About richgalloway

richgalloway · ‎05-15-2023

As you've discovered the rest command only issues GET requests. Any operation requiring a POST or DELETE request must come from something other than the Splunk UI.

richgalloway · ‎05-15-2023

I wonder if the problem lies with the stanza name rather than the LINE_BREAKER setting. If the name in a source::// stanza doesn't match the name of the data source then the settings will not be applied. A source named "kafka_metrics://kafka_metrics" seems like a rather odd file name. Are you sure that's the correct source name? How are you obtaining the name?

richgalloway · ‎05-15-2023

Examine the logs to see if they contain information that satisfy your Splunk use cases. See https://community.splunk.com/t5/Splunk-Cloud-Platform/Determining-the-logs-and-sourcetype-for-usecases/m-p/643164#M2235

richgalloway · ‎05-15-2023

richgalloway · ‎05-15-2023

I recommend creating a role and account only for running scheduled searches. Don't use 'nobody'. Having a role just for scheduled searches makes it much easier to manage the resources it can use.

richgalloway · ‎05-14-2023

I don't know what apps you have installed so I can only guess about where the changes should be made. Look for an app with "fluentd" in the name. If you don't have one, then look in splunkbase (apps.splunk.com) for one; otherwise, create one. The props.conf file will be in the fluentd app on the indexers. The app is uploaded to the Splunk Cloud UI and is distributed to indexers automatically. The inputs.conf file(s) will be on the forwarders, either in the same app or a different one. The app is loaded from the DS so that is where you should make changes. Sorry for the vagueness of this answer, but there is no single way to do many things in Splunk and I don't know enough about your environment to be specific.

richgalloway · ‎05-14-2023

"its not working" isn't helpful. Did you restart the indexer(s)? Are you looking at data that was onboarded after the change (and restart)? Existing data won't change. Can you share raw data (before Splunk touches it)?

richgalloway · ‎05-13-2023

The way I read the manual, the blacklist1 setting is only for WinEventLog inputs. Use blacklist (without a digit) for monitor inputs. [monitor:///var/log/*] crcSalt = <SOURCE> blacklist = \.gz$

richgalloway · ‎05-12-2023

Knowing what index the offending sourcetype is in is only part of the battle. Next, use your Splunk skills to find which host(s) send the data and the original source file. This information will help you identify the inputs.conf file to change. Once you've found the inputs.conf file, modify the appropriate stanza to include a sourcetype setting (sourcetype=itops, for example). The next step is to create a matching stanza in a props.conf file on the indexers. In an appropriate app, edit props.conf to include the "Great Eight" attributes. [itops] TIME_PREFIX = TIME_FORMAT = MAX_TIMESTAMP_LOOKAHEAD = TRUNCATE = SHOULD_LINEMERGE = LINE_BREAKER = EVENT_BREAKER_ENABLE = true # Set to the same value as LINE_BREAKER EVENT_BREAKER = Set each value based on the events received with that sourcetype. Yes, another option is to not ingest this data. If you don't use it then there's little point in paying to ingest it.

richgalloway · ‎05-12-2023

UFs do not have the ability to filter data. That requires a Heavy Forwarder (HF) and is done the same way as on an indexer.

richgalloway · ‎05-12-2023

It looks like the LINE_BREAKER setting needs to be adjusted. The current setting has Splunk looking for the string "confluent_kafka_" followed by a space, but that does not match what is in the event. Additionally, the first capture group, which is always discarded by Splunk, appears to contain important information. Try LINE_BREAKER = ()confluent_kafka_server_request_bytes\{

richgalloway · ‎05-12-2023

There is nothing you need to do. The message is informational and is just Splunk telling you what it is doing.

richgalloway · ‎05-12-2023

Try this rex command. | rex field=foo "(?<user>\S+)\s\((?<host>=[^\(]+)"

richgalloway · ‎05-12-2023

That's something only you or someone else familiar with your Splunk environment can answer specifically. The apps to update are those that define inputs and do not specify sourcetypes.

richgalloway · ‎05-12-2023

That's not much for a prop.conf stanza. It's hard to be certain without seeing sample data, but you may need additional settings. Consider adding the "Magic Six" attributes. TIME_PREFIX TIME_FORMAT MAX_TIMESTAMP_LOOKAHEAD SHOULD_LINEMERGE LINE_BREAKER TRUNCATE

richgalloway · ‎05-12-2023

Failing to parse timestamps is a different problem. Please post a new question so this one can focus on the line breaking problem. What do you mean by "all logs fall under a single line"? The sample events appear to be multi-line.

richgalloway · ‎05-12-2023

This can happen if Splunk treats a single log entry as a multiple events because the line breaking settings in props.conf are incorrect. I understand you verified the props.conf, but it's possible that 2 or 3 times a month a log entry is created which does not match the props.conf settings. If you are using indexer acknowledgement then duplication of events is very possible. It will happen when a UF re-sends events after an ack was lost or arrived late.

richgalloway · ‎05-12-2023

Assuming "indexname" is a placeholder for the name of index sought, then the syntax is correct. It's possible the index name is not specified in any inputs.conf file. Also, if the Splunk instance does not perform inputs then there may be no inputs.conf files for btool to display. If you run Splunk on Linux and you have access to the CLI then the OS may be able to find the file. Run this command on your Deployment Server and SHC Deployer (or standalone instance, if that's all you have). find /opt/splunk/etc -name inputs.conf -print0 | xargs -r0 grep "indexname"

richgalloway · ‎05-12-2023

See https://community.splunk.com/t5/Splunk-Cloud-Platform/How-to-determine-which-logs-are-being-utilized-for-specific/m-p/642987/highlight/true#M2220

richgalloway · ‎05-12-2023

There isn't a one-click answer to this question. Each dashboard or use-case will have to be researched separately. Simply put, run the base search (everything before the first pipe) and append | stats count by source. That will produce a list of sources used by that search/use-case. If the search contains subsearches (via join or append commands then combine the base searches of each subsearch with the base search of the main search using append. <<base search>> | append [ <<text before first pipe of subsearch1>>] | append [ <<text before first pipe of subsearch2>>] | stats count by source This method doesn't apply to searches that start with a generating command (tstats, dbxquery, inputlookup, etc.). Be aware that some sources change names every day.

richgalloway · ‎05-12-2023

As the message says, the LINE_BREAKER attribute must contain a capture group (a set of parenthses). Try LINE_BREAKER = ()^\{ You only need to specify LINE_BREAKER once in a stanza.

richgalloway · ‎05-12-2023

Copy the MC search and modify it to suit your purposes. You can copy an MC panel by clicking on the magnifying glass icon in the bottom-right corner of the panel.

richgalloway · ‎05-12-2023

I'm sorry, but I can't help with this question as it is currently written. There are too many inconsistencies in the sample output so I can't figure out what logic to implement.

richgalloway · ‎05-11-2023

The description does not match the SPL which doesn't match the output. The SPL increments Inspection_Count each time the Mac_ID field contains the value "Serial num" [sic]. That means the Inspection_Count column should start at zero and increase by one at rows 2, 6, 9, 14, 16, 21, and 23. I see nothing special about row 26.

richgalloway · ‎05-11-2023

Make sure your Windows account is allowed to write to \Program Files. See https://learn.microsoft.com/en-us/troubleshoot/windows-server/application-management/msi-installation-error-1603 for information about the error.

Posts	16784
Solutions	2989
Karma Given	2040
Karma Received	6728
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	11 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Is it possible to run a Splunk search via the ...

Re: events breaking using props conf

Re: How to ingest the all logs into single sourcet...

Re: events breaking using props conf

Re: How to configure settings for the "nobody" use...

Re: How to ingest the all logs into single sourcet...

Re: events breaking using props conf

Re: I want to blacklist the .gz files in input.con...

Re: How to ingest the all logs into single sourcet...

Re: How do i ignore few keyword contained events a...

Re: events breaking using props conf

Re: Splunk input offset

Re: how to split a field into 2 different fields u...

Re: How to ingest the all logs into single sourcet...

Re: Event mismatch in data. event count is higher ...

Re: Linebreaking regex has no capturing groups

Re: Event mismatch in data. event count is higher ...

Re: Using btool to find an index in a monitor stan...

Re: Determining the logs and sourcetype for usecas...

Re: How to determine which logs are being utilized...

Re: Linebreaking regex has no capturing groups

Re: highest resource consumption alerts

Re: How to change count value?

Re: How to change count value?

Re: Universal forwarder setup wizard ended prematu...

Join the Conversation