Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About SplunkDash
SplunkDash
Motivator
Member since:
05-28-2021
11-18-2024
Community Statistics
| Posts | 443 |
| Solutions | 4 |
| Karma Given | 302 |
| Karma Received | 4 |
| Member Since | 05-28-2021 |
Activity Feed
- Karma Re: Issues with HTTP Status for HEC token for PickleRick. 11-18-2024 04:45 PM
- Karma Re: Issues with HTTP Status for HEC token for isoutamo. 11-18-2024 04:45 PM
- Posted Re: Issues with HTTP Status for HEC token on Getting Data In. 11-18-2024 04:44 PM
- Karma Re: Issues with HTTP Status for HEC token for dural_yyz. 11-18-2024 04:44 PM
- Posted Re: Issues with HTTP Status for HEC token on Getting Data In. 11-18-2024 04:40 PM
- Posted Re: Issues with HTTP Status for HEC token on Getting Data In. 11-17-2024 12:26 PM
- Posted Issues with HTTP Status for HEC token on Getting Data In. 11-17-2024 11:23 AM
- Karma Re: Create HEC token from Linux CLI for sainag_splunk. 10-03-2024 08:08 AM
- Karma Re: Create HEC token from Linux CLI for sainag_splunk. 10-03-2024 08:08 AM
- Posted Re: Create HEC token from Linux CLI on Security. 10-02-2024 07:36 PM
- Posted Create HEC token from Linux CLI on Security. 10-02-2024 06:16 PM
- Posted Windows performance -Velocity SD Service Counters logs on Security. 08-19-2024 06:30 PM
- Karma Re: Extract Epoch Time as readable time format using props.conf for richgalloway. 08-17-2024 07:31 PM
- Posted Extract Epoch Time as readable time format using props.conf on Security. 08-17-2024 03:53 PM
- Karma Re: Field Extraction with CSV File for gcusello. 07-11-2024 01:54 PM
- Karma Re: Field Extraction with CSV File for PickleRick. 07-11-2024 01:54 PM
- Karma Re: Field Extraction with CSV File for ITWhisperer. 07-11-2024 01:54 PM
- Karma Re: Field Extraction with CSV File for ITWhisperer. 07-11-2024 01:54 PM
- Posted Re: Field Extraction with CSV File on Security. 07-11-2024 05:40 AM
- Posted Re: Field Extraction with CSV File on Security. 07-11-2024 02:19 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-17-2021
02:43 PM
Hello, I have a complex data source (sample events given below). Is there any way I can write TIME_PREFIX and TIME_FORMAT for this data source? Thank you so much, greatly appreciated. FOAT A BRMCPRD FMM0 0080 0 0 CFOL.OLG.GENERIC.REQUEST.FIT1 2021-06-14 00:03:48.165 FOAT A RCTID QMGR NAME INDS I/P CNT O/P CNT MQ Series Q name 2021-06-14 00:03:48.162 FOAT A -------- ---------------- RCTID ---- ------- ------- ------------------------------- 2021-06-14 00:03:48.163 FOAT A IOB FRAME COMMON SWB XWB ECB FRM1MB 2021-06-14 00:08:09.521 FOAT A BRMCPRD FMM0 0080 0 0 CFOL.OLG.GENERIC.REQUEST.FIT1 2021-06-14 00:28:09.361 FOAT A 1 0 4 4 20 0.86 499.26 1.68 2021-06-14 00:28:09.445 FOAT A 2 0 3 2 3 1.19 498.92 2.19 2021-06-14 00:28:09.446 FOAT A 3 0 2 2 2 1.17 498.95 2.20 _ 2021-06-14 00:28:09.447 FOAT A 4 0 4 2 10 1.24 498.87 2.27 2021-06-14 00:28:09.448 FAAT A END OF DISPLAY+ 2021-06-14 00:28:09.449 DFAT A Utilization OK .7 - .7 / .3 - .3 _ 2021-06-14 23:58:11.233 DFAT A CFCAOL Message Rate OK 0.0 / 0.0 2021-06-14 23:58:11.234 FISA A DASRS Message Rate OK 0.0 / 0.0 2021-06-14 23:58:11.235 FISA A Command Code timeouts past Min OK c-0 / i-0 / b-0 2021-06-14 23:58:11.236 FIAT A BTIF Response Time OK n-0 / r-0 / t-0 2021-06-14 23:58:11.237 FIST A Serv Ctr or C-Codes Disabled OK 2 2021-06-14 23:58:11.238 BNAT A 02303F80 *ENBL* AN AT AU BR CI FR KC ME OG PH 2021-06-14 23:30:04.120 PODA A CFOL 0.0 0.0 2021-06-14 18:56:09.072 PODA A IDRS 0.0 0.0 2021-06-14 18:56:09.073 PODA A EFTP 0.0 0.0 2021-06-14 18:56:09.074 TBCA A AAES0009I 00.00.00 FROM TA 0A : AAER0412I ACT: Variation RASIGN activated from dir F:\TESTAVENVAR 2021-06-15 00:00:00.195
... View more
- Tags:
- PROPS-Complex Source
Labels
- Labels:
-
rex
08-15-2021
05:53 PM
oops ...😀 cool working as expected, thank you so much, appreciated!!!
... View more
08-15-2021
05:39 PM
Thank you so much. But, still getting error message...Failed to parse timestamp!!!
... View more
- Tags:
- Tha
08-15-2021
05:17 PM
Hello, I wrote a PROPS Configuration file for following csv file but getting error message. Any help will be highly appreciated. Thank you so much. [ csv ] SHOULD_LINEMERGE=false CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv TIME_FORMAT=%Y%m%d %H:%M:%S:%Q HEADER_FIELD)LINE_NUMBER=1 TIMESTAMP_FIELDS=TIMESTAMP category=Structured
... View more
- Tags:
- PROPS for csv
Labels
- Labels:
-
regex
08-12-2021
09:03 PM
Thank you so much appreciated. What about if I use TIME_PREFIX=at+\s Since # of words are not the same, but there always "at+\s" before the Date/Time. But, please let me know if you have any recommendation other than this.
... View more
08-12-2021
01:39 PM
Hello, how can I write TIME_PREFIX for props conf file for following sample event. Any help will be highly appreciated. Thank you, greatly appreciated. INFORMATION:Metadata Deployment process started at Tue Jun 16 11:51:47 EDT 2020. INFORMATION:Metadata Deployment process ended at Tue Jun 16 11:51:48 EDT 2020. INFORMATION:Metadata Deployment process ended at Tue Jun 16 11:51:49 EDT 2020
... View more
- Tags:
- time_prefix
Labels
- Labels:
-
regex
08-12-2021
12:33 PM
Hello, I am a source file which has events with 2 different file formats. How would I write TIME_FOMAT for my PROPS Configuration file. any help will be highly appreciated. Thank you.. 2021/05/30 16:28:12 JAVA_OPTION_USESERVERCIPHERSUITESORDER:-DuseServerCipherSuitesOrder=true 2021/05/30 16:28:12 JAVA_OPTION_XMX:-Xmx196m 2021-05-30 16:28:27.872 INFO 28709 --- [ main] .c.r.b.i.e.ConsulBootstrapPropertyLoader 2021-05-30 16:28:43.677 INFO 28709 --- [ main] com.sas.studio.ApplicationPetrichor
... View more
- Tags:
- Time Format
Labels
- Labels:
-
regex
08-12-2021
10:27 AM
Hello, I was trying to write PROPS configuration file following sample events... 2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| 2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| since it has pipe "|"..here is what I wrote..but not working... Any help will be highly appreciated...thank you so much.. SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) INDEXED_EXTRACTIONS = psv TIME_FORMAT = %Y%m%d %H:%M:%S:%Q TIMESTAMP_FIELDS = TIMESTAMP
... View more
- Tags:
- props
Labels
- Labels:
-
regex
08-12-2021
10:08 AM
Hello, since event has the pipe "|" ...I wanted to use following props conf ...but not working.., any help will be highly appreciated! SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) INDEXED_EXTRACTIONS = psv TIME_FORMAT = %Y%m%d %H:%M:%S:%Q TIMESTAMP_FIELDS = TIMESTAMP
... View more
08-12-2021
09:26 AM
Perfect ...working as expected, thank you so much ...appreciated.....just one more issue... my source is text file....how would I make my PROPS Conf file not to read first line ....as first line is not an event.. ost: 'XXXpcdwa', OS: 'LIN X64', Release: '35.0.0-X1127.19.1.ex7.x86_128', Version: ' 2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| 2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462|
... View more
08-12-2021
08:54 AM
Hello, What would be my TIME_FORMAT for prop configuration file for this events 2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| 2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462| I wrote this not covering entire range TIME_PREFIX=^ TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%f%z Any help will be highly appreciated. Thank you so much.
... View more
- Tags:
- time_format
Labels
- Labels:
-
regex
08-09-2021
07:41 AM
..yes working as expected.....thank you so much, truly appreciated!!!
... View more
08-09-2021
12:19 AM
Why we need the version of it...? .....anyways, I solved that issue (see below). Thank you so much, appreciated!!! SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true TIME_PREFIX=\,+\s TIME_FORMAT=%d %b %Y %H:%M:%S %z MAX_TIMESTAMP_LOOKAHEAD=26
... View more
08-05-2021
03:19 PM
Thank you so much. I stuck writing my TIME_PREFIX and TIME_FORMAT in Props Configuration file for those events . Thank you again.
... View more
08-05-2021
02:31 PM
How would I write the props config file for following events, any help will be highly appreciated, thank you! Thu, 01 Jul 2021 00:20:04 -0400|system|flush_vulns|INFO|-1|Removing old data in Repository Thu, 01 Jul 2021 00:20:04 -0400|system|flush_vulns|INFO|-1|Successful removal of old data in Repository Thu, 01 Jul 2021 00:20:05 -0400|system|flush_vulns|INFO|-1|Removing old data in Repository Thu, 01 Jul 2021 00:20:05 -0400|system|flush_vulns|INFO|-1|Successful removal of old data in Repository
... View more
- Tags:
- Props Configuration
Labels
- Labels:
-
regex
08-03-2021
06:02 PM
I think I am good, working as expected. Thank you again, truly appreciated your support in this effort.
... View more
08-03-2021
05:27 PM
Thank you so much, appreciated I used this one as well. Only problem when I use this double pipe "||". If I use {9} without this "||" (i.e, replace "||" with "|") working as expected, but, getting error message when I have "||" in the events. Any help will be highly appreciated.
... View more
08-03-2021
07:28 AM
Hi, How would I write Time_FORMAT and TIME_PREFIX for my Props Conf file for the following sample events. Any help will be highly appreciated. Thank you so much. RTJCB|DEMOEE|AFFR|ANALYST |VIEWSUMMARY |XYA565656873 ||12.214.61.90|00| |20210730 13:00:26:907| |000000|030|ACMF|0| STJCB|DEMOEE|AFFR|ANALYST |VIEWCASE |YNA565656873 ||12.214.61.90|00| |20210730 13:00:29:045| |000000|030|ACMF|0| TRJCB|DEMO|AFFR|ANALYST |VIEWSUMMARY |XBC565656873 ||12.214.61.90|00| |20210730 13:00:30:421| |000000|030|ACMF|0| RXJCB|DEMOEE|AFFR|ANALYST |VIEWCASE |DCN132748456 ||12.214.61.90|00| |20210730 13:00:40:273| |201512|030|ACMF|0| DSJCB|DEMOEE|AFFR|ANALYST |UPDATECASE |CBB132748456 ||12.214.61.90|01|Attempt to update to an code |20210730 13:00:47:347| |201512|030|ACMF|0| RXJCB|DEMOEE|AFFR|ANALYST |VIEWCASE |ABB132748456 ||12.214.61.90|00| |20210730 13:00:48:519| |201512|030|ACMF|0|
... View more
- Tags:
- props conf
Labels
- Labels:
-
rex
07-15-2021
02:54 PM
_raw just generated automatically from the system when I pull the source file through SPLUNK web console to test my PROPS. It doesn't make any differences if I take off take option
... View more
07-15-2021
02:28 PM
Thank you. But, I used DATETIME_CONFIG=current SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 EVAL-_raw=replace(_raw,"\"","") INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured but, showing no events.......when I take off "DATETIME_CONFIG=current" and leave this value blank... it's showing events with error messages ("Failed to parse timestamp"). Any help will be highly appreciated.
... View more
07-15-2021
01:45 PM
Hello, Please let me know how I would write Props Configuration file for this csv file. Segment of sample data for this csv file is given below. Any help will be highly appreciated, thank you!
... View more
- Tags:
- props.conf
Labels
- Labels:
-
field extraction
07-09-2021
02:37 PM
Hi, Using dBConnect in SPLUNK, how I would setup to schedule my SQL query to run a particular time in a day or week. Any help will be highly appreciated. Thank you!
... View more
- Tags:
- dbconnect
07-07-2021
07:32 PM
Thank you so much, appreciated! ......working as expected 😊!!!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-18-2024
08:07 PM
|
Karma given to
