I have found a search in the charge back application that might fit for seeing the SVC's by index.  Unfortunately that's how my company manages costs, by index.  The search is good, but I'm still having issues getting just the SVC's and index as my return:  I did modify it from one day to 1 month, but I only want it to bring back for one month and thus have only one line of results.   Any help would be appreciated. index=summary source="splunk-ingestion" | `sim_filter_stack(myimplementation)` | dedup keepempty=t _time idx st | stats sum(ingestion_gb) as ingestion_gb by _time idx | eventstats sum(ingestion_gb) as total_gb by _time | eval pct=ingestion_gb/total_gb | bin _time span=1m | join _time [ search index=summary source="splunk-svc-consumer" svc_consumer="data services" svc_usage=* | fillnull value="" svc_consumer process_type search_provenances search_type search_app search_label search_user unified_sid search_modes labels search_head_names usage_source | eval unified_sid=if(unified_sid="",usage_source,unified_sid) | stats max(svc_usage) as utilized_svc by _time svc_consumer search_type search_app search_label search_user search_head_names unified_sid process_type | timechart span=1m sum(utilized_svc) as svc_usage ] | eval svc_usage=svc_usage*pct | timechart useother=false span=1m sum(svc_usage) by idx limit=200 ... View more

I have the following script, but it keeps erroring out. def connect_to_splunk(username,password,host='http://xxxxxxxx.splunkcloud.com',port='8089',owner='admin',app='search',sharing='user'😞     try:         service=client.connect(username=username,password=password,host=host,port=port,owner=owner,app='search',sharing=sharing)         if splunk_service:             print("Splunk login successful")             print("......................" )     except Exception as e:         print(e) def main():     try:         splunk_service = connect_to_splunk(username='xxxxxx',password='xxxxxxx')     except Exception as e:         print(e)     There is no error from the debugger (Using Visual Studio).  Would appreciate any assistance. ... View more

We are moving into a container environment and plan to manage the logs via Splunk Cloud.  We'd like to be able to programmatically create the Event Collector, the main index and additional indexes.  Has anyone done anything like that?  We would need to both create and upgrade. ... View more

Here is a sample of my data.  I want to separate each hours/min/sec since I have no timestamp I'm unable to make it work.  I get the first few to break, but then it goes back to breaking incorrectly. 07:05:00.140 [https-jsse-nio-8443-exec-17] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG120','347','334' Probably OK to ignore.Single entity not found. 07:05:00.126 [https-jsse-nio-8443-exec-17] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'CUSTAUTHSST1','19021','334' Probably OK to ignore.Single entity not found. 07:05:00.096 [https-jsse-nio-8443-exec-17] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG120','825','334' Probably OK to ignore.Single entity not found. 07:00:17.125 [https-jsse-nio-8443-exec-23] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] [Message: NO_EXACT_MATCH_FOUND_FOR_GEOCODE - No Exact match was found for the specified geocode, Message: AV_SUCCESSFUL_PROCESSING - Successful processing.] ... 45 common frames omitted at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:176) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:149) at org.jboss.jca.adapters.jdbc.WrappedConnection.prepareStatement(WrappedConnection.java:444) at org.jboss.jca.adapters.jdbc.WrappedConnection.lock(WrappedConnection.java:164) Caused by: java.sql.SQLException: IJ031040: Connection is not associated with a managed connection: org.jboss.jca.adapters.jdbc.jdk7.WrappedConnectionJDK7@50fdb291 ... 29 common frames omitted at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1566) at org.hibernate.query.internal.AbstractProducedQuery.doList(AbstractProducedQuery.java:1598) at org.hibernate.internal.SessionImpl.list(SessionImpl.java:1526) at org.hibernate.engine.query.spi.HQLQueryPlan.performList(HQLQueryPlan.java:220) at org.hibernate.hql.internal.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:395) at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:505) at org.hibernate.loader.Loader.list(Loader.java:2599) at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2604) at org.hibernate.loader.Loader.doList(Loader.java:2770) at org.hibernate.loader.Loader.doList(Loader.java:2787) at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:351) at org.hibernate.loader.Loader.doQuery(Loader.java:949) at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1990) at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:2012) at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:2082) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:151) at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:186) at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113) at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47) Caused by: org.hibernate.exception.GenericJDBCException: could not prepare statement ... 20 common frames omitted at com.thomsonreuters.persistence.helper.SabrixInternalExceptionDelegate.doExecute(SabrixInternalExceptionDelegate.java:87) at com.thomsonreuters.persistence.AbstractSabrixBaseRepository$6.call(AbstractSabrixBaseRepository.java:394) at com.thomsonreuters.persistence.AbstractSabrixBaseRepository$6.call(AbstractSabrixBaseRepository.java:398) at com.thomsonreuters.persistence.AbstractBaseRepository.findOneMatching(AbstractBaseRepository.java:753) at com.thomsonreuters.persistence.AbstractBaseRepository.findOne(AbstractBaseRepository.java:428) at org.springframework.data.jpa.repository.support.QuerydslJpaRepository.findOne(QuerydslJpaRepository.java:106) at com.querydsl.jpa.impl.AbstractJPAQuery.fetchOne(AbstractJPAQuery.java:253) at com.querydsl.jpa.impl.AbstractJPAQuery.getSingleResult(AbstractJPAQuery.java:183) at org.hibernate.query.internal.AbstractProducedQuery.getSingleResult(AbstractProducedQuery.java:1614) at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1575) at org.hibernate.internal.ExceptionConverterImpl.convert(ExceptionConverterImpl.java:154) Caused by: javax.persistence.PersistenceException: org.hibernate.exception.GenericJDBCException: could not prepare statement at java.util.TimerThread.run(Timer.java:505) at java.util.TimerThread.mainLoop(Timer.java:555) at com.sabrix.scheduler.ScheduledTask.run(ScheduledTask.java:84) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.runTask(AutoContentDownloadTask.java:529) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.runTaskAndNotify(AutoContentDownloadTask.java:545) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.runTask(AutoContentDownloadTask.java:693) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.isTimeToRun(AutoContentDownloadTask.java:778) at com.sun.proxy.$Proxy135.getFrequency(Unknown Source) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:205) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344) at java.lang.reflect.Method.invoke(Method.java:498) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at sun.reflect.GeneratedMethodAccessor857.invoke(Unknown Source) at com.sabrix.te.autocontentdownload.configuration.DefaultAutoContentDownloadSubsystemConfiguration.getFrequency(DefaultAutoContentDownloadSubsystemConfiguration.java:290) at com.sabrix.scheduler.SDIConfiguration.getAutoFrequency(SDIConfiguration.java:149) at com.sabrix.scheduler.SDIConfiguration.getAutoFreqConfig(SDIConfiguration.java:359) at com.sabrix.scheduler.SDIConfiguration.getConfig(SDIConfiguration.java:525) at com.thomsonreuters.persistence.taxentity.ConfigDao.findConfigByName(ConfigDao.java:69) at com.thomsonreuters.persistence.AbstractSabrixBaseRepository.findEntityByEntityKeyWithFinderException(AbstractSabrixBaseRepository.java:393) at com.thomsonreuters.persistence.helper.SabrixFinderExceptionDelegate.doExecute(SabrixFinderExceptionDelegate.java:65) at com.thomsonreuters.persistence.helper.SabrixInternalExceptionDelegate.doExecute(SabrixInternalExceptionDelegate.java:91) at com.thomsonreuters.persistence.helper.SabrixInternalExceptionDelegate.processException(SabrixInternalExceptionDelegate.java:135) com.sabrix.error.SabrixInternalException: Could not execute AbstractBaseRepository.findEntityByEntityKeyWithFinderException(). 06:57:48.030 [Timer-1] ERROR c.s.t.a.c.DefaultAutoContentDownloadSubsystemConfiguration - [EVENT FAILURE Anonymous:@unknown -> /ExampleApplication/com.sabrix.te.autocontentdownload.configuration.DefaultAutoContentDownloadSubsystemConfiguration] An error occurred whilst retrieving the auto content download frequency setting. Using default of "12" hours. at java.util.TimerThread.run(Timer.java:505) at java.util.TimerThread.mainLoop(Timer.java:555) at com.sabrix.scheduler.ScheduledTask.run(ScheduledTask.java:84) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.runTask(AutoContentDownloadTask.java:529) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.runTaskAndNotify(AutoContentDownloadTask.java:543) at com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask.removeMessagesForChannel(AutoContentDownloadTask.java:585) at com.sun.proxy.$Proxy143.removeMessages(Unknown Source) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:212) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186) at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:118) at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:367) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344) at java.lang.reflect.Method.invoke(Method.java:498) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at sun.reflect.GeneratedMethodAccessor856.invoke(Unknown Source) at com.sabrix.te.messaging.management.NotificationMessageRemover.removeMessages(NotificationMessageRemover.java:88) at com.thomsonreuters.persistence.taxentity.NotificationMessageDao.findMessages(NotificationMessageDao.java:99) com.sabrix.messaging.management.MessageFinderRuntimeException: Could not execute AbstractBaseRepository.findEntitiesByEntityKey(Predicate). 06:57:48.030 [Timer-1] ERROR c.s.t.a.task.AutoContentDownloadTask - [EVENT FAILURE Anonymous:@unknown -> /ExampleApplication/com.sabrix.te.autocontentdownload.task.AutoContentDownloadTask] An exception occurred during removal of messages on channel with id 200. 06:49:26.496 [https-jsse-nio-8443-exec-4] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG148','10222','334' Probably OK to ignore.Single entity not found. 06:49:26.488 [https-jsse-nio-8443-exec-4] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG192','7983','334' Probably OK to ignore.Single entity not found. 06:49:26.446 [https-jsse-nio-8443-exec-2] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG148','10222','334' Probably OK to ignore.Single entity not found. 06:49:26.437 [https-jsse-nio-8443-exec-2] INFO com.sabrix - [EVENT SUCCESS Anonymous:@unknown -> /ExampleApplication/com.sabrix] Failed to look up error 'USSG192','7983','334' Probably OK to ignore.Single entity not found. ... View more

I want to create a list per index of all the sourcetypes under it and the key value pairs set in the sourcetypes and I want to export this to a cvs file. index=* Name                                                                    Value CHARSET                                                            UTF-8 MAX_TIMESTAMP_LOOKAHEAD              23 etc: ... View more

I have been trying to create this sourcetype and am not sure I'm capturing it correctly.     Sample date:      [2023-03-26T14:06:06.356-04:00] Regex Breakdown:    \[\d{4}-\d{2}-\d{2}.\d{2}:\d{2}:\d{2}.\d{3}-\d{2}:\d{2}] Timestamp:    %Y-%m-%d{2}\T\d{2}:%H%:%M.%S.%N-\d{2}:\d{2} But I'm having issues with the timestamp value.  I've not run into one that has no breaks in it before.  Any help will be much appreciated. ... View more

So far I can get the hosts and forwarder version, but I am unable to get the index the forwarders belong to: index="_internal" source="*metrics.lo*" group=tcpin_connections fwdType=uf | dedup hostname| table hostname,version,os How can I tie the above with the index that the hosts belong to?   ... View more

This is the inputs.file:: As you can see they all go to the same directory structure, but the last one is supposed to catch all the logs not beginning with the defined *_xxxxx_*.log so that general logs will be stored in Splunk as well.  How can I do this? [monitor:///var/log/containers/*_ctisp1_*.log] index = ctisp1 sourcetype = dks-ctisp1 followSymlink = true [monitor:///var/log/containers/*_ocpprd_*.log] index = ocpprd sourcetype = dks-ocpprd followSymlink = true [monitor:///var/log/containers/*_custconnectp1_*.log] index = custcontp1 sourcetype = custcontp1 followSymlink = true [monitor:///var/log/containers/*_ocpnotifp3_*.log] index = ocpnotifp3 sourcetype = dks-ocpnotifp3 [monitor:///var/log/containers/*_ocpcorep3_*.log] index = ocpcorep3 sourcetype = ocpcorep3 [monitor:///var/log/containers/*_custcon2p3_*.log] index = custcon2p3 sourcetype = custcon2p3 [monitor:///var/log/containers/*_custcon1p3_*.log] index = custcon1p3 sourcetype=custcont1p3 [monitor:///var/log/containers/*_ctisap3_*.log] index = ctisap3 sourcetype = dks-ctisap3 [monitor:///var/log/containers/*_ctisp1_*.log] index = ctisp1 sourcetype = dks-ctisp1 [monitor:///var/log/containers/*_ivrp1_*.log] index = ivrp1 sourcetype = dks-ivrp1 #[monitor:///host/containers/*/[a-f0-9]+-json.log$] #index=dcp #sourcetype=dner-logsiamanti-container-logs #[monitor:///var/lib/docker/containers/*/[a-f0-9]+-json.log$] #index=dcp #sourcetype=diamanti-container-logs [monitor:///var/log/containers/*_ocpnotifp3_*.log] index = ocpnotifp3 sourcetype = ocpnotifp3 [monitor:///var/log/containers/*_ocpcorep3_*.log] index = ocpcorep3 sourcetype = ocpcorep3 [monitor:///var/log/containers/*_custcon2p3_*.log] index = custcon2p3 sourcetype = custcont2p3 [monitor:///var/log/containers/*_igridp2_*.log] index = igridp2 sourcetype = dks-igridp2 ## END of PROD ## Monitor all Diamanti logs [monitor:///var/log/diamanti/.../*.log] index=dcp sourcetype = diamanti-system-logs # Monitor Container logs [monitor:///var/log/containers/*.log] index=dcp sourcetype = diamanti-container-logs ... View more