Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About indeed_2000
indeed_2000
Motivator
Member since:
11-24-2019
07-13-2024
Community Statistics
| Posts | 528 |
| Solutions | 7 |
| Karma Given | 95 |
| Karma Received | 3 |
| Member Since | 11-24-2019 |
Activity Feed
- Got Karma for issue with "_time" after using fit command in DLTK. 07-08-2024 12:44 AM
- Posted Re: Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 10:28 AM
- Karma Re: Compare resp code count of two dates for each servername for ITWhisperer. 02-23-2024 10:26 AM
- Posted Re: Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 04:00 AM
- Posted Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 12:34 AM
- Posted Re: compare two result on Splunk Search. 02-21-2024 09:18 PM
- Karma Re: compare two result for bowesmana. 02-21-2024 09:18 PM
- Posted Re: compare two result on Splunk Search. 02-20-2024 08:57 AM
- Posted compare two result on Splunk Search. 02-19-2024 08:41 PM
- Karma Re: splunk 8.0.4 support mpreview? for PickleRick. 01-22-2024 09:27 AM
- Posted splunk 8.0.4 support mpreview? on Splunk Search. 01-21-2024 08:50 PM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-18-2024 02:19 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-18-2024 12:03 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-17-2024 11:31 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-17-2024 11:28 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-15-2024 11:26 AM
- Posted Need to create summary index continuously realtime on Splunk Search. 01-15-2024 09:49 AM
- Posted Re: issue with "_time" after using fit command in DLTK on Splunk Search. 01-09-2024 04:42 AM
- Posted issue with "_time" after using fit command in DLTK on Splunk Search. 01-09-2024 03:55 AM
- Posted Re: Download splunk apm on premises on Splunk Search. 12-20-2023 09:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-30-2019
02:09 AM
run your solution on this part of log:
09:04:01.042,module1,F[6]L,IN
09:04:01.437,module1,F[6]L,OUT
09:04:01.438,module4,F[6]L,IN
09:04:01.439,module4,F[6]L,OUT
09:04:01.481,module2,F[6]L,IN
09:04:01.482,module2,F[6]L,IN
09:04:01.483,module2,F[6]L,IN
09:04:01.484,module2,F[6]L,OUT
09:04:01.485,module2,F[6]L,OUT
09:04:01.488,module50,F[18]L,IN
09:04:01.489,module52,F[20]L,IN
09:04:01.490,module53,F[18]L,OUT
09:04:01.491,module52,F[20]L,OUT"
result:
09:04:01.481,module2,F[6]L,IN
09:04:01.482,module2,F[6]L,IN
09:04:01.488,module50,F[18]L,IN
expected result:
09:04:01.483,module2,F[6]L,IN
09:04:01.488,module50,F[18]L,IN
09:04:01.490,module53,F[18]L,OUT
... View more
12-28-2019
09:10 AM
Thank you and Happy New Year 🙂
this is large file I can't define dc value, it has lots of this kind of events.
I expect every single value that hadn't output.
Any idea?
... View more
12-28-2019
08:48 AM
Hi
I have log file like this:
09:04:04.042 module1: F[6]L: IN
09:04:01.417 module1: F[6]L: OUT
09:04:01.418 module4: F[6]L: IN
09:04:01.419 module4: F[6]L: OUT
09:04:01.420 module12: F[6]L: IN
09:04:01.421 module2: F[6]L: IN
09:04:01.422 module41: F[6]L: IN
09:04:01.426 module12: F[6]L: OUT
09:04:01.427 module50: F[18]L: IN
09:04:01.428 module52: F[20]L: IN
09:04:01.429 module50: F[18]L: OUT
09:04:01.435 module52: F[20]L: OUT
as you see every module had (IN) value after while (OUT).
Now I want to define something to expect (OUT) value for each (IN) due to the Fingerprint and Module.
For example in above log file:
1- group them by F (F value means fingerprint)
2- group them by modules
3- detect any F had (IN) but no (OUT). example module2, module41 with F[6] had IN (input) but never had OUT (output).
Any recommendation?
Thanks,
... View more
12-18-2019
10:28 PM
So what should I do to ingest them into the splunk?
... View more
12-18-2019
10:19 PM
What kind of log do you need?
... View more
12-18-2019
10:17 PM
Now I’m confused 🙂
1-@gcusello told ingested data in splunk is better you told sql is better 🙂
2-I’m using sysadmin user of db to connect database
... View more
12-18-2019
10:14 PM
1-You mean performance and reliability will be better if I index them on splunk instead of using db-connect.
2-in sql explorer when i hit open in search data will be ingest into the splunk or I should do something else?
3-I’m using sysadmin user of db to connect database.
... View more
12-18-2019
10:00 PM
I’m using sysadmin user of db to connect database.
... View more
12-18-2019
09:31 PM
I’m using same user to get tables in splunk and db server.
I can read table in splunk and db server but in splunk all table appear Except this table!
... View more
12-18-2019
09:22 PM
Hi
As I know splunk index everything that I import on it but why every time I open dashboard it will recalculate every pivot and report?
Is it possible do something to prevent this and every time open dashboard show quickly latest result or just recalculate new input data not all of them.
Any recommendation?
Thanks,
... View more
12-18-2019
07:14 AM
Hi
I try to join two table in "splunk db connect" with sql command but won't join them. now I have 3 questions:
1-sql editor syntax exactly understand sql command ? because I can run it directly on database.
2-what is the different if I run queries in "splunk db connect" vs "search" ? (different performance,action)
3-some table not show in list of splunk connect db while this table exist in database and when I write query to select that table it will show contents , what is the reason?
Thanks
... View more
12-16-2019
11:13 AM
Sure,
1-I’m going to the search and enter "source = "/opt/logs/*"
2-click on “field extraction”
https://docs.splunk.com/File:Extract_new_fields.png
... View more
12-16-2019
08:17 AM
1-I have several log files with different structure and want extract specific field on all of them.
2-At first step of "field extract" Splunk ask sourcetype.
... View more
12-16-2019
08:15 AM
create new sourcetype as you mention "my_SourceType", but when I hit "field extraction" it has only show "my_SourceType" and it is empty ! there is no event!
while when going to the search it and enter "source = "/opt/logs/*" show all events!
Any recommendation?
Thanks,
... View more
12-16-2019
07:05 AM
Hi
I want to create "field extract" on all logs that exist in below address.
/opt/logs/file1.log
/opt/logs/file2.log
/opt/logs/file3.log
when I create new "field extract" at first step ask me choose a source type: file1.log or file2.log or file3.log ?
How can extract field on all of them like "/opt/logs/*" ?
Should create index for this path?
Thanks,
... View more
12-13-2019
08:57 PM
Hi
I have some log files with different name that copy into the Splunk server "/opt/splunk/logs" daily.
when I extract fields it just do this on specific file, while I need those field extract on every log on that path.
what is the solution here? I should define index for all logs and the extract field? is there any idea?
Thanks,
... View more
12-13-2019
08:34 AM
There is no transforming here.
... View more
12-11-2019
01:53 AM
I have log file like this:
A[1020/09/09] B[1013/09/09] C[05-07-00000000-000-A-B-C]
want to extract field of A, B, C.
1-How can I extract content between brackets [] ? as you see in each brackets have (dash or slash ...)
2-How can I extract fields as it could be single part "1020/09/09" or split like this "1020" "09" "09"
Thanks,
... View more
12-10-2019
07:24 AM
As @woodcock told They are TWO SEPARATE extractions.
... View more
12-10-2019
07:22 AM
Exactly, I thought it can extract multiple fields with field extraction.
... View more
12-10-2019
07:19 AM
Logs and enterprise splunk locate on the single server and I just want to do this config affect to specific log. Not whole logs.
... View more
12-10-2019
04:34 AM
1-file contain only log of today.
2-there is no date in log it just time 08:00:00.122
3-"_time" also show logs that belong this dates 2018 ,2017, 2016 ...
exact problem is splunk convert time to date e.g.
source="/opt/logs-20191210.log" | table _time
1 2018-02-02 09:04:04.042
2 2018-02-02 09:04:04.041
3 2018-02-02 09:04:04.041
4 2018-02-02 09:04:04.039
5 2018-02-02 09:04:04.039
....
1 2017-07-13 08:43:56.928
2 2017-07-13 08:43:56.927
3 2017-07-13 08:43:56.925
4 2017-07-13 08:43:56.925
5 2017-07-13 08:43:56.920
....
1 2016-12-26 08:48:35.986
2 2016-12-26 08:48:35.986
3 2016-12-26 08:48:35.984
4 2016-12-26 08:48:35.979
5 2016-12-26 08:48:35.979
...
1-here is the props.conf
[logs-20191210-too_small]
TIME_FORMAT = %H:%M:%S.%3N
also try this one
DATETIME_CONFIG = CURRENT
2- remove fishbucket
3- restart service
Problem still remain.
Any idea?
... View more
12-09-2019
11:20 PM
Hour:Minutes:Seconds:Millisecond
08:00:00.122 = 08 AM
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-13-2024
12:53 PM
|
Karma given to
