Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About smdasim
smdasim
Explorer
Member since:
07-24-2017
01-03-2021
Community Statistics
| Posts | 41 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 07-24-2017 |
Activity Feed
- Got Karma for Re: TcpOutputProc - Cooked connection to Forwarder IP:9997 timed out. 07-08-2022 02:52 PM
- Posted How can I get a sample license file for Splunk Enterprise? on Installation. 10-11-2018 06:27 AM
- Tagged How can I get a sample license file for Splunk Enterprise? on Installation. 10-11-2018 06:27 AM
- Posted Why am I getting errors on a search head with all their indexer IPs? on Deployment Architecture. 10-08-2018 05:11 AM
- Tagged Why am I getting errors on a search head with all their indexer IPs? on Deployment Architecture. 10-08-2018 05:11 AM
- Posted Re: unable to Send access.log events to the web index. Hosts should be www1, www2, www3 on Deployment Architecture. 08-17-2018 07:33 PM
- Posted Re: How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 07:32 PM
- Posted Re: TcpOutputProc - Cooked connection to Forwarder IP:9997 timed out on Splunk Search. 08-17-2018 07:31 PM
- Posted How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 06:29 PM
- Tagged How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 06:29 PM
- Tagged How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 06:29 PM
- Tagged How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 06:29 PM
- Tagged How am I able send data to the main index but not able to send data to any newly created index? on Getting Data In. 08-17-2018 06:29 PM
- Posted Re: TcpOutputProc - Cooked connection to Forwarder IP:9997 timed out on Splunk Search. 08-17-2018 05:27 PM
- Posted Re: TcpOutputProc - Cooked connection to Forwarder IP:9997 timed out on Splunk Search. 08-17-2018 01:53 PM
- Posted Re: unable to Send access.log events to the web index. Hosts should be www1, www2, www3 on Deployment Architecture. 08-17-2018 12:14 PM
- Posted Re: unable to Send access.log events to the web index. Hosts should be www1, www2, www3 on Deployment Architecture. 08-17-2018 05:01 AM
- Posted unable to Send access.log events to the web index. Hosts should be www1, www2, www3 on Deployment Architecture. 08-17-2018 04:37 AM
- Tagged unable to Send access.log events to the web index. Hosts should be www1, www2, www3 on Deployment Architecture. 08-17-2018 04:37 AM
- Posted Re: TcpOutputProc - Cooked connection to Forwarder IP:9997 timed out on Splunk Search. 08-16-2018 03:38 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2018
12:04 AM
Hi renjith.nair,
Can you please give me links for basic setup required for architecture certification lab.
regards
smdasim
... View more
07-02-2018
01:30 AM
Hi
how to deploy search head and indexer with detailed steps
regards
smdasim
... View more
- Tags:
- splunk-enterprise
06-26-2018
05:51 AM
Hi Team,
I am using dark.css in y dashboard and everything is becoming black including the lable font of a single value Visualizations .
How to change the label font clour so that font colour of single-value label field is white
Regards
smdasim
... View more
- Tags:
- splunk-enterprise
05-08-2018
03:36 AM
Hi ,
I have the below data to index into splunk
Can you advice how can i decode the hex timestamp below (5A8145B4.0000) so that below events can be indexed into splunk
via inputs.conf/props.conf
+5A8145B4.0000 Component: kbb
+5A8145B4.0000 Driver: tms_ctbs623fp5:d4009a/4402680.1
(5A8145B4.0004-1:kbbssge.c,52,"BSS1_GetEnv") KMS_NODEID="huhhjyxphtm01bvgfdx2"
(5A8145B4.0005-1:kbbssge.c,52,"BSS1_GetEnv") KMS_NODEID="jhgfklhtm01bnhbx2"
(5A8145B4.0006-1:kbbssge.c,52,"BSS1_GetEnv")
many thanks
smdasim
... View more
- Tags:
- splunk-enterprise
04-22-2018
07:09 PM
Hi Splunk Team,
Any update on the above question
Regards,
Smdasim!
... View more
04-14-2018
09:24 PM
Using above solution is resulting the sourcetype to set to breakable_text
... View more
04-13-2018
11:55 PM
Current Code which is only picking all logs and putting into sourcetype server_deprovision:default
[monitor://C:\opt\hyperblue\logs\build_logs*_provision_runlist.log]
disabled = false
sourcetype = server_provision:default
blacklist= _deprovision_runlist|_preprovision_runlist.log$
[monitor://C:\opt\hyperblue\logs\build_logs*_preprovision_runlist.log]
disabled = false
sourcetype = server_preprovision:default
blacklist= _provision_runlist|_deprovision_runlist.log$
[monitor://C:\opt\hyperblue\logs\build_logs*_deprovision_runlist.log]
disabled = false
sourcetype = server_deprovision:default
blacklist= _provision_runlist|_preprovision_runlist.log$
... View more
04-13-2018
11:52 PM
[monitor://C:\opt\hyperblue\logs\build_logs**_preprovision_runlist.log]
or
[monitor://C:\opt\hyperblue\logs\build_logs***_preprovision_runlist.log]
not working
... View more
04-13-2018
08:31 AM
Hi Team,
I want to read below log files in 3 separate source types like deprovision , preprovision and provision but the code mentioned in picking one source type files.
2072.37915_xxalslnxxxt10029_deprovision_runlist.log
2072.37915_xxalslnxxxt10029_provision_runlist.log
2072.37915_xxalslnxxxt10029_preprovision_runlist.log
inputs.conf code :
[monitor://C:\opt\hyperblue\logs\build_logs*_preprovision_runlist.log]
[monitor://C:\opt\hyperblue\logs\build_logs*_provision_runlist.log]
[monitor://C:\opt\hyperblue\logs\build_logs*_deprovision_runlist.log]
Please hekp
Regards
smdasim
... View more
- Tags:
- splunk-enterprise
03-15-2018
05:16 AM
Hi ,
I am not able to parse the below log format using timeformat -props.conf
It is giving me a warning unable to parse the timestamp format
Log details below
[12/10/2017 | 21:35:32.561512] | {pid= 6588} | {tid= 12252} | :: | EPVWA005I Application end
[12/10/2017 | 21:35:41.678398] | {pid= 468} | {tid= 4776} | :: | EPVWA004I Application version [9.8.0 (9.80.0.7)] start
[14/10/2017 | 02:35:35.331215] | {pid= 468} | {tid= 12392} | :: | EPVWA005I Application end
Please advice
Regards
smdasim
... View more
- Tags:
- splunk-enterprise
02-07-2018
05:56 PM
Hi,
I want to skip first six header lines since they don't have time stamp information to index.please help
McAfee ePO 5.3.1.296
Server name: XXXXXXXX(XXXXXXXX.XXXX.XXXX.XXXXXXX.com.XX)
Platform: Server 6.2
Processors: 4
Architecture: 64-bit
Physical memory: 16383 MB
20180123154844 I #02828 NAIMSERV PSO load: id=7298 ts=6480670
... View more
- Tags:
- splunk-enterprise
02-03-2018
04:12 AM
Hi Micahkemp,
Can you please let me know more about the last line ,how it can be implemented .
"you could have Splunk use the first instance of a timestamp it sees (based on a regex) be used for that event".As an option i can put first few lines into a single event with timestamp -20180123154844
Thank you for your reply.
Regards
sdasim
... View more
02-02-2018
04:44 AM
Hi ,
Please provide step by step details to Integrate Rapid7-Nexpose with Splunk ?.
Regards
smdasim
... View more
01-31-2018
10:28 PM
Hi Ellio,
thank you very much and much appreciated for your help in this regard !
Regards,
smdasim
... View more
01-31-2018
10:26 PM
Hi Folks,
I am adding data from a log file with filename: server_zmslx1xt1119.log
For the timestamp, first 7 lines does not have timestamp and fail to parse and default to filemod time instead of (20180123154844 or 01/23/18 3:48:44:000).
I want splunk to pick up the timestamp for header fields from the line that have the timestamp (20180123154844)
Please advice
--------------------------------log file ------------------------
McAfee ePO 5.3.1.296
Server name: ZMSLX1XT1119 (zmslx1xt1119.xx.xxxx.xxxx.com.in)
Platform: Server 6.2
Processors: 4
Architecture: 64-bit
Physical memory: 16383 MB
20180123154844 I #02828 NAIMSERV PSO load: id=7298 ts=6480670
20180123154844 I #02828 NAIMSERV PSO load: id=7299 ts=6480679
20180123154844 I #02828 NAIMSERV PSO load: id=7300 ts=6480712
20180123154844 I #02828 NAIMSERV PSO load: id=7301 ts=6480716
20180123154844 I #02828 NAIMSERV PSO load: id=7302 ts=6480740
20180123154844 I #02828 NAIMSERV PSO load: id=7303 ts=6480749
20180123154844 I #02828 NAIMSERV PSO load: id=7304 ts=141092230
--------------------------------log file ------------------------
Regards
smdasim
... View more
01-26-2018
12:41 PM
sometime the same field value has value in KB,MB and GB .ParEdenSpace_Used can have values like 294.9 KB,2G B ,1.9 MB etc
... View more
01-26-2018
12:19 PM
Hi ,
I have split the below log into key value paris ParEdenSpace_init=6.5 MB ParEdenSpace_Used=204.6 ParEdenSpace_Commited=1.7 GB and ParEdenSpace_Max=12.8 GB .
I have used below query to plot the data, however, the minParEdenSpaceUsed value is in KB but it is showing high value in the graph attached. How would I normalize the values before I plot the data and how to identify if the value is in bytes, MB or GB and then convert into standard GB or MB.
timechart span=1d min(ParEdenSpace_Used) as minParEdenSpaceUsed ,max(ParEdenSpace_Used) as maxParEdenSpaceUsed,min(ParEdenSpace_Committed) as minParEdenSpace_Committed,max(ParEdenSpace_Committed) as maxParEdenSpace_Committed,,max(ParEdenSpace_Max) as maxParEdenSpace_Max
Log file
2017-06-26T02:10:12 [INFO] [Thread: Security Console] Memory pool configuration:
| Init | Used | Committed | Max |
Code Cache | 2.4 MB | 46.8 MB | 48.9 MB | 240 MB |
Metaspace | 0 bytes | 90.3 MB | 92.2 MB | -1 bytes |
Par Eden Space | 6.5 MB | 204.6 MB | 1.7 GB | 12.8 GB |
Par Survivor Space | 768 KB | 0 bytes | 221.2 MB | 1.6 GB |
CMS Old Gen | 248 MB | 2.1 GB | 4.3 GB | 32 GB |
Many thanks for your response!
much appreciated
... View more
08-25-2017
07:22 PM
Please give me details from front end to add the required fix .
... View more
08-25-2017
06:57 PM
How to tel Splunk to index based on second column(Timestamp) instead of column(Server Started). This is causing data to be index to old data May 26,2017 instead of Aug 25.
I want to fix it from Splunk UI only. Please advice
Server Started Timestamp Document Type User Message Id Session
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Open Document\SHDashboard 10009
2017-05-26 18:51:20 2017-08-25 09:08:53 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Sheet XXRPXX\U123456 Activated sheet Document\SHSessionHeatmap 10009
2017-05-26 18:51:20 2017-08-25 09:08:54 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Bookmark XXRPXX\U123456 Apply Server\BM02-00 10009
2017-05-26 18:51:20 2017-08-25 09:33:28 \FILES.BM.QLIKVIEW.KVR.COMPANY.COM.IN Document XXRPXX\U123456 Close Document\SHSessionHeatmap 10009
... View more
- Tags:
- splunk-enterprise
07-25-2017
08:37 PM
Please Go to fields --->Setting -->Field extractions
Select the source type which you want to analyse say qvd (Please add qvd source data before analysing in SPLUNK)
select the delimited method regex or tab delimited either of them can be used or both .
On creating the regex from spunk search UI, the config files get generated automatically and can be found below .
C:\Program Files\Splunk\etc\apps\search\local
props
[qvd]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
description = QlikViewLogs
pulldown_type = true
EXTRACT-QVD = ^(?[^\t]+)\t(?[^\t]+)\t(?[^\t]+)\t(?\w+)[^\t\n]*\t(?[^\t]+)\t(?\w+\s+)(?[^\t]+)(?.+)
REPORT-QVD-Automatic = REPORT-QVD-Automatic
disabled = false
[QlikView]
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
description = Qlik View Logs
pulldown_type = true
transforms.conf
[REPORT-QVD-Automatic]
DELIMS = "\t"
FIELDS = "Server_Started","Time_stamp","Document","Type","User","Message","Id","Session"
Please feel free to advice in case I am missing something ,
Regards
Emu
... View more
- « Previous
-
- 1
- 2
- Next »
