About sushma7

sushma7 · ‎04-09-2014

Yeah ok that worked out for me, but this query does not generate any statistical graph for me, is there a way to modify the query a bit so that i could be able to generate the query?

sushma7 · ‎04-09-2014

so just replace eval move_time=strftime(diff, "%H:%M:%S.%3Q") with eval move_time = tostring(diff, "%H:%M:%S.%3Q"). Is that right?

sushma7 · ‎04-09-2014

eval end_time=strptime(move_end,"%Y-%m-%d %H:%M:%S.%3Q") | eval start_time=strptime(move_file_start,"%Y-%m-%d %H:%M:%S.%3Q") | eval diff=end_time-start_time | eval move_time=strftime(diff, "%H:%M:%S.%3Q").. Please see this query and correct me

sushma7 · ‎04-09-2014

Ok, i wrote a query to calculate the difference between start and end time. In my XML file the start time is 19:42:48:305 and end time is 19:42:42:080, so the actual difference between them should be 00:00:06:225, but it is showing me as 20:00:06:225, why is it happening so?

sushma7 · ‎04-08-2014

I knew that we have to use spath so as to retrieve the xml values, but I am not clear as how to use in case of my above requirement.

sushma7 · ‎04-07-2014

Hi, Please find the below XML file: 20140401-05:39:58 <![CDATA[Connection established]]> FTP 26875412 0 0 153.71.45.1:21 153.71.45.109:53828 start F34F6ECC-6A58-4577-FE93-1F7F7C4D4C1D 20140401-05:40:11 <![CDATA[logon success (110001001)]]> FTP 26875412 1 1 110001001 sep03vvm401.mdccommonldap.com 153.71.45.1:21 153.71.45.109:53828 PASS <![CDATA[*****]]> 220 F34F6ECC-6A58-4577-FE93-1F7F7C4D4C1D 20140401-05:40:12 <![CDATA[]]> FTP 26875412 1 0 110001001 sep03vvm401.mdccommonldap.com 153.71.45.1:21 153.71.45.109:53828 STOR <![CDATA[FDD_110001001_110001000_20140401_055542_20140401_3_201404010555421515_P.XCF]]> <![CDATA[D:\Program Files\NCR\ECPIX\Data\SystemIn\users\110001001\FDD_110001001_110001000_20140401_055542_20140401_3_201404010555421515_P.XCF]]> 86692 187 F34F6ECC-6A58-4577-FE93-1F7F7C4D4C1D 20140401-05:40:12 <![CDATA[Connection closed]]> FTP 26875412 1 0 110001001 sep03vvm401.mdccommonldap.com 153.71.45.1:21 153.71.45.109:53828 QUIT F34F6ECC-6A58-4577-FE93-1F7F7C4D4C1D For this file I need a query to retrieve the values for 1. 153.71.45.1:21 153.71.45.109:53828 110001001 sep03vvm401.mdccommonldap.com Start time for the request i.e. where the cmd start is mentioned. quit time for the request i.e. where the cmd quit is mentioned. difference between the start and quit time for request. Let me know if you need any more information. Regards, Sushma.

sushma7 · ‎04-03-2014

How to use filed extraction rather than this rex commands?

sushma7 · ‎04-03-2014

Hi Team, I have indexed system logs into the SPLUNK and it looks something like below: [4/1/14 6:06:10:218 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.218 | | | | | | | Completed ftpHandler .doPost [4/1/14 6:06:10:938 EDT] 000000a9 SystemOut O DEBUG | 2014-04-01 06:06:10.938 | | | | | | | In FTP recognize *****Reqtype:E****Filename:FDD_110001001_110001000_20140401_062210_20140401_3_201404010622421530_P.XCF Now here, I want to retrieve the time when the "Completed ftpHandler .doPost" operation has been completed say 2014-04-01 06:06:10.218 as per our example above and the time when the "requesttype:E" operation has been completed say 2014-04-01 06:06:10.938 . Once I get these two time values then I should be able to calculate the difference between those two time period. I need query to be written in such a manner. Is that possible? Please help! Regards, Sushma.

sushma7 · ‎03-16-2014

Any suggestions please?

sushma7 · ‎03-15-2014

Thak You...!!

sushma7 · ‎03-15-2014

So far 5 messages exist and you are saying that if I exceed 5 of them in 30 days , search function would be disabled, then what am I supposed to do?

sushma7 · ‎03-15-2014

One more thing indexing volume of 2GB is per day right? I mean to say that today i would index 1GB data, tomorrow i would index another 1GB which, the next day another 1GB, there's no issue right?

sushma7 · ‎03-15-2014

The exact reason is the monitored source has grown up.As you are saying that cleaning up the index doesn't breach the limit, what should I do now to avoid the indexing limit message?

sushma7 · ‎03-15-2014

Hi Team, Mine is SPLUNK enterprise with licensing limit upto 2GB per day. I received licensing limit has exceeded the maximum size on one fine day, to overcome the warning I cleaned up the index , after few days again i received the warning message and I cleaned up the index.Like this I cleaned up the indexes whenever I received a warning. Now when I check the license manager for more details it is showing me so far 5 messages i received previously on different dates related to exceeding the limit, though I have cleaned up. Somewhere I read that if i ignore all the warnings and if count has exceeded more than 5 then some of the search functionalities would be disabled. Now here as soon as I receive the message I would clean up the index, still the messages under license manager exists and count has exceeded more than 5. Will my search functionlities get disabled? Need advice please! Cheers, Sushma.

sushma7 · ‎03-15-2014

Sorry to say this, it was my typo error I gave the same thing that you have mentioned i.e. [monitor://E:\Splunk] disabled=false recursive=true But why is it not viewing my other log files? Is there any UNC restriction in SPLUNK? When it can read a file by SystemOut_14.2.2011_1 in one of the sub directory, why is it not viewing the other 9 log files whose name just differs by last digitSystemOut_14.2.2011_2 etc...

sushma7 · ‎03-14-2014

Need help!

sushma7 · ‎03-13-2014

Under inputs.conf file i just enetered [monitor:///E:Splunk] disabled =false recursive = true Is thereanything more I need to enter?

sushma7 · ‎03-13-2014

Under inputs.conf file i just enetered [monitor:///E:\Splunk] disabled =false recursive = true Is thereanything more I need to enter?

sushma7 · ‎03-13-2014

Hi, I have a directory on E drive by name SPLUNK. It has 3 to 4 subdirectories in it and under each subdirectory there almost 10 files with names as SystemOut_14.2.2011_1, SystemOut_14.2.2011_2 etc.. But in my SPLUNK only monitors the first file in each of the subdirectory, not the rest, why is it happening so? Appreciate your help! Regards, Sushma.

sushma7 · ‎03-13-2014

Kindly someone help me on this

sushma7 · ‎03-13-2014

To be more clear i shall say this way E:\Splunk has 2 folders ftplogs and ncpi. ftplogs has 5 more folders in it say a,b,c,d,e. the folder a has 10 log files in it with names SystemOut_14.03.2014_18.07.01, SystemOut_14.03.2014_18.07.02 like that ....till 18.07.10. But from SPLUNK machine I could just view only the first log file but not the rest, though I gave monitor=[E:\Splunk] under inputs.conf file

sushma7 · ‎03-13-2014

Hi Team, I have installed Universal forwarder on one of the box that I need to monitor.In that machine I want to monitor a particular folder under E drive, say E:\Splunk. The splunk folder has inturn two more directories ftplogs and NPCI. The NPCI inturn has set of directories which inturn has some logs in it. Splunk can monitor only few directories under NPCI but not all, why is it happening so? Need your suggestion. Thanks in advance for your help! Regards, Sushma.

sushma7 · ‎02-09-2014

What I didnt get is one thing per suppose I wrote a query to collect the cpu utilization from the windows boxes and selected the time range picker as 60 minutes, then it would display the cpu utilization of last 60 minutes if I add it to the dashboard,it is going to be static right? whenever i open and see the dashboard it would be displaying the same result?

sushma7 · ‎02-08-2014

Restarting again the forwarder has resolved my issue... Thanks!!!

sushma7 · ‎02-08-2014

Ok, one more question all the data that is indexed goes by default into main, I am aware of it. In my case I installed windows app and its add-on on a windows box, now i want that windows box to index the data into a separate index that I have created. To do so I edited the inputs.conf file and added the line index = test(the one I created) under SplunkForwarder\etc\apps\Splunk_TA_Windows\default.inputs.conf and restarted the forwarder, logged into main Splunk instance and in the search query I searched for index=test, but it is showing zero events. Is there anything am supposed to do?

Posts	60
Solutions	0
Karma Given	2
Karma Received	5
Member Since	‎12-30-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Will there be any issues directly upgrading from S...

Error in splunkd.log: Breaking event because limit...

How to configure Splunk forwarder on Linux?

Retention of SPLUNK data

Recursive monitoring of directories

Query to get the values out of XML data

Query to retrieve the data from the logs

Licensing Issue

Monitoring the directories recursively

Monitoring of remote directory

Re: Query to get the values out of XML data

Re: Query to get the values out of XML data

Re: Query to get the values out of XML data

Re: Query to get the values out of XML data

Re: Query to get the values out of XML data

Query to get the values out of XML data

Re: Query to retrieve the data from the logs

Query to retrieve the data from the logs

Re: Monitoring the directories recursively

Re: Licensing Issue

Re: Licensing Issue

Re: Licensing Issue

Re: Licensing Issue

Licensing Issue

Re: Monitoring the directories recursively

Re: Monitoring the directories recursively

Re: Monitoring of remote directory

Re: Monitoring the directories recursively

Monitoring the directories recursively

Re: Monitoring of remote directory

Re: Monitoring of remote directory

Monitoring of remote directory

Re: Dashboard Creation

Re: Dashboard Creation

Re: Dashboard Creation

Join the Conversation