About Roy_9

Roy_9 · ‎10-03-2023

Hello, I am seeing the below error in the internal logs. The lookup table XYZ does not exist or not available I have checked in Lookup table files, Lookup definitions, Automatic Lookups but didn't find this lookup.How do i need to get rid of this error, any suggestions please. Thanks

Roy_9 · ‎09-18-2023

Hello @ITWhisperer I added the host name to the query provided and ran a search but i am not seeing any results under statistics tab. Is result=0 means that the host is reporting and that is the reason we are not seeing results? Can you please confirm? Thanks

Roy_9 · ‎09-14-2023

Hello, I am trying to find the dates when the host stopped sending logs to splunk in the last 6 months.I have used the below search but can only find the earliest and latest indexed time. Just wanted to know the dates as well when the host stopped sending logs. | tstats count as totalcount earliest(_time) as firstTime latest(_time) as lastTime where index=linux host=xyz by host | fieldformat firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S") | fieldformat lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S") Thanks

Roy_9 · ‎08-22-2023

Sure @gcusello I am still working on this effort, i will definitely post my observations once I am done.

Roy_9 · ‎08-22-2023

@Anu Can you double check the index name which you used while configuring this add-on? if the index name is correct, give index=* and see if it fetches any results.

Roy_9 · ‎08-16-2023

thanks @gcusello i will take a look at the disk space resources and see if it helps

Roy_9 · ‎08-15-2023

Hello, Can someone please help me with the solutions for the below errors on splunk internal logs? Host Component Error splunk01-shc SearchScheduler The maximum disk usage quota for this user has been reached. splunk01-shc DispatchManager The maximum number of concurrent historical searches on this instance has been reached. splunk01-shc UserManagerPro SAML config is invalid, Reconfigure it. splunk02 ExecProcessor message from "{}" /bin/sh: {}: Permission denied splunk02 ExecProcessor message from "{}" File "/opt/splunk/etc/apps/splunk_assist/bin/instance_id_modular_input.py", line 29, in should_run splunk01-shc SearchScheduler Search not executed: The maximum number of concurrent historical searches on this instance has been reached., concurrency_category={}, concurrency_context={}, current_concurrency={} concurrency_limit={}

Roy_9 · ‎06-30-2023

Thanks a lot @gcusello

Roy_9 · ‎06-17-2023

Hello, Can someone please help me with the steps to fix it, when one of the search head in a search head cluster is down? Thanks

Roy_9 · ‎06-17-2023

Can you also help me with a search to run this on SH, I saw DMC is not set up in our environment.

Roy_9 · ‎06-16-2023

Hello, Can someone please help me with the Splunk search to find the list of Heavy Forwarders reporting with their IP address? thanks

Roy_9 · ‎05-08-2023

Hello @gcusello The parsing queues fill percentages are less than 70% when the testing was run, I am not sure on what other factors that are causing the issue.Do yo have any thoughts? Thanks

Roy_9 · ‎05-05-2023

Hello, I have a usecase where few servers stopped ingesting for 3-4 hrs when the user is doing performance testing on those servers and then servers started ingesting again automatically, I am not sure what caused the ingestion to stop. During the time when the ingestion has stopped, logs are still available on the server Please help me with the troubleshooting on what might have caused for this issue and how I can remediate this? Thanks in advance

Roy_9 · ‎04-24-2023

@gcusello It didn’t worked, timestamp is getting rounded to nearest second

Roy_9 · ‎04-24-2023

@yeahnah I tried your config by creating the sourcetype directly on splunk cloud but it isn’t working, timestamp is still getting rounded in the event instead of accurately displaying the timestamp with milli seconds.

Roy_9 · ‎04-24-2023

@woodcock I tried your config by creating the sourcetype directly on splunk cloud but it isn’t working, timestamp is still getting rounded in the event instead of accurately displaying the timestamp with milli seconds.

Roy_9 · ‎04-07-2023

I am just keeping the sourcetype to test for testing purposes on my stand alone test server, I have applied the below props and i am still getting the error: couldnot use strptime to parse timestamp from "2023-04-07 11-37-39.354" Failed to parse timestamp, defaulting to file modtime. these logs are already being indexed and sent to splunk cloud, we have an on prem HF in place. is it possible to extract the timestamp from the event directly and apply it to timestamp field at search time? I used the below search but still my timestamp is getting rounded index="abc" sourcetype="test" | rex "\["BS"\":\"(?<event_time>\d{4}-\d{2}-\d{2} \d{2}-\d{2}-\d{2}\.\d{3})\"" | eval timestamp=strptime(event_time,"%Y-%m-%d %H-%M-%S.%3N") for ex: "2023-04-07 11-37-39.354" is rounded to 4/7/23 11:37:40.000 AM under Time column in search.

Roy_9 · ‎04-04-2023

Hello, I m trying to build the props.conf for the below log but when i am getting "failed to parse timestamp" and "defaulting to file modtime" error. [test] TIME_PREFIX = \["BS": TIME_FORMAT = %Y-%m-%d %H-%M-%S.%3N LINE_BREAKER = \} SHOULD_LINEMERGE = true TRUNCATE = 100000 below is the log sample ["BS":"2023-04-04 20-10-45.013", MessageID:"test-7657-99", UID="xy123-bc22"] { xyz } ["BS":"2023-04-04 20-10-46.013", MessageID:"test-7687-99", UID="xy123-bc22"] { abc } Please help me with it Thanks

Roy_9 · ‎04-04-2023

@richgalloway do you have any idea on this usecase?

Roy_9 · ‎04-04-2023

Hello, How to change the permissions of the knowledge objects(ex., dashboards, alerts) on the splunk cloud search head to a new user since the previous owner who created those is no longer with the organization Please help me with it. Thanks

Roy_9 · ‎04-04-2023

Hello, Does anyone is still using Splunk add-on for sharepoint? Looks like it is not available in splunkbase anymore. If yes, can you pls provide the sourcetype config for mssharepoint-uls? thanks

Roy_9 · ‎04-04-2023

Hello, In order to monitor a file via UF, those files should grant read-only permissions user and group as splunk:splunk on linux servers, I have doubt on windows servers whether the user and group (splunk:splunk) is an active directory service account and group? Thanks

Roy_9 · ‎04-03-2023

Yeah, for some reason, header is not getting removed, I am manually testing it by uploading through Add data section via UI, it is not already indexed. If you don't mind, can you copy your props.conf stanza and put it here so that i will compare with mine and see if something is missing.

Roy_9 · ‎04-03-2023

I just applied the below to the props.conf but still seeing the same error, unable to remove the header. SEDCMD-removeheader Thanks

Roy_9 · ‎04-03-2023

Thank you so much @LRF and just a quick question What if we want to make this events structured, if we want to get the values with respect to each field let's say under process, process value should be displayed, under TID, TID value should be displayed, like the same way i wanted for area, category, Event ID Level, Message and correlation.

Posts	363
Solutions	22
Karma Given	73
Karma Received	35
Member Since	‎08-05-2020

Online Status	Offline
Date Last Visited	‎07-27-2025 11:14 AM

Where can I download Universal Forwarder Package f...

Need help with SPL for windows logins

Splunk Report Delivery

Unable to Access on Splunk Enterprise

Need help with splunk add-on for linux

How to check whether IPV6 is enabled on machines i...

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Splunk DBConnect with Informix

Splunk query to find browsers installed on a machi...

The lookup table XYZ does not exist or not availab...

Re: Help needed on splunk query to find the dates ...

How to create search to find the dates where the h...

Re: Splunk Internal logs Errors

Re: Unable to extract fields from package source t...

Re: Splunk Internal logs Errors

Can someone help me with the solutions for the bel...

Re: Splunk query to find the traffic of Heavy Forw...

What are the troubleshooting steps for search head...

Re: Splunk query to find the traffic of Heavy Forw...

Splunk search to find the traffic of Heavy Forward...

Re: Splunk stopped ingesting

Why did Splunk stop ingesting?

Re: Help needed with building props.conf

Re: Help needed with building props.conf

Re: Help needed with building props.conf

Re: Help needed with building props.conf

How to build props.conf?

Re: How to change Splunk Permissions to a new user...

How to change Splunk Permissions to a new user on ...

Any one using Splunk add-on for sharepoint?

Splunk UF file permissions on windows servers?

Re: Help needed with Props.conf

Re: Help needed with Props.conf

Re: Help needed with Props.conf

Are you a member of the Splunk Community?