About isoutamo

isoutamo · ‎06-28-2020

You could try this: | rex field=_raw ".*:(?<message>[^:]+)" r. Ismo

isoutamo · ‎06-28-2020

Then you could try this: | rex field=_raw ".*:(?<message>[^:]+)"

isoutamo · ‎06-28-2020

Hi, Those variables are in wrong order: | rex field=_raw ",description=(?<my_description>[^\"]+)" You could check these with https://regex101.com

isoutamo · ‎06-26-2020

When your servers are configured correctly with time zone information and you are using e.g. NTP to keep time in sync, then splunk automatically handles different time zones. R. Ismo

isoutamo · ‎06-26-2020

Hi you have exceed your daily ingesting amount at least on five days within last 30days. To resolve this you must ask from your splunk account manager a reset license to get over this situation. Also if your splunk is enough new version (6.6 or was it already 6.5?) you should ask no enforcement license to avoid this situation again. And of course you must update your license to cover your daily ingesting amount. r. Ismo

isoutamo · ‎06-26-2020

Couple of best practices which we are using: Always use LVM and volume groups on linux => You can extend space easily later one Add disk -> add it to vg -> extend current LV -> extend FS over that LV -> update indexes.conf to know bigger volume (if you are using volumes) xfs is your friends (at least in older linux versions we have had some issues with ext4) On splunk side use always volumes (after that your life is easier) As @gcusello said, use separate tiers for hot/warm and cold data If you are using Smartstore then there are some other guidelines to follow, partially little bit different than using only local storage Always ensure that your disks are fast enough! For high volume indexes use maxDataSize = auto_high_volume Add enough earlier new indexers not just additional disk space to current indexers. Usually it's good to user clusters as earlier as possible (even one node clusters for future expansions). r. Ismo

bowesmana · ‎06-25-2020

Hi @harkirat9712 So if I understand the data format correctly, the combined search could be index=TEST (sourcetype=source1 OR sourcetype=source2) (url="/api/v1/test" OR (url="/api/*/*/*" AND Response_Status="200")) | rex "'id':'(?<id>[\d.]+)" | eval matchUrl="\/api\/[^\/]*\/".id."\/.*" | where (url="/api/v1/test" OR match(url,matchUrl)) | table _time id url and the rex for the second would be index=TEST sourcetype=source1 url="/api/v1/test" | rex "'id':'(?<id>[\d.]+)" | table _time id | join max=0 id [ search index=TEST sourcetype=source2 url="/api/*/*/*" Response_Status="200" | rex field=url "\/api\/[^\/]*/(?<id>[\d.]+)\/" | rename _time as sub_time | table id sub_time url ] I hope this is what you need. I have just removed the values() part of what I thought was in the data, so now it's just looking for the id between the //

isoutamo · ‎06-25-2020

Have you check if this is already proposed on ideas.splunk.com? If not, maybe you should add it there! r. Ismo

isoutamo · ‎06-25-2020

Please remember that there are row and time out limits for sub searches.... Sometimes those will hit if you are have two many rows in sub search. In those cases you must divide this search to two part e.g. first create lookup and then queries values from it on the actual search. R. Ismo

isoutamo · ‎06-25-2020

It depends if you are using only inputs then indexers (or HFs) are enough, but if you are using also dbxquery etc. then it must be also in sh layer. Quite often java has installed under /opt. Check from correct installation manual how you should configure DBX when you are installing it. The easiest way is do it with GUI/web. Other option is do it via conf files, but I prefer GUI. r. Ismo

isoutamo · ‎06-22-2020

You still need to use @Richfez example with transaction to get the correct answer.

to4kawa · ‎06-22-2020

Hi @isoutamo your <![CDATA[ ... ]]> usage is nice. I'll use it.

isoutamo · ‎06-17-2020

If you are starting splunk with systemd, then you must update it’s config to use new additional memory. Just disable and then enable boot start or directly edit systemd startup config. r. Ismo

isoutamo · ‎06-14-2020

Hi have you try to put those passwords under local not to default directory? At least some times this has fixed it. r. Ismo

to4kawa · ‎06-03-2020

not working If you want to solve the problem, you have to talk about the situation or no one will know. | makeresults | eval _raw="Name,spent,income A,10,20 B,20,40 C,30,60 A,40,80 B,50,100" | multikv forceheader=1 | table Name,spent,income | stats sum(spent) as spent sum(income) as income by Name results Name spent income A 50 100 B 70 140 C 30 60

isoutamo · ‎05-12-2020

Did this help? If your script is specified with #! /usr/bin/env python, then python.version will be ignored for coldToFrozen. Also note that for warmToCold, this is always how the Python script is specified, so there is no applicable python.version for warmToCold. So try to specify path to python3 on the shebang.

richgalloway · ‎04-07-2020

timechart fails because stats is not passing on the _time field. See my corrected answer.

isoutamo · ‎03-06-2020

Hi If you have many separate transforms on props.conf for individual source/source type etc. try to combine those to one line e.g. TRANSFORMS-foo = foo1 TRANSFORMS-bar = bar1 To TRANSFORMS-foobar = foo1, bar1 This helps in our case after update 6.6.5 to 7.3.3. Ismo

smithjnick · ‎02-28-2020

Yep JP - that fixed the issue - those damn quotation marks. thank you muchly and have a great weekend.

isoutamo · ‎02-27-2020

Yes that’s correct. You must ask that update from Splunk. Ismo

rfeddal · ‎03-05-2020

I resolved my issue: The source added in the second index was the same of the first one. So I deleted the second sourcetype, deleted the both indexes and recreated them, then it I re-found my 7 sourcetypes.

PaulJGreene · ‎03-04-2020

Note to soutamo, There was a deploymentclient.conf file, and it was pointing to the correct server:port#. It didn't have a [deployment-client] stanza though, so I added that, per the document you linked to.

ekost · ‎03-04-2020

Happy to help! Hopefully you have some time to implement the changes, and document what you find as you go for later internal reference. You also have your Sales Engineer to reach-out to with questions.

123michi19 · ‎02-20-2020

Thanks for your help 🙂

isoutamo · ‎02-20-2020

Or you can try to use ‘FIELD.NAME’ instead of FIELD.NAME.

Posts	4262
Solutions	468
Karma Given	456
Karma Received	1275
Member Since	‎14-02-2017

Online Status	Online
Date Last Visited	5 hours ago

Find enabled windows inputs by SPL query?

Why can't I change alert with REST- It change perm...

Why does Splunk_TA_aws hang on configure / inputs ...

Don't execute rest of commands if there is no even...

Indexing Ubisecure Ubilogin logs?

Fieldformat didn't work with foreach

Cannot migrate DBConnect 2.4.0 -> 3.2.0 on Splunk ...

How to check splunk multisite cluster status after...

Re: Field extraction, string after last colon

Re: regex everything after last colon in each line

Re: Regular expression in "|rex field" to return ...

Re: how to find time difference between UF and HF

Re: License error

Re: Linux add disk space for Splunk indexes and l...

Re: Join and pass value to sub search

Re: How to easily copy alerts to another instance?

Re: Search based on results of another search?

Re: The Java Bridge server is not running

Re: How can I search for two different events tha...

Re: Is it possible to override a base search <earl...

Re: High Memory on Indexers

Re: Unhash password found on Slave-apps

Re: need to use Group By here in my result

Re: How to force Splunk to use Python 3 for our ap...

Re: Subsearch produced 50000 results, truncating t...

Re: 8.0.1 upgraded Heavy Forwarder- TcpOutputProc ...

Re: How to populate a null field if certain field ...

Re: Update the email on my certification request f...

Re: Why all my sourcetypes are not showing up in w...

Re: How to get domain controllers sending event lo...

Re: Migrating Splunk data from one server (6.3.2) ...

Re: Basic commands with SPL

Re: Coalesce function not working with extracted f...