About sphiwee

sphiwee · ‎09-15-2021

Hi the port will always be the same, however when I run this regex command in my search it doesnt extract anything Quota I think it was extracted automatically and its wrong hence I wanted the regex way

sphiwee · ‎09-14-2021

I have the following log !!! --- HUB ctxsdc1cvdi013.za.sbicdirectory.com:443 is unavailable --- !!! user='molefe_user' password='molefe' quota='user' host='002329bvpc123cw.branches.sbicdirectory.com' port='443' count='1' !!! --- HUB 002329bvpc123cw.branches.sbicdirectory.com:443 is unavailable --- !!! host='005558bvpc5ce4w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 005558bvpc5ce4w.za.sbicdirectory.com:443 is unavailable --- !!! host='41360jnbpbb758w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 41360jnbpbb758w.za.sbicdirectory.com:443 is unavailable --- !!! host='48149jnbpbb041w.za.sbicdirectory.com' port='443' count='1' !!! --- HUB 48149jnbpbb041w.za.sbicdirectory.com:443 is unavailable --- !!! user='pips_lvl_one_user' password='pips_lvl_one' quota='user' I have above log and I'm struggling to extract the colored items ctxsdc1cvdi013.za.sbicdirectory.com = as workstation ID is unavailable = as status molefe = as quota

sphiwee · ‎08-03-2021

Yes the script is sending results to splunk, I want the visualization like the one below

sphiwee · ‎08-03-2021

Currently running a script on server querying a servers availability, the result of the script is "200" or other codes if the environment is not available.. How can I create a visualization that shows that percentage of the environments availability of 30 days ?

sphiwee · ‎07-01-2021

I have the below column whereby im pinging the url in the column, but for a nicer view I only want to display the pc name eg "03131bipc142w" is this possible?

sphiwee · ‎06-21-2021

index="acoe_np_spa_metrics" | search Project="*" AND Volume="*" | timechart span=1mon count(eval(D_Status="F")) as success_count count(eval(D_Status="S")) as failure_count count as Total | eval STP=(success_count/Total)*100 | fields - Total Good day, I have the above SPL query it gives me the count of "F"s and "S"s but I need the sum of Volumes where D_Status = F and sum of Volume where D_Status = S

sphiwee · ‎06-21-2021

Thanks it works, but seems I actually had to get the sum of the volume where D_status = F and sum of volume where D_Status = S... How can I achieve this?

sphiwee · ‎06-20-2021

here's the spl query index="acoe_np_spa_metrics"| search Project="*" AND Volume="*" |bin _time span=1month | stats count(eval(D_Status="F")) as success_count count(eval(D_Status="S")) as failure_count | eval TOTAL_COUNT=(success_count + failure_count) | eval STP=(success_count/TOTAL_COUNT)*100 | timechart STP

sphiwee · ‎06-20-2021

How can I get STP as a bar chart ? im getting error when i try to do it like this i want to display STP for each month

sphiwee · ‎12-01-2020

I want to have a message on the alert such as "Error code alert on host: ........" The way you're doing it is this achievable? and how?

sphiwee · ‎11-30-2020

Good day, I would like to create an alert for the below error, can i get a regex for the higlighted part and how would i go about creating the alert, or should I just look out for the event and set to trigger whenever its > 0. 2020-11-14 23:04:24 [http-nio-127.0.0.1-7080-exec-7] LdapHealthChecker [ERROR] Error loading the user groups from LDAP server. Please check the ldap.server.url, ldap.bind.dn, ldap.bind.password secure connection properties. Refer to "Manage Configuration Properties Guide". org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839\x00]

sphiwee · ‎11-24-2020

cp to backup location, then rm originals

sphiwee · ‎11-24-2020

Hi there we noticed we are not getting some logs coming through @ some hours in the morning after log rotation. so we ran the below query. index=_internal host=* /opt/workfusion/supervisord/log/workfusion.out.log NOT Metrics earliest=-7d latest=now | timechart span=5m count as NumInt here's the result below 11-24-2020 01:30:03.080 +0200 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/workfusion/supervisord/log/workfusion.out.log'. 11-19-2020 01:30:04.536 +0200 INFO WatchedFile - Logfile truncated while open, original pathname file='/opt/workfusion/supervisord/log/workfusion.out.log', will begin reading from start. How can I fix this since it's affecting our dashboard because there are no results or logs so the dashboard is empty.

sphiwee · ‎11-22-2020

are you able to tell me what do these lines do [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] or [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] because watchdog.log and cloud.log are not the logs we are monitoring

sphiwee · ‎11-19-2020

[default] index = default _rcvbuf = 1572864 host = $decideOnStartup [blacklist:$SPLUNK_HOME/etc/auth] [blacklist:$SPLUNK_HOME/etc/passwd] [monitor://$SPLUNK_HOME/var/log/splunk] index = _internal [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] index = _internal [monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log] index = _telemetry [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] index = _telemetry :

sphiwee · ‎11-18-2020

hi I don't want the rotated log because its being archived, I want the new log that's been generated.. because somehow after log rotation logs stop being forwarded.

sphiwee · ‎11-18-2020

where can I find that file?

sphiwee · ‎11-18-2020

Hi our logs stop forwarding for a while after they have been archived, and this causes us to miss out on valuable data, how can I make splunk start monitoring that log after the old one has been renamed and archived ?

sphiwee · ‎11-17-2020

Am I able to convert that 14% to a piechart that shows only 14% space used? and how? kinda struggling to do it

sphiwee · ‎11-17-2020

Hi @inventsekar i was able to fix it with this "| search memoryUsed=* OR directory=*"

sphiwee · ‎11-17-2020

How do i get rid of the empty spaces above

sphiwee · ‎11-17-2020

Can I please get the extraction of "14%" as memory used & "boot" as directory, thank you. [2020-11-17 11:33:43+0200] Filesystem Size Used Avail Use% Mounted on /dev/sda1 2.0G 274M 1.8G 14% /boot

sphiwee · ‎10-30-2020

is it possible to get alerts through whatsapp? and how?

sphiwee · ‎10-28-2020

Why is the time like this? and where is the start time taken from and the end time?

sphiwee · ‎10-28-2020

To which query do i add it to? "PROCESSING" of "COMPLETE"

Posts	104
Solutions	0
Karma Given	69
Karma Received	5
Member Since	‎07-06-2020

Online Status	Offline
Date Last Visited	Tuesday

Installation via powershell on windows

regex skipping items with square brackets

How can i create a stacked bar graph showing the d...

How to convert from horse shoe to stacked bar char...

How can we automate Sending of screenshot?

How to get percentage of 200 responses?

How do I extract using regex?

How to write a rex to get daily average for time r...

How do I add host and description of error code in...

How to write a regex to get the text in red as "E...

Re: field extraction

field extraction

Re: server availability

server availability

edit fields

timechart sum

Re: eval and timechart

Re: eval and timechart

eval and timechart

Re: create EXTRACTION

create EXTRACTION

cpRe: Log rotation affecting reading of logs

Log rotation affecting reading of logs

Re: Logs not forwarding after Log Rotation

Re: Logs not forwarding after Log Rotation

Re: Logs not forwarding after Log Rotation

Re: Logs not forwarding after Log Rotation

Logs not forwarding after Log Rotation

Re: EXTRACTION OF FIELDS

Re: EXTRACTION OF FIELDS

Re: EXTRACTION OF FIELDS

EXTRACTION OF FIELDS

getALERTS THROUGH WHATSAPP

Re: Time and Duration Dashboard

Re: Time and Duration Dashboard