About uagraw01

uagraw01 · ‎07-25-2020

How to hide this message in dashboard ?

uagraw01 · ‎07-19-2020

I used splunk catchpoint add-ons to fetch the data from catchpoint. But after i mapped into splunk i can see only 12 hours of data into splunk. I want all 24 hours of data. Can any one tell me what settings i need to modify in catchpoint or in splunk add-on.

uagraw01 · ‎07-18-2020

@richgalloway Yes same thing happened from my side. It is parsed but same error is displayed.

uagraw01 · ‎07-15-2020

<July 13, 2020 10:55:02,572 PM CDT> <Error> <oracle.oam.binding> <OAM-00002> <Error occurred while handling the request. This is the sample log.

uagraw01 · ‎07-15-2020

@faizancool85 i used all these six settings but when i used TIME_FORMAT the above error is showing to me.

uagraw01 · ‎07-15-2020

@faizancool85 The same error which i pasted earlier.

uagraw01 · ‎07-15-2020

@faizancool85 yes added but still not working. But when i remove TIME_FORMAT completely and use only LINE_BREAKER=\w{3}\s\d{2},\s\d{4}\s\d{2}:\d{2}:\d{2},\d{3}\s\w{2}\s\w{3} It is perfectly parsed. But i want to use time format also. Please let me know what is the reason that not get parsed or showing the above error as mentioned earlier.

uagraw01 · ‎07-15-2020

@richgalloway Still showing the same error. Please let me know to fix this.

uagraw01 · ‎07-14-2020

@richgalloway I will try and let you know.

uagraw01 · ‎07-14-2020

@richgalloway Above is the error. Please help me how to fix this one.

uagraw01 · ‎07-14-2020

My logs are that kind : <July 13, 2020 10:55:02,572 PM CDT> So i used TIME_FORMAT=%b %d, %Y %H:%M:%S, %3N%p%z But it is not parsing and showing me error that " could not use strptime to parse timestamp from "july 13, 2020 10:52:03,907 PM CDT> Please let me know how to solve this issue.

uagraw01 · ‎07-14-2020

@anilchaithu Yes i have the event which occured 4 days ago for that error. When i run a simple search as @richgalloway suggest it capture that event. But when i used to create a field for that error as you also suggest, it is not capturing any event.

uagraw01 · ‎07-14-2020

@anilchaithu The mentioned SPL is not working.

uagraw01 · ‎07-13-2020

@anilchaithu Yes this approach is also seems correct. I will try this one and let you know.

uagraw01 · ‎07-13-2020

@richgalloway yes i tried this also, its working. Beacuse server is generating this error after every 2 or 3 days not sure. So if you suggest, can i set this simple one query into the final alert ?

uagraw01 · ‎07-13-2020

I want to create an alert for one particular error. So what would be the exact spl i need to write? Error is not in the intersting field.So i used this one. I did from my end : index=os source="/var/log/messages" | eval new_error= "server is not responding" Is the above search correct? If not then please provide me the correct one.

uagraw01 · ‎07-07-2020

@richgalloway So you want me to use only TIME_FORMAT=%x %H:%M:%S.%3N and remove %Z?

uagraw01 · ‎07-06-2020

@richgalloway Yes i will check, please let me know if source system and that source system logs are different timestamps, then it will create any latency ? And how to solve that?

uagraw01 · ‎07-06-2020

@richgalloway event time is CDT. So what i need to do.

uagraw01 · ‎07-06-2020

My index time is 7/6/20 3:37:42.210 PM My event time is 07/06/20 10:37:42.210 CDT My TIME_FORMAT=%x %H:%M:%S.%3N%Z But still, by referencing the above time, we can see the latency between index time and event time. Please suggest how to resolve this.

uagraw01 · ‎07-05-2020

So if i have capabilities of schedule_search, then it will get resolve the issue ?

uagraw01 · ‎07-05-2020

In my case alert is not triggered when particular log is generated. So i checked that the person who created that alert previously has no permission for scheduler search when i verify from internal logs and beacuse of this i am not able to see any view result for job runs. So please suggest if i will create new alert by with all scheduled search permission, so it will get resolve or not ? Means schedule search is directly proportional to alert triggered ?

uagraw01 · ‎07-04-2020

@gcusello I want to upgrade this from 6.5.5 to 7.2 ? You have any documented steps rather than Splunk docs. If you have please share it with me.

uagraw01 · ‎07-04-2020

@gcusello Thanks for sharing this.

uagraw01 · ‎07-04-2020

Thanks @acharlieh as i already referred this before.

Posts	525
Solutions	1
Karma Given	152
Karma Received	6
Member Since	‎06-03-2020

Online Status	Offline
Date Last Visited	2 weeks ago

Splunk Users not visible

Splunk DB connect issue

Manual field extraction

Real time data timestamp is not matching

Events mismatch values with lookup values

Time field is not matching with _time

Splunk user role restriction

Splunk DB connect to Splunk

Timestamp fixing

Email receipents from saved searches

Splunk dashboard

Catchpoint Splunk addons

Re: Timezone

Re: Timezone

Re: Timezone

Re: Timezone

Re: Timezone

Re: Timezone

Re: Timezone

Re: Timezone

Timezone

Re: Is my alert query is correct

Re: Is my alert query is correct

Re: Is my alert query is correct

Re: Is my alert query is correct

Is my alert query is correct

Re: Event time and index time

Re: Event time and index time

Re: Event time and index time

How to resolve latency between event time and inde...

Re: Alert not triggered

Alert not triggered

Re: Universal forwarder upgradation

Re: Universal forwarder upgradation

Re: Universal forwarder upgradation