Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About leandromatperei
leandromatperei
Path Finder
Member since:
11-12-2019
01-20-2022
Community Statistics
| Posts | 84 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-12-2019 |
Activity Feed
- Posted Re: Splunk regex ignore fields before match on Splunk Search. 01-06-2022 11:05 AM
- Posted Splunk regex ignore fields before match on Splunk Search. 01-06-2022 10:26 AM
- Tagged Splunk regex ignore fields before match on Splunk Search. 01-06-2022 10:26 AM
- Posted Splunk regex ignore fields before match on Splunk Enterprise. 12-02-2021 12:20 PM
- Posted regex splunk log json on Splunk Enterprise. 11-08-2021 06:51 AM
- Tagged regex splunk log json on Splunk Enterprise. 11-08-2021 06:51 AM
- Posted Hide and Show Input Dropdown on Splunk Enterprise. 03-21-2021 07:16 AM
- Posted Change Values Indexation on Splunk Enterprise. 03-20-2021 10:01 AM
- Tagged Change Values Indexation on Splunk Enterprise. 03-20-2021 10:01 AM
- Posted Re: Splunk Tile Maps on Splunk Enterprise. 03-20-2021 05:51 AM
- Posted Splunk Tile Maps on Splunk Enterprise. 03-20-2021 03:55 AM
- Posted Re: Define identification field on Splunk Enterprise. 03-19-2021 05:44 PM
- Posted Re: Define identification field on Splunk Enterprise. 03-19-2021 05:08 PM
- Posted Define identification field on Splunk Enterprise. 03-19-2021 03:41 PM
- Tagged Define identification field on Splunk Enterprise. 03-19-2021 03:41 PM
- Posted extract some text into a field with rex on Splunk Search. 03-12-2021 04:34 AM
- Posted How can I configure Splunk to read a csv file from a sourcetype on Splunk Enterprise. 03-05-2021 05:03 AM
- Posted Replace values in query on Splunk Enterprise. 02-04-2021 06:16 AM
- Posted Using rex to filter fields on Splunk Search. 12-04-2020 06:31 AM
- Tagged Using rex to filter fields on Splunk Search. 12-04-2020 06:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-03-2020
04:03 PM
Hello, does anyone have any success stories using the Genesys logs in Splunk?
... View more
- Tags:
- sourcetype
Labels
- Labels:
-
configuration
08-28-2020
05:10 PM
Hello Everyone, I am new to base search and need some help from you. The query is taking a while, I would like to create base search to load faster. Basically, I want to count error data 200 and 400 by hosts, action and referer_domain. Below is the xml. Can you help me? <dashboard theme="dark">
<label>INDEX WEB</label>
<row>
<panel>
<title>GET POR HOSTS</title>
<chart>
<search>
<query>index=web source="access.log" "GET" | stats count by host</query>
<earliest>0</earliest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<title>STATUS 200 POR ACTION</title>
<chart>
<search>
<query>index=web source="access.log" status=200 | stats count by action</query>
<earliest>0</earliest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<title>referer_domain</title>
<chart>
<search>
<query>index=web status=200 | stats count by referer_domain</query>
<earliest>0</earliest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>POST POR HOSTS</title>
<chart>
<search>
<query>index=web source="access.log" "POST" | stats count by host</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<title>STATUS 400 POR ACTION</title>
<chart>
<search>
<query>index=web source="access.log" status=400 | stats count by action</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
<panel>
<title>referer_domain</title>
<chart>
<search>
<query>index=web status=400 | stats count by referer_domain</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</dashboard>
... View more
- Tags:
- base search
Labels
- Labels:
-
other
08-28-2020
02:52 PM
I have some dashboards in Splunk and I would like to use basesearch so that they load a little faster, I don't have much experience with this use. I have the example of xml using the data provided by Splunk itself, could you help me in the best way how to use basesearch in these panels? <form theme="dark">
<label>2808 Leandro Matos</label>
<fieldset submitButton="false" autoRun="false">
<input type="checkbox" token="checkhost" searchWhenChanged="true">
<label>Selecione o Host</label>
<valuePrefix>host="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>index=web
| table host
| dedup host</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
<choice value="*">ALL</choice>
</input>
<input type="multiselect" token="multiselect" searchWhenChanged="true">
<label>Selecione os endereços de IP</label>
<prefix>clientip IN (</prefix>
<suffix>)</suffix>
<delimiter>, </delimiter>
<fieldForLabel>clientip</fieldForLabel>
<fieldForValue>clientip</fieldForValue>
<search>
<query>index=web
| table clientip
| dedup clientip</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="*">ALL</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="link" token="listcategoria">
<label>Selecione a Categoria:</label>
<choice value="*">ALL</choice>
<fieldForLabel>categoryId</fieldForLabel>
<fieldForValue>categoryId</fieldForValue>
<search>
<query>index=web
| table categoryId
| dedup categoryId
| sort categoryId</query>
<earliest>0</earliest>
<latest></latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=web $multiselect$ | stats count by clientip</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=web categoryId=$listcategoria$ | stats count by categoryId</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=web $checkhost$ | stats count by host</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Mapa</title>
<input type="time" token="time" searchWhenChanged="true">
<label>Selecione o range de tempo</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<html/>
<html>Selecione a posição no mapa para detalhamento na tabela</html>
<map>
<search>
<query>index=web | iplocation clientip | geostats count by Country</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="mapping.type">marker</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="map.click.south">$click.bounds.south$</set>
<set token="map.click.east">$click.bounds.east$</set>
<set token="map.click.north">$click.bounds.north$</set>
<set token="map.click.west">$click.bounds.west$</set>
</drilldown>
</map>
<html/>
</panel>
<panel>
<title>Lista de IP's</title>
<table>
<search>
<query>index=web
| iplocation clientip prefix=client
| table client*
| search clientlat >= $map.click.south$
clientlat <= $map.click.north$
clientlon >= $map.click.west$
clientlon <= $map.click.east$</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<title>Hosts</title>
<input type="time" token="time2" searchWhenChanged="true">
<label>Selecione o intervalo de tempo</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<html/>
<chart>
<search>
<query>index=web | stats count by host</query>
<earliest>$time2.earliest$</earliest>
<latest>$time2.latest$</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">column</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"count": "#00FFFF"}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="refresh.display">progressbar</option>
</chart>
<html/>
</panel>
</row>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html>
<style>
.dashboard-body {
background: #f28500 !important;
}
.dashboard-panel{
border-radius: 20px;
}
h2{
color: #f28500;
}
</style>
</html>
</panel>
</row>
</form>
... View more
- Tags:
- base search
Labels
- Labels:
-
timechart
08-15-2020
09:05 PM
I thought a regex would be necessary, how were your settings in time format and time prefix? Sorry I'm a little new in this part, I only know the SPL part
... View more
08-15-2020
08:28 PM
Can you give me any tips regarding the indexing regex?
... View more
08-15-2020
08:13 PM
Could you give an example of how I could configure the props.conf file to index this type of log?
... View more
08-15-2020
06:42 PM
friends, I need help to be able to index this data in Splunk. The date and time format has 03 hours more GMT than my current time, so a log for example that is 10:00 am in the vdd is 07:00 Here is an example of a file: See that the beginning of the log indicates the time and day (16), but in fact we are on the 15th from 10:00 (03 hours less), can you help me? I tried to use a standard indexing sourcetype but it didn't work. 16 01:04:59.152) From: <sip:10.56.106.39:5060;transport=tcp>;tag=101cad68-276a380a-13c4-61010-10b8b-55341977-10b8b (16 01:04:59.152) To: <sip:10.55.115.12:5060;transport=tcp>;tag=15616914053140452_local.1595388622658_5585445_5703986 (16 01:04:59.152) Via: SIP/2.0/TCP 10.56.106.39:5060;rport=62175;branch=z9hG4bK-10b8b-4151957-51c18034-fa23450 (16 01:04:59.152) Record-Route: <sip:SM-CTSP-01@10.55.115.12;av-asset-uid=rw-2a64a6b3;lr;transport=TCP> (16 01:04:59.152) Av-Global-Session-ID: 83e241d0-df5c-11ea-b2f4-005056866260 (16 01:04:59.152) Server: AVAYA-SM-7.1.3.4.713406 (16 01:04:59.152) Contact: <sip:10.55.115.12:5060;transport=tcp> (16 01:04:59.152) Content-Length: 0 (16 01:04:59.152) (16 01:04:59.152) (16 01:04:59.152) <<<<< received: SIP/2.0 200 OK (16 01:04:59.152) Call-ID: 101caf18-276a380a-13c4-61010-10b8b-40841bfc-10b8b (16 01:04:59.152) CSeq: 460658901 OPTIONS (16 01:04:59.152) From: <sip:10.56.106.39:5060;transport=tcp>;tag=101caf18-276a380a-13c4-61010-10b8b-490db803-10b8b (16 01:04:59.152) To: <sip:10.55.115.14:5060;transport=tcp>;tag=9708321523057227_local.1595385862537_5573806_5690910 (16 01:04:59.152) Via: SIP/2.0/TCP 10.56.106.39:5060;rport=62176;branch=z9hG4bK-10b8b-4151957-2000a9d0-fa235d0 (16 01:04:59.152) Record-Route: <sip:SM-CTSP-02@10.55.115.14;av-asset-uid=rw-338e8404;lr;transport=TCP> (16 01:04:59.152) Av-Global-Session-ID: 83e2b700-df5c-11ea-a9a2-00505686cdac (16 01:04:59.152) Server: AVAYA-SM-7.1.3.4.713406 (16 01:04:59.152) Contact: <sip:10.55.115.14:5060;transport=tcp> (16 01:04:59.152) Content-Length: 0 (16 01:04:59.152) (16 01:04:59.152) (16 01:05:12.319) <<<<< received: OPTIONS sip:10.56.106.39 SIP/2.0 (16 01:05:12.319) Via: SIP/2.0/UDP 10.225.86.50:5060;branch=z9hG4bK24d305d2 (16 01:05:12.319) Max-Forwards: 70 (16 01:05:12.319) From: "asterisk" <sip:asterisk@10.225.86.50>;tag=as232a75bf (16 01:05:12.319) To: <sip:10.56.106.39> (16 01:05:12.319) Contact: <sip:asterisk@10.225.86.50:5060> (16 01:05:12.319) Call-ID: 0e70a5de2b61b2c801b75e171774e189@10.225.86.50:5060
... View more
- Tags:
- sourcetype
Labels
- Labels:
-
configuration
08-11-2020
11:06 AM
Dear, I need to identify some duplicate events that are right after the "Call-ID:", however in Splunk I am not getting him to identify this field: index=teste "*CALL-ID*" : Aug 11 14:50:42 10.178.214.7 1 2020-08-11T14:50:41.979000-03:00 localhost GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:42" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 2932867290-4209
Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.326000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006
Aug 11 14:50:34 10.53.96.71 1 2020-08-11T14:50:25.080000-03:00 G7500-4D2120F2 GroupSeries - - [NXLOG@14506 EventReceivedTime="2020-08-11 14:50:34" SourceModuleName="plcmlog" SourceModuleType="im_file"] CEng: SIPMSG: Call-ID: 1112255280-4006
... View more
- Tags:
- regex
Labels
- Labels:
-
regex
08-04-2020
02:06 PM
I would like to put together a graph with the difference of values as a percentage, so I can use the single value and if it is above 70% it would turn red. index="teste" "ProcessInboundEmail" | timechart span=10m dc(id_email) as ProcessInboundEmail
| appendcols [search index="teste""submitInboundEmail" ended | timechart span=10m dc(id_email) as submitInboundEmail]
| eval diff = ProcessInboundEmail - submitInboundEmail | eval diff=if(ProcessInboundEmail< submitInboundEmail, diff * -1, diff) can you help me?
... View more
- Tags:
- diff
Labels
- Labels:
-
stats
07-21-2020
08:58 AM
I have the result below in a table, but for some technical reasons I need to check these values in a bar chart, but as the field is a string containing date and time I am not able to perform the conversion index=teste "EnviaSMS" | table _time, enviaSMS, GravaDB, VerificaTotal
| rename VerificaTotalSec As "Verifica - TotalEmSegundos" | sort -_time Application Log: 2020-07-21T12:49:40.168 Dbg 09900 [000c02f527958102] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s16ms - VerificaTotal:0h0m0s172ms
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s155ms
2020-07-21T12:49:40.136 Dbg 09900 [000c02f527957636] [Tempos] - EnviaSMS:0h0m0s0ms - GravaDB:0h0m0s0ms - VerificaTotal:0h0m0s160ms How could I calculate the last 60 minutes on a line graph displaying the information in the 03 columns?
... View more
Labels
- Labels:
-
regex
06-16-2020
10:07 AM
I have the following query below, I need to generate a third column or generate an alarm when the values generated are 80% higher than the last 07 days earliest=-7d@d index=txt | eval ELAPTIME = round(ELAPTIME / 100,2)/60 | timechart eval(round(avg(ELAPTIME),2)) as "Job Execution" Result Splunk: _time Job Execution 2020-06-09 55.00 2020-06-10 51.74 2020-06-11 55.74 2020-06-12 70.00 2020-06-13 90.00 2020-06-14 85.00 2020-06-15 150 Note that on June 15, the job had a problem because of his time that was 80% above the other days.
... View more
06-16-2020
08:23 AM
I would like a third column with a written value that is above the threshold or not, if it is below 80% of the previous value. Ex: 2020-06-16 09:00:00 2000 2020-06-16 09:30:00 4666 2020-06-16 10:00:00 3798 In the period from 09:30 until 10:00 the volume is ok, since the data volume is above 80%. However between 09:00 and 09:30 the value was less than 80%, so I would have to alarm.
... View more
06-16-2020
06:33 AM
Hello, I would like a support for a query to compare the values of the last 30 minutes, if it is below 80% of the volume, generate another column in red or exceed the limit. Ex: index="txt" "Retrieving message #" | timechart span=30m count as server Command Result: _time server 2020-06-16 08:00:00 857 2020-06-16 08:30:00 1605 2020-06-16 09:00:00 4507 2020-06-16 09:30:00 4666 2020-06-16 10:00:00 3798 In this case, the first two volumes were below expectations.
... View more
Labels
- Labels:
-
stats
04-07-2020
06:33 AM
https://www.dropbox.com/s/zfr9g9e6n8hsfzj/qtd_ramal_diario_05042020.txt?dl=0
... View more
04-07-2020
06:23 AM
@to4kawa , I configured the structure below using props.conf and transform.conf, however, the following points did not work:
My file name maintains a structure "qtd_ramal_diario_DDMMAAAA.txt", for example, the file "qtd_ramal_diario_05042020.txt" needs to be indexed in Splunk on 05/05/2020, how to select how to use this configuration file?
Another point I need that all the lines of my file are indexed to each of the events in Splunk, sending the complete file for analysis.
For example, if my file has 200 lines, it needs to be 200 events in Splunk.
**props.conf**
[linux-nice]
REPORT-fields = commafields
**transforms.conf**
[commafields]
DELIMS = ";"
FIELDS = field1, field2, field3
... View more
04-06-2020
01:41 PM
Thank you for your help.
This file is generated every day, what would the configuration of props.conf look like?
... View more
04-06-2020
08:38 AM
Hello everyone,
I have the attached file that is generated every night through my client's internal system and I need to index the information to collect metrics.
I need these files to be indexed based on their date in the file name.
Ex: The name of the file generated by the system is (qtd_ramal_diario_04042020.txt, qtd_ramal_diario_05042020.txt, etc.), so I need it to be indexed according to the time in the file name.
I need to extract the information that is between ";" in separate fields with the names (Field1, Field2, Field3) respectively.
Remembering that this file is variable, there are days that generate many lines and others do not.
FIELD1 FIELD2 FIELD3
77111010; 8; 614
77111812; 1; 106
77115070; 1; 58
70666287; 4; 171
70662245; 12; 708
77196074; 23; 1439
Is there a way to do this with Splunk?
Below is an example of the generated log:
78122960;2; 132
55002801;3; 279
8068256;8; 466
80661008;4; 134
55258888; 21;1843
76283160;1;25
55735555; 15;1027
55191240;1; 267
80662176;2; 249
790965034;3;93
55159608;1;20
80668021;1;19
76282680;2; 154
80664441;5; 536
71172794;1;28
55196157; 16;1208
55192425;3; 347
55196091;1;23
55192404;1;71
55196032; 24; 996
55196553;2;78
55196040;4;1087
55196426;1; 152
78111816;2; 157
78111847;1;30
78111815;6; 429
78111814;3; 233
55021902;2; 278
55034140;4; 159
550364331;1;80
550561127;2;78
... View more
04-03-2020
05:40 AM
The 06 fields are always listed, what changes is the size of the affected lines that is linked to the number of agents.
Now the fields are always 06 (Agent Name, Channel, Extension, Logger Id, Call Day)
... View more
04-02-2020
04:51 PM
Hello everyone.
I need to index the logs below and the example that is on my Dropbox link in a new sourcetype.
The event line break occurs through the timestamp at the beginning of each interaction: "2020-04-02 22:09:52,416", this is the time format of my log.
Another point is that it is added with a time zone of 03 hours more, so for example:
- The log of the time "2020-04-02 22:09:52,416" should be indexed in Splunk with the time "2020-04-02 19:09:52,416", if it is not clear I will explain it again.
Can you help me how to set up this sourcetype in props.conf?
Link Dropbox:
https://www.dropbox.com/s/qn2b2vnjyo1t0mj/server.txt?dl=0
2020-04-02 21:57:38,063 INFO ecp-1-1784929 25000 ExtractWindow: CFG, [2020-02-28 05:53:42,2020-04-02 21:57:14(1582869222,1585864634)]
*** SESSIONS(2):
2020-04-02 21:32:52,779 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan - exit(elapsed 47 ms) returning 43
2020-04-02 21:32:53,278 WARN ecp-1-872908 20000 User data mapping and data base schema validation warnings:
Default value in data base schema for user dimension column USER_DATA_CUST_DIM_2.SEGMENTO is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_13.CORRENTISTAS is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_13.MULTIPLO is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_13.TPESSOA is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_13.AVI is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_13.ELEG is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_14.ASSUNTO is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_14.PRODUTODN is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_14.CONPO is empty, will use hardcoded default: none
Default value in mapping for user dimension column USER_DATA_CUST_DIM_15.FIDELIZA is empty, will use hardcoded default: none
2020-04-02 21:32:53,278 INFO ecp-1-872908 30000 JobTransform: SERVICE_OBJECTIVE default is = -1
2020-04-02 21:32:53,278 INFO ecp-1-872908 30000 JobTransform: creating Lookup ...
2020-04-02 21:32:53,278 DEBUG ecp-1-872908 35000 COMMIT: 2004326974; called by com.genesyslab.gim.etl.jobs.transform.JobTransform.init(JobTransform.java:269)
2020-04-02 21:32:53,278 INFO ecp-1-872908 30000 JobTransform: initialized
2020-04-02 21:32:53,309 INFO ecp-1-872908 30042 Job step INIT completed successfully.
2020-04-02 21:32:53,309 INFO ecp-1-885538 30041 Job step AGENTtoRESOURCE started.
2020-04-02 21:32:51,999 DEBUG ecp-1-872908 35000 ConcurrentUtils.shutdown: all tasks completed, executor terminated
2020-04-02 21:32:51,999 INFO ecp-1-872908 20104 Job 'Job_ExtractICON' completed successfully.
2020-04-02 21:32:51,999 INFO ecp-1-872908 25000 Execution Info
+[Job_ExtractICON].....................................................21653 ms. Invocations 1
|-- [INIT]................................................................15 ms. Invocations 1
|--+[RUN]..............................................................20905 ms. Invocations 1
|-- [TRUNCATE_TMP]....................................................203 ms. Invocations 1
|--+[EXTRACT].......................................................20670 ms. Invocations 1
|--+[ExtractAndMerge]............................................13417 ms. Invocations 1
|--+[ExtractTriplets]..........................................2886 ms. Invocations 1
|-- [G_IR]..................................................3181 ms. Invocations 7
|-- [G_CALL]................................................8859 ms. Invocations 7
|-- [G_IS_LINK].............................................3135 ms. Invocations 7
|--+[MergeMove]...............................................10359 ms. Invocations 1
|-- [insertIRs4ConCalls2TmpMerge](0).........................499 ms. Invocations 1
|--+[insertClassifiedIsLinks](5993)..........................561 ms. Invocations 1
|-- [classify links - join](5993).........................234 ms. Invocations 1
|-- [classify links - insert](5993).......................171 ms. Invocations 1
|-- [insertIsLinks2TmpMerge](1058)............................93 ms. Invocations 1
|-- [update_G_CALL_ROOTIRID](1533)...........................561 ms. Invocations 2
|-- [update_G_IR_ROOTIRID](1096).............................156 ms. Invocations 2
|-- [insertIRs2TmpMerge](38).................................218 ms. Invocations 1
|-- [updateTO_CYCLE](0)......................................234 ms. Invocations 4
|-- [updateRootIrInTmpMerge](41).............................156 ms. Invocations 4
|-- [updateRootirInTmpMerge2](3937)..........................141 ms. Invocations 1
|-- [insertPendingRootIrs2TmpMerge](1881).....................47 ms. Invocations 1
|-- [insertNotPendingRootIrs2TmpMerge](3648).................187 ms. Invocations 1
|-- [insertNotPendingLinks](2116)............................593 ms. Invocations 1
|-- [deleteNotPendingLinks](2116)............................124 ms. Invocations 1
|-- [G_IR_copyMerged](4696)..................................531 ms. Invocations 1
|-- [G_IR_deleteMerged](4696)................................125 ms. Invocations 1
|-- [G_CALL_copyMerged](6846)...............................1263 ms. Invocations 1
|-- [G_CALL_deleteMerged](6846).............................2543 ms. Invocations 1
|-- [G_IR_copyStuckRecords](0)...............................187 ms. Invocations 1
|-- [G_CALL_copyStuckRecords](0).............................422 ms. Invocations 1
|--+[Extract].....................................................6833 ms. Invocations 1
|-- [G_IR]......................................................578 ms. Invocations 1
|-- [G_VIRTUAL_QUEUE]..........................................2059 ms. Invocations 8
|-- [GC_LOGIN].................................................1014 ms. Invocations 1
|-- [GC_BUS_ATTRIBUTE].........................................1357 ms. Invocations 1
|-- [G_USERDATA_HISTORY]......................................15678 ms. Invocations 8
|-- [GC_IVRPORT]................................................983 ms. Invocations 1
|-- [GC_TREATMENT]..............................................858 ms. Invocations 1
|-- [GC_SKILL]..................................................982 ms. Invocations 1
|-- [GCX_GROUP_PLACE]...........................................749 ms. Invocations 1
|-- [G_SECURE_USERDATA_HISTORY].................................811 ms. Invocations 8
|-- [GC_PLACE]..................................................999 ms. Invocations 1
|-- [GC_ANNEX]..................................................265 ms. Invocations 1
|-- [GCX_GROUP_ROUTEDN]........................................1482 ms. Invocations 1
|-- [G_DND_HISTORY].............................................750 ms. Invocations 6
|-- [G_ROUTE_RESULT]...........................................2416 ms. Invocations 8
|-- [G_AGENT_STATE_RC].........................................1186 ms. Invocations 6
|-- [GC_SWITCH].................................................952 ms. Invocations 1
|-- [GC_ATTR_VALUE].............................................921 ms. Invocations 1
|-- [GM_L_USERDATA].............................................625 ms. Invocations 1
|-- [GCX_FORMAT_FIELD].........................................1498 ms. Invocations 1
|-- [G_CUSTOM_DATA_S]...........................................920 ms. Invocations 8
|-- [GM_F_USERDATA]..............................................94 ms. Invocations 1
|-- [G_PARTY].................................................10294 ms. Invocations 8
|-- [G_CALL_STAT]..............................................1387 ms. Invocations 7
|-- [GCX_ENDPOINT_PLACE].......................................1310 ms. Invocations 1
|-- [GCX_GROUP_AGENT]..........................................1326 ms. Invocations 1
|-- [GCX_CAMPGROUP_INFO].......................................1045 ms. Invocations 1
|-- [GCX_SKILL_LEVEL]..........................................1435 ms. Invocations 1
|-- [GCX_LOGIN_INFO]............................................999 ms. Invocations 1
|-- [G_ROUTE_RES_VQ_HIST]......................................1295 ms. Invocations 8
|-- [GC_AGENT]..................................................858 ms. Invocations 1
|-- [GCX_AGENT_PLACE]...........................................983 ms. Invocations 1
|-- [GC_CAMPAIGN]...............................................749 ms. Invocations 1
|-- [GC_CALLING_LIST]..........................................1061 ms. Invocations 1
|-- [G_LOGIN_SESSION]..........................................3900 ms. Invocations 6
|-- [GC_TENANT].................................................748 ms. Invocations 1
|-- [G_IR_HISTORY].............................................2668 ms. Invocations 8
|-- [GCX_CAMPLIST_INFO]........................................1372 ms. Invocations 1
|-- [GC_FILTER]................................................1217 ms. Invocations 1
|-- [G_CALL]....................................................639 ms. Invocations 1
|-- [GC_TIME_ZONE]..............................................655 ms. Invocations 1
|-- [GC_OBJ_TABLE]..............................................624 ms. Invocations 1
|-- [GC_VOICE_PROMPT]...........................................593 ms. Invocations 1
|-- [GC_GROUP].................................................1030 ms. Invocations 1
|-- [GC_SCRIPT]................................................1186 ms. Invocations 1
|-- [GC_ACTION_CODE]...........................................1311 ms. Invocations 1
|-- [GC_ENDPOINT]...............................................811 ms. Invocations 1
|-- [G_AGENT_STATE_HISTORY]...................................15163 ms. Invocations 6
|-- [GCX_SUBCODE]..............................................1373 ms. Invocations 1
|-- [GC_TABLE_ACCESS]..........................................1061 ms. Invocations 1
|-- [GCX_GROUP_ENDPOINT].......................................1467 ms. Invocations 1
|-- [GC_IVR]....................................................655 ms. Invocations 1
|-- [G_PARTY_HISTORY].........................................23727 ms. Invocations 8
|-- [GC_FORMAT].................................................780 ms. Invocations 1
|-- [GC_FOLDER]................................................1076 ms. Invocations 1
|-- [GC_FIELD]..................................................312 ms. Invocations 1
|-- [GC_APPLICATION]...........................................1061 ms. Invocations 1
|-- [GX_SESSION_ENDPOINT]......................................5601 ms. Invocations 6
|-- [GCX_LIST_TREATMENT].......................................1389 ms. Invocations 1
|-- [G_IS_LINK_HISTORY]........................................1092 ms. Invocations 7
|--+[MergeMove]...................................................3089 ms. Invocations 1
|-- [insertIRs4ConCalls2TmpMerge](0)............................421 ms. Invocations 1
|--+[insertClassifiedIsLinks](3877).............................187 ms. Invocations 1
|-- [classify links - join](3877).............................78 ms. Invocations 1
|-- [classify links - insert](3877)...........................93 ms. Invocations 1
|-- [insertIsLinks2TmpMerge](0)..................................62 ms. Invocations 1
|-- [insertIRs2TmpMerge](0).....................................234 ms. Invocations 1
|-- [updateRootirInTmpMerge2](1821).............................172 ms. Invocations 1
|-- [insertPendingRootIrs2TmpMerge](1757).......................141 ms. Invocations 1
|-- [insertNotPendingRootIrs2TmpMerge](23).......................63 ms. Invocations 1
|-- [insertNotPendingLinks](24).................................265 ms. Invocations 1
|-- [deleteNotPendingLinks](24)..................................31 ms. Invocations 1
|-- [G_IR_copyMerged](23)........................................78 ms. Invocations 1
|-- [G_IR_deleteMerged](23)......................................47 ms. Invocations 1
|-- [G_CALL_copyMerged](24).....................................297 ms. Invocations 1
|-- [G_CALL_deleteMerged](24)....................................46 ms. Invocations 1
|-- [G_IR_copyStuckRecords](0)..................................188 ms. Invocations 1
|-- [G_CALL_copyStuckRecords](0)................................312 ms. Invocations 1
|-- [DESTROY]............................................................733 ms. Invocations 1
2020-04-02 21:32:51,999 DEBUG main 35000 SQLUtils.queryAndScan (SELECT CTL_SCHEMA_INFO.SCHEMA_VERSION FROM (select 1 as dummy from DUAL) DUAL LEFT OUTER JOIN ginfo.CTL_SCHEMA_INFO ON CTL_SCHEMA_INFO.SCHEMA_NAME = 'Genesys Info Mart',302366050) - enter
2020-04-02 21:32:51,999 DEBUG main 35000 SQLUtils.queryAndScan - exit(elapsed 0 ms) returning 1
2020-04-02 21:32:51,999 INFO main 25000 Reading CTL_SCHEMA_INFO.Genesys Info Mart=8.1.402.01
2020-04-02 21:32:51,999 DEBUG main 35000 SQLUtils.queryAndScan (SELECT CTL_SCHEMA_INFO.SCHEMA_VERSION FROM (select 1 as dummy from DUAL) DUAL LEFT OUTER JOIN ginfo.CTL_SCHEMA_INFO ON CTL_SCHEMA_INFO.SCHEMA_NAME = 'UPDATE_IDB_FOR_GIM',302366050) - enter
2020-04-02 21:32:51,999 DEBUG main 35000 SQLUtils.queryAndScan - exit(elapsed 0 ms) returning 1
2020-04-02 21:32:51,999 INFO main 25000 Reading CTL_SCHEMA_INFO.UPDATE_IDB_FOR_GIM=8.1.400.01
2020-04-02 21:32:51,999 INFO main 31201 GIM Server - current state is TRANSFORM.
2020-04-02 21:32:51,999 INFO ecp-1-872908 20103 Job 'Job_TransformGIM' started. Version='8.1.402.08' built '2015-03-11 18:50:32 UTC'.
2020-04-02 21:32:51,999 INFO ecp-1-872908 30041 Job step INIT started.
2020-04-02 21:32:51,999 INFO ecp-1-872908 30000 JobTransform: initializing...
2020-04-02 21:32:52,093 DEBUG ecp-1-872908 35000 Executing {call DBMS_LOCK.ALLOCATE_UNIQUE(?,?,864000)}
2020-04-02 21:32:52,108 DEBUG ecp-1-872908 35000 Executing {?=call DBMS_LOCK.REQUEST(?,?,10,false)}
2020-04-02 21:32:52,108 DEBUG ecp-1-872908 35000 OPEN: 2004326974; count 1
2020-04-02 21:32:52,108 INFO ecp-1-872908 30000 JobTransform: reading extract HWM info...
2020-04-02 21:32:52,108 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan (SELECT CTL_EXTRACT_HWM.TABLE_NAME,CTL_EXTRACT_HWM.DATA_SOURCE_KEY,CTL_EXTRACT_HWM.DATA_SOURCE_TYPE,CTL_EXTRACT_HWM.EXTRACT_START_TIME,CTL_EXTRACT_HWM.EXTRACT_END_TIME,CTL_EXTRACT_HWM.ROW_COUNT,CTL_EXTRACT_HWM.MAX_TS,CTL_EXTRACT_HWM.JOB_ID,CTL_EXTRACT_HWM.JOB_NAME,CTL_EXTRACT_HWM.JOB_VERSION,CTL_EXTRACT_HWM.DAP_NAME,CTL_EXTRACT_HWM.DSS_ID,CTL_EXTRACT_HWM.ICON_DBID,CTL_EXTRACT_HWM.PROVIDERTAG FROM ginfo.CTL_EXTRACT_HWM WHERE CTL_EXTRACT_HWM.DATA_SOURCE_KEY > 1 AND ( NOT EXISTS (SELECT 1 FROM ginfo.CTL_DS WHERE CTL_DS.DATA_SOURCE_KEY = CTL_EXTRACT_HWM.DATA_SOURCE_KEY)),2004326974) - enter
2020-04-02 21:32:52,249 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan - exit(elapsed 141 ms) returning 0
2020-04-02 21:32:52,249 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan (SELECT COALESCE(MIN(G_IR.TERMINATED_TS),0) FROM ginfo.G_IR,2004326974) - enter
2020-04-02 21:32:52,405 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan - exit(elapsed 156 ms) returning 1, (1585856618)
2020-04-02 21:32:52,405 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan (SELECT CTL_EXTRACT_HWM_JOIN_CTL_DS.DATA_SOURCE_TYPE,MIN(CTL_EXTRACT_HWM_JOIN_CTL_DS.MAX_TS) FROM (SELECT TABLE_NAME,(DS_KEY) DATA_SOURCE_KEY,(MAX(MAX_TS)) MAX_TS,(MAX(MAX_TIME)) MAX_TIME,(MAX(DATA_SOURCE_TYPE)) DATA_SOURCE_TYPE,(MAX(DS_DBID)) DS_DBID,(MAX(DS_DBID_PRIM)) DS_DBID_PRIM,(MAX(DS2_DBID)) DS2_DBID FROM (SELECT CTL_EXTRACT_HWM.*,(CTL_EXTRACT_HWM.DATA_SOURCE_KEY) DS_KEY,CTL_DS.DS_DBID,CTL_DS.DS_DBID_PRIM,CTL_DS.DS2_DBID FROM ginfo.CTL_EXTRACT_HWM INNER JOIN ginfo.CTL_DS ON CTL_EXTRACT_HWM.DATA_SOURCE_KEY = CTL_DS.DATA_SOURCE_KEY WHERE CTL_EXTRACT_HWM.DATA_SOURCE_TYPE <> 4 UNION ALL SELECT CTL_EXTRACT_HWM.*,(99) DS_KEY,(99) DS_DBID,(0) DS_DBID_PRIM,(0) DS2_DBID FROM ginfo.CTL_EXTRACT_HWM WHERE CTL_EXTRACT_HWM.DATA_SOURCE_TYPE = 4) CTL_EXTRACT_HWM_JOIN_CTL_DS GROUP BY TABLE_NAME,DS_KEY) CTL_EXTRACT_HWM_JOIN_CTL_DS GROUP BY CTL_EXTRACT_HWM_JOIN_CTL_DS.DATA_SOURCE_TYPE,2004326974) - enter
2020-04-02 21:32:52,529 DEBUG ecp-1-872908 35000 SQLUtils.queryAndScan - exit(elapsed 124 ms) returning 3
2020-04-02 21:37:54,411 INFO Agg.NewData 25000 Got addFactAvailNotification3: 1,585,860,300 1,585,863,000 INTERACTION_RESOURCE_FACT false true
2020-04-02 21:37:54,411 INFO ecp-1-885730 25000 notifyFactAvailable: INTERACTION_RESOURCE_FACT , online_media=false, interval_agg= true, current_time=1585863474, start=1585849500, end=1585863000, range= 14400, delay= 124 (List item=1)
2020-04-02 21:37:54,411 INFO Agg.NewData 25000 Got addFactAvailNotification3: 1,585,849,500 1,585,863,000 INTERACTION_RESOURCE_FACT true false
2020-04-02 21:37:54,411 INFO ecp-1-885730 25000 notifyFactAvailable: INTERACTION_RESOURCE_FACT , online_media=false, interval_agg=false, current_time=1585863474, start=1585849500, end=1585849500, range= 900, delay= 124 (List item=1)
2020-04-02 21:37:54,411 INFO Agg.NewData 25000 Got addFactAvailNotification3: 1,585,849,500 1,585,849,500 INTERACTION_RESOURCE_FACT false false
2020-04-02 21:37:54,411 INFO ecp-1-885730 25000 notifyFactAvailable: INTERACTION_RESOURCE_FACT , online_media=false, interval_agg=false, current_time=1585863474, start=1585861200, end=1585863000, range= 2700, delay= 124 (List item=2)
2020-04-02 21:37:54,411 INFO Agg.NewData 25000 Got addFactAvailNotification3: 1,585,861,200 1,585,863,000 INTERACTION_RESOURCE_FACT false false
2020-04-02 21:37:54,411 DEBUG ecp-1-885730 35000 SQLUtils.executeUpdate (INSERT INTO ginfo.CTL_AUDIT_LOG (AUDIT_KEY,JOB_ID,CREATED_TS,CREATED,PROCESSING_STATUS_KEY,MIN_START_DATE_TIME_KEY,MAX_START_DATE_TIME_KEY,MAX_CHUNK_TS,DATA_SOURCE_KEY,ROW_COUNT,INSERTED) VALUES (?,?,?,?,?,?,?,?,?,?,?),317443306,[CONSISTENT_READ_FAILURE]) - enter
2020-04-02 21:37:54,411 DEBUG ecp-1-885730 35000 SQLUtils.executeUpdate - exit(elapsed 0 ms) returning 1
2020-04-02 21:37:54,426 DEBUG ecp-1-885730 35000 COMMIT: 317443306; called by com.genesyslab.gim.etl.jobs.transform.TransformTask.commitAndRelease(TransformTask.java:165)
... View more
04-02-2020
06:00 AM
@to4kawa thanks a lot.
That way it was indexed is perfect for me, it is possible to extract the fields properly.
The only problem is with more fields in the file, where Splunk discards many fields, the larger prints and files are below:
https://www.dropbox.com/s/6dulocddzhm3dld/splunk.rar?dl=0
... View more
04-02-2020
12:14 AM
@to4kawa thanks a lot.
I would just like to check if it is possible that the timestamp is the value of the field "Started running 2020-03-31 22:00:00"
I analyzed that the timestamp is in the current time and must be at the time the routine was executed.
Is it also possible that all fields are within the same line?
... View more
04-01-2020
11:22 PM
Follow my dropbox link with the file
https://www.dropbox.com/s/zrqyiobhvb3jn30/teste.txt?dl=0
This file is complete with the complete format, just open it through notepad or notepad ++.
... View more
04-01-2020
11:13 PM
I don't think I quite understand, I'm sending a link to the original file.
See if you can include this file in Splunk within a new type of source code with the regex settings.
The file should only be opened in notepad or notepad ++
https://www.splunk.com/ https://www.splunk.com/
https://www.splunk.com/
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-20-2022
11:48 AM
|
