ここにソースコードと検索ステートメントを貼り付けられますか？ ... View more

What is used in the syslog?Syslog-NG ,rsyslog ?? Can you paste the configuration of syslog? ... View more

The 2 instances are managed by 2 separate teams and both teams requires internal logs to troubleshoot. Thanks for the answer. I will goahead and test this. ... View more

Storage is not an issue since both parties(Security & Operations team works individually and license) need internal logs to troubleshoot. Can I have an example configuration please? Can I just leave all Splunk internal indexes it is in the default dir as it is to forward to both Indexer group or I need to create one default group? ... View more

@gcusello : Just adding to it: Can we forward all default indexes like internal audit etc to both Indexers? ... View more

Where to keep REST API response or which module I need to modify to call other script that takes the response JSON and do check ? ... View more

This works with time ranges. How can I give this as checkpoint? ... View more

The REST API itself not supports to query timestamp greater than or lesser than. For this situation I need help to adjust in script to create a checkpoint of id's that is indexed already. https://${nw_server_hostname}:9090/nwrestapi/v3/global/${endpoint}?q=completionStatus: "Failed" This end point gives me backup failed events like below: { "count":6, "jobs":[ { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultReportHomeTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-16T08:00:00+08:00", "exitCode":1, "id":221372, "itemIdLong":221372, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/221372", "rel":"item" } ], "name":"DefaultReportHomeTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-16T08:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" }, { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultNsrclientfixTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-16T07:00:00+08:00", "exitCode":1, "id":221371, "itemIdLong":221371, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/221371", "rel":"item" } ], "name":"DefaultNsrclientfixTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-16T07:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" }, { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultReportHomeTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-15T08:00:00+08:00", "exitCode":1, "id":221124, "itemIdLong":221124, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/221124", "rel":"item" } ], "name":"DefaultReportHomeTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-15T08:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" }, { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultNsrclientfixTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-15T07:00:00+08:00", "exitCode":1, "id":221123, "itemIdLong":221123, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/221123", "rel":"item" } ], "name":"DefaultNsrclientfixTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-15T07:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" }, { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultReportHomeTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-14T08:00:00+08:00", "exitCode":1, "id":220875, "itemIdLong":220875, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/220875", "rel":"item" } ], "name":"DefaultReportHomeTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-14T08:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" }, { "adhocJob":false, "command":"/xxx/xxxx/xxxxxxx -C DefaultNsrclientfixTask", "completionStatus":"Failed", "dependentJobIds":[ 0 ], "endTime":"2020-01-14T07:00:00+08:00", "exitCode":1, "id":220874, "itemIdLong":220874, "links":[ { "href":"https://{nw_server_hostname}:9090/nwrestapi/v3/global/jobs/220874", "rel":"item" } ], "name":"DefaultNsrclientfixTask", "ndmp":false, "parentJobId":0, "previousJobId":0, "rootParentJobId":0, "runOnHost":"{nw_server_hostname}.xxxxxxx.com", "siblingJobIds":[ ], "startTime":"2020-01-14T07:00:00+08:00", "state":"Completed", "stopped":true, "tenant":"", "type":"task job" } ] } I can only do a check point with endTime field. But cant make a call with "endTime" greater than some timestamp.The vendor REST API is not supported with greater than or less than symbols(https://www.support.nec.co.jp/DownLoad.aspx?file=document%2Fdocu91962_NetWorker-18.2-REST-API-Getting-Started-Guide.pdf&id=3170102299) Is there any way to do a checkpoint so that I can make sure that no duplicate events I am getting everytime make a REST API call. NB:- id field is unique for each event. Is ther a way to do checkpoint using id field? ... View more

Can we setup HA for rsyslog? ... View more

I have identified the issue. The issue is ,the endpoint url to list all applications are not listing EUM application: curl -x http://xxxxxxxx.xxxxxx.com:8080 --user xxxxxxxx@xxxxxxx-xxxx:xxxx'https://xxxxx-xxx.saas.appdynamics.com/controller/rest/applications' When I give the Application ID manually in the input it is fetching EUM data.But the event has no application name. curl -x http://xxxxxxxx.xxxxxx.com:8080 --user xxxxxxx@xxxxxx-xxxx:xxxxxx 'https://xxxxx-xxxx.saas.appdynamics.com/controller/rest/applications/18929 /metric-data??output=JSON&time-range-type=BEFORE_NOW&duration-in-mins=60&metric-path=End%20User%20Experience%7CApp%7CEnd%20User%20Response%20Time%20%28ms%29' Since the script uses /controller/rest/applications rest api we are not getting Application name. # Given an application name, let's find it's ID def get_app_id(app_name): for app in application_list: if app["name"] == app_name: return app['id']; return -1; # Given an application ID, let's find it's name def get_app_name(app_id): for app in application_list: if str(app["id"]) == app_id: return app['name']; return -1; To get application name for EUM we have to use the endpoint below with app_id given in the input: curl -x http://xxxxxxxx.xxxxxx.com:8080 --user xxxxxxxx@xxxxxxx-xxxx:xxxx'https://xxxxx-xxx.saas.appdynamics.com/controller/rest/applications/**<app_id>**' Anyone knows where I need correct to get the application name for EUM using App ID. NB:- The same URL can be used to get application name for APM but if user kept App-name or id blank then this URL unusable. ... View more