
thanks in advance
... View more
05-24-2017
09:45 AM
hey somesoni2, it worked but at the same time we could see some space between the events now and the word "at" is removed. Now the events look like this
log details :
[2017-05-24T12:40:55.515-04:00] [ibm_server1] [ERROR] [] [ibm.iam.platform.kernel.impl] [tid: [ACTIVE].ExecuteThread: '22' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxxxxxx] [ecid: 061bf930d1319f9b:-30072ed4:15c2c8bbbd3:-8000-000000000009f634,0] [APP: ibm#11.1.2.0.0] [J2EE_APP.name: spml-dsml] [J2EE_MODULE.name: spmlws] [WEBSERVICE.name: ibmProvisioning] [WEBSERVICE_PORT.name: ibmProvisioningPort] Kernel Information: {0}[[
ibm.tam.platform.kernel.ValidationFailedException: IAM-3030006:The following password policy rules were not met:Password must not be one of 8 previous passwords.
:
Source)
Source)
Source)
Source)
Method)
Caused By: ibm.tam.passwordmgmt.exception.InvalidPasswordException
kindly guide me on how to remove the space and the words from the events.
... View more
05-24-2017
08:18 AM
thanks somesoni2, can I update the below stanza will it fix the issue.
[ibm:auth:identitymanagement]
SEDCMD-removeat = s/at \S+//g
... View more
05-24-2017
07:29 AM
Hi Dineshraj, Good Evening , we are still seeing the huge log details getting into splunk.
Please guide us on how to remove the word starting with "at" from the events list.
Recent Log details :
[2017-05-24T09:21:31.473-04:00] [itm_server1] [ERROR] [] [com.xxxxx.tam.itm.plugins.eventhandlers] [tid: [ACTIVE].ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxxxx] [ecid: ce05a10ae6311cf9:15640c05:15c2c928226:-8000-00000000000b19be,1:123289:21] [APP: itm#11.1.2.0.0] [J2EE_APP.name: itm_11.1.2.0.0] [J2EE_MODULE.name: workflowservice] [WEBSERVICE.name: CallbackService] [WEBSERVICE_PORT.name: CallbackServicePort] Exception Occurred.[[
ibm.tam.identity.exception.AccessDeniedException: tam-3054101:The logged-in user itminternal does not have viewSearchEntity permission on Role xxxxx Inactive itm
Users entity.:itminternal:viewSearchEntity:Role:xxxxx Inactive itm Users
at ibm.tam.identity.rolemgmt.impl.RoleManagerCommon.hasAccess(RoleManagerCommon.java:401)
at ibm.tam.identity.rolemgmt.impl.RoleManagerCommon.hasAccess(RoleManagerCommon.java:251)
at ibm.tam.identity.rolemgmt.impl.RoleManagerImpl.getDetails(RoleManagerImpl.java:531)
at ibm.tam.identity.rolemgmt.impl.RoleManagerImpl.getDetails(RoleManagerImpl.java:492)
at sun.reflect.GeneratedMethodAccessor4906.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
... View more
05-24-2017
06:56 AM
Hi Somesoni2, I have tried the above stanza inprod environment but it is not working, we could still see the huge log details getting into splunk.
Props.conf details: Placed at Indexer instances.
[ibm:auth:identitymanagement]
SEDCMD-removeat = s/at /S+//g
Log details :
[2017-05-24T09:21:31.473-04:00] [itm_server1] [ERROR] [] [com.xxxxx.tam.itm.plugins.eventhandlers] [tid: [ACTIVE].ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxxxx] [ecid: ce05a10ae6311cf9:15640c05:15c2c928226:-8000-00000000000b19be,1:123289:21] [APP: itm#11.1.2.0.0] [J2EE_APP.name: itm_11.1.2.0.0] [J2EE_MODULE.name: workflowservice] [WEBSERVICE.name: CallbackService] [WEBSERVICE_PORT.name: CallbackServicePort] Exception Occurred.[[
ibm.tam.identity.exception.AccessDeniedException: tam-3054101:The logged-in user itminternal does not have viewSearchEntity permission on Role xxxxx Inactive itm
Users entity.:itminternal:viewSearchEntity:Role:xxxxx Inactive itm Users
at ibm.tam.identity.rolemgmt.impl.RoleManagerCommon.hasAccess(RoleManagerCommon.java:401)
at ibm.tam.identity.rolemgmt.impl.RoleManagerCommon.hasAccess(RoleManagerCommon.java:251)
at ibm.tam.identity.rolemgmt.impl.RoleManagerImpl.getDetails(RoleManagerImpl.java:531)
at ibm.tam.identity.rolemgmt.impl.RoleManagerImpl.getDetails(RoleManagerImpl.java:492)
at sun.reflect.GeneratedMethodAccessor4906.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
kindly guide me how to remove the word starting with "at" from the events list from above actual log details.
... View more
05-16-2017
10:52 AM
Somesoni2 kindly guide me on how to remove a specific string from an event in splunk.
thanks in advance.
... View more
05-16-2017
10:26 AM
Hi Somesoni2 thanks for your effort, actually we are monitoring the identity management logs in splunk and we are using UF agent to get the events from remote machine to the splunk indexer. so in this case were do we want to configure the props.conf details in indexer or Heavy forwarder. And also do we need to configure transforms.conf along with props.conf
Props.conf : Is the below stanza correct
[sourcetype=IBM:AUT:TAM]
SEDCMD-removeat = s/at /s+//g
kindly guide me on this.
thanks in advance
... View more
05-16-2017
09:46 AM
Hi Dineshraj, can you guide me on how to remove a particular values in the event.
thanks in advance.
... View more
05-16-2017
09:42 AM
Hi All, currently we are facing an issue in removing a specific values from the event list starting with the word "at" as we do not want these in the splunk events.
Example :
5/16/17
8:57:04.674 AM
[2017-05-16T08:57:04.674-04:00] [TIM_server1] [ERROR] [] [db2.tam.platform.kernel.impl] [tid: [ACTIVE].ExecuteThread: '29' for queue: 'xxxx.kernel.Default (self-tuning)'] [userId: xxx_TIMPASSSYNC] [ecid: d87cb14ef99e9513:-133033ab:15c0857bfd3:-8000-000000000005cb77,0] [APP: TIM#11.1.2.0.0] [J2EE_APP.name: spml-dsml] [J2EE_MODULE.name: spmlws] [WEBSERVICE.name: TIMProvisioning] [WEBSERVICE_PORT.name: TIMProvisioningPort] Kernel Information: {0}[[
db2.tam.platform.kernel.ValidationFailedException: IAM-3030006:The following password policy rules were not met:Password must not be one of 8 previous passwords.
:
at db2.tam.passwordmgmt.eventhandlers.UserPasswordValidationHandler.validate(UserPasswordValidationHandler.java:96)
at db2.tam.platform.kernel.impl.TIMEvent.executeHandlers(TIMEvent.java:204)
at db2.tam.platform.kernel.impl.MonitoredTIMEvent.invokeExecuteHandler(MonitoredTIMEvent.java:99)
at db2.tam.platform.kernel.impl.MonitoredTIMEvent.executeHandlers(MonitoredTIMEvent.java:69)
at db2.tam.platform.kernel.impl.TIMEvent.execute(TIMEvent.java:157)
at db2.tam.platform.kernel.impl.ProcessImpl.executeStage(ProcessImpl.java:223)
at db2.tam.platform.kernel.impl.TIMProcess.doStageExecution(TIMProcess.java:38)
at db2.tam.platform.kernel.impl.ProcessImpl.execute(ProcessImpl.java:182)
at db2.tam.platform.kernel.impl.MonitoredTIMProcess.execute(MonitoredTIMProcess.java:33)
at db2.tam.platform.kernel.impl.Utils.manageSyncProcessing(Utils.java:73)
Kindly guide me on how to remove this value starting with "at" from the events list.
thanks in advance
... View more
05-16-2017
06:58 AM
thanks dineshraj for your timely help on this, but actually we need the events but not the content starting with "at" from the events.
Details of events
5/16/17
8:57:04.674 AM
[2017-05-16T08:57:04.674-04:00] [TIM_server1] [ERROR] [] [db2.tam.platform.kernel.impl] [tid: [ACTIVE].ExecuteThread: '29' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xxx_TIMPASSSYNC] [ecid: d87cb14ef99e9513:-133033ab:15c0857bfd3:-8000-000000000005cb77,0] [APP: TIM#11.1.2.0.0] [J2EE_APP.name: spml-dsml] [J2EE_MODULE.name: spmlws] [WEBSERVICE.name: TIMProvisioning] [WEBSERVICE_PORT.name: TIMProvisioningPort] Kernel Information: {0}[[
db2.tam.platform.kernel.ValidationFailedException: IAM-3030006:The following password policy rules were not met:Password must not be one of 8 previous passwords.
:
at db2.tam.passwordmgmt.eventhandlers.UserPasswordValidationHandler.validate(UserPasswordValidationHandler.java:96)
at db2.tam.platform.kernel.impl.TIMEvent.executeHandlers(TIMEvent.java:204)
at db2.tam.platform.kernel.impl.MonitoredTIMEvent.invokeExecuteHandler(MonitoredTIMEvent.java:99)
at db2.tam.platform.kernel.impl.MonitoredTIMEvent.executeHandlers(MonitoredTIMEvent.java:69)
at db2.tam.platform.kernel.impl.TIMEvent.execute(TIMEvent.java:157)
at db2.tam.platform.kernel.impl.ProcessImpl.executeStage(ProcessImpl.java:223)
at db2.tam.platform.kernel.impl.TIMProcess.doStageExecution(TIMProcess.java:38)
at db2.tam.platform.kernel.impl.ProcessImpl.execute(ProcessImpl.java:182)
at db2.tam.platform.kernel.impl.MonitoredTIMProcess.execute(MonitoredTIMProcess.java:33)
at db2.tam.platform.kernel.impl.Utils.manageSyncProcessing(Utils.java:73)
Kindly guide me on this please.
... View more
05-16-2017
06:12 AM
Hi Dineshraj, Could you please guide me on this issue, needs to remove above details from the events.
thanks in advance.
... View more
05-15-2017
10:58 PM
Hi Dineshraj, After configuring /pushing the above stanza from DP to the remote systems we could see the data getting into splunk and unable to perform the search. But currently we face another issue, data pulled from the remote machine contain some large list of unwanted URL's followed by at.
Details :
at java.lang.reflect.Method.invoke(Method.java:606)
at IBM.idm.common.login.SignInBean.handleWeblogicAuthn(SignInBean.java:133)
at IBM.idm.common.login.SignInBean.doLogin(SignInBean.java:99)
at sun.reflect.GeneratedMethodAccessor5210.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at com.sun.el.parser.AstValue.invoke(AstValue.java:187)
at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:297)
Kindly guide me in how to remove this URL from the logs.
... View more
05-12-2017
12:15 AM
thanks dineshraj, regarding the two set of serverclass can i define like this
For unix :
[serverClass:Test-TAM]
whitelist.0 = testtam*
[serverClass:Test-TAM:app:Test-TAM]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
For windows:
[serverClass:Test-TAM2]
whitelist.0 = testtIM*
[serverClass:Test-TAM2:app:Test-TAM2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
thanks in advance.
... View more
05-11-2017
11:19 PM
thanks dineshraj, its much needed help. This is the first time I got a request to monitor the set of files. Similarly we have to monitor the below logs detail in splunk for the same severs. Can I configure the stanza like you had mentioned in above comments in the same inputs.conf stanza.
Log details to be monitored :
/opt/IBM/middleware/user_projects/domains/Test/servers/TAM_server*/logs/TAM_server*.out*
/opt/IBM/middleware/user_projects/domains/Test/servers/TAM_server*/logs/TAM_server*-diag*.log
/opt/IBM/middleware/user_projects/domains/Test/servers/cl_server*/logs/cl_server*.out*
/opt/IBM/middleware/user_projects/domains/Test/servers/cl_server*/logs/cl_server*-diag*.log
Inputs.conf stanza
[monitor:///opt/IBM/middleware/user_projects/domains/Test/servers/TAM_server*/logs/(.out|.log)]
index=app
sourcetype=IBM:AUT:TAM
blacklist = (.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$)
[monitor:///opt/IBM/middleware/user_projects/domains/Test/servers/cl_server*/logs/(.out|.log)]
index=app
sourcetype=IBM:AUT:TAM
blacklist = (.(tar|gz|bz2|tar.gz|tgz|tbz|tbz2|zip|z)$)
But it is necessary to configure the blacklist stanza ?.
thanks in advance
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-20-2025
08:58 PM
|
