About isoutamo

isoutamo

Please create a new question as this one is already solved and you seems to have some different requirements.

isoutamo

Hi Every apps has app.conf file under <app>/default. There is defined app's name and some other parameters. You must change those in this file. Then the name of app will changed on your GUI too. r. Ismo

isoutamo

Ok, then it’s best to wait resolution for your P2 case.

isoutamo

Can you give any sanitized sample data? It's enough that fields are extracted, but not need to index those in ingesting phase?

isoutamo

Is it possible to extract those xml parts 1st and then use xmlkv command to those?

isoutamo

I mean that you should use " in this search | search test_field_name="test_field_name_1"

isoutamo

Hi You should use “ with your field value name. Otherwise splunk think that your value is field name. r. Ismo

isoutamo

As already mentioned all those numbers are from 0 to something not 1 to something!

isoutamo

Based on docs this should works. BUT on example part those platform selections have done on app not serverclass level. Maybe you should try that? Btw have you configured this by gui or manually with text editor?

isoutamo

Have you local indexes on DS or are you sending logs to your real indexers? This has changes on 9.2.x and it could cause something weird.

isoutamo

Hi can you told the base information of your environment (OS, version, splunk version, TA versions, UF versions etc.)? Have you update something lately etc.? r. Ismo

isoutamo

Hi in splunk you can get it like | makeresults | eval _raw = "Ex:- <abc>WoW</abc> <xyz>SURE</xyz>" ``` above prepare test event ``` | rex "(?ms)<abc>(?<abc>[^<]+)<\\/abc>.*<xyz>(?<xyz>[^<]+)<\\/xyz>" A nice place to test those is regex101.com. Here is link to your case https://regex101.com/r/iBvAPm/1 When you are converting those for Splunk, usually there is need to add some additional escape character as splunk preprocessing that reg ex and remove some \ characters r. Ismo

isoutamo

Please create a support case on Splunk Support to ask this option.

isoutamo

I didn’t add those to previous messages as answered by phone. You could look those from https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/TroubleshootSmartStore

isoutamo

You should look e.g where an isnull function. With it you could drop unwanted rows away.

isoutamo

Exactly that way. So you must select which one those are and based on that select SEDCMD or transforms.

isoutamo

Then I propose you to use transforms.conf and send those lines into dev null. There are quite many examples on community and also on docs. See e.g. https://community.splunk.com/t5/Getting-Data-In/sending-specific-events-to-nullqueue-using-props-amp-amp/m-p/660688 just replace that REGEX to match your line or beginning of your line. Basically SEDCMD do almost same. It just clears that line but it didn't remove it. Basically there are sill "empty" line on your log events, not removed line.

isoutamo

Fieldformat is just to keep those values as numbers instead of covert those to string as happened with eval.

isoutamo · ‎03-25-2024

It would be nice to get the real log format in the first phase not after 1st version has resolved! Do all valid log rows starting with ##? If so then you should add transforms.conf which drop away other lines. If there is not any way to recognise those without looking ##start_string and ##end_string then you probably must write some preprocessing or your own modular input. Splunk's normal input processing handling those lines one by one and it cannot keep track other lines and is there happening something or not.

isoutamo · ‎03-24-2024

Hi why you want keep kvstore running on your HFs? Usually it’s not needed there! Only reason why you need it, is some modular input which keep its checkpoint there. Usually this means that you have wrote it by yourself. If you really need it, then add HF as indexer on your MC and use it for monitoring. r. Ismo

isoutamo · ‎03-23-2024

All those errors should be on internal logs. Currently quite many TAs are using those too. Those have own log files as a source in _internal. You should just query those from it and look what you have.

isoutamo · ‎03-22-2024

Hi normally you could use e.g. stats to do correlation between events. In your case try e.g. ... | stats first(_time) as _time values(*) as * by SessionID This will generate one event by each SessionID with contains other fields as multivalue fields or if values was same in all combined events then normal field. r. Ismo

isoutamo · ‎03-22-2024

Is there any word or some token how you know where first xml part will ends or is it just end of line and then 3rd line is some other text?

isoutamo · ‎03-22-2024

Have you check that your IAM roles are still correctly defined and valid for your node? Can you run those S3 access test commands?

isoutamo · ‎03-22-2024

You could try to ask it from Splunk Support or your account manager.

Posts	4215
Solutions	465
Karma Given	453
Karma Received	1259
Member Since	‎14-02-2017

Online Status	Offline
Date Last Visited	Tuesday

Find enabled windows inputs by SPL query?

Why can't I change alert with REST- It change perm...

Why does Splunk_TA_aws hang on configure / inputs ...

Don't execute rest of commands if there is no even...

Indexing Ubisecure Ubilogin logs?

Fieldformat didn't work with foreach

Cannot migrate DBConnect 2.4.0 -> 3.2.0 on Splunk ...

How to check splunk multisite cluster status after...

Re: How to migrate a distributed, clustered Splunk...

Re: Apps

Re: Deployment Server clients have wrong apps

Re: Want to write rex in props to extract field fr...

Re: Want to write rex in props to extract field fr...

Re: splunk search lookup help

Re: splunk search lookup help

Re: cron schedule

Re: Deployment Server clients have wrong apps

Re: Deployment Server clients have wrong apps

Re: Deployment Server clients have wrong apps

Re: Want to write rex in props to extract field fr...

Re: Error calling execve(): No such file or direct...

Re: Splunk Stuck Checking Indexes when using Smart...

Re: correlate value using common field

Re: Adding custom data from file

Re: Adding custom data from file

Re: Having a space as the thousands separator, an...

Re: Adding custom data from file

Re: monitoring KV store status of heavy forwarders

Re: Errors

Re: correlate value using common field

Re: extract only xml part from an event

Re: Splunk Stuck Checking Indexes when using Smart...

Re: Is AIX 6.1 supported backward compatible with ...