Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About abhayneilam
abhayneilam
Contributor
Member since:
10-01-2012
06-05-2020
Community Statistics
| Posts | 391 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 39 |
| Member Since | 10-01-2012 |
Activity Feed
- Got Karma for How to execute a Splunk search in a dashboard on click of a button using JavaScript?. 07-19-2024 07:05 AM
- Got Karma for How to route the data in a different index?. 11-24-2020 03:45 PM
- Karma Re: conditional rex in splunk for FrankVl. 06-05-2020 12:49 AM
- Got Karma for How to create two text boxes on a dashboard with a submit button using JavaScript where entered values get stored in a CSV file?. 06-05-2020 12:48 AM
- Got Karma for How to assign colors for a choropleth map based on the range of counts?. 06-05-2020 12:48 AM
- Got Karma for How to assign colors for a choropleth map based on the range of counts?. 06-05-2020 12:48 AM
- Karma Re: timechart OTHER column for linu1988. 06-05-2020 12:47 AM
- Karma Re: timechart OTHER column for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: How to set up cron schedule for per minute data summary index? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to hide or remove the "edit" button from an app's user interface? for raghu_vedic. 06-05-2020 12:47 AM
- Got Karma for ERROR BucketMover. 06-05-2020 12:47 AM
- Got Karma for Splunk - List of Dashboards. 06-05-2020 12:47 AM
- Got Karma for Applying Quarantine .... Removing quarantine. 06-05-2020 12:47 AM
- Got Karma for Your session has expired. Log in to return to the system. 06-05-2020 12:47 AM
- Got Karma for Re: timechart with delta command using by clause. 06-05-2020 12:47 AM
- Got Karma for Background chart Overlay in Area Graph. 06-05-2020 12:47 AM
- Got Karma for Splunkweb performance help: "system is approaching maximum number of historical searches". 06-05-2020 12:47 AM
- Got Karma for How to get data to appear on a graph after adding the "%" character to numeric results?. 06-05-2020 12:47 AM
- Got Karma for Dashboard Error: Pulldown is configured statically but with only a single static option. 06-05-2020 12:47 AM
- Got Karma for How do I find out why _indextime is greater than _time for a lot of my events?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
05-28-2015
12:59 PM
05-29-2015 01:01:48.091 +0530 ERROR HttpListener - Exception while processing request from 192.168.56.1 for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+(phonehome)+&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&=1432841136381: Connection closed by peer
05-29-2015 01:01:48.091 +0530 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+index%3D_internal+(phonehome)+&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&=1432841136381 sent a 0 byte response after earlier claiming a Content-Length of 705!
05-29-2015 01:13:40.401 +0530 ERROR HTTPClient - Cannot resolve IP of host=apps.splunk.com: Temporary failure in name resolution
05-29-2015 01:13:40.401 +0530 ERROR ApplicationUpdater - Error checking for update, URL=/api/apps:resolve/checkforupgrade: Invalid URI
This I have got from "grep -i "error" splunkd.log" in my DS
... View more
05-28-2015
12:54 PM
[root@localhost local]# telnet 192.168.56.111 8089
Trying 192.168.56.111...
Connected to 192.168.56.111.
Escape character is '^]'.
I am able to connect to my DS from UF
... View more
05-28-2015
12:10 PM
[root@localhost splunk]# grep -i "reset" splunkd.log
05-28-2015 13:44:09.331 -0500 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
05-28-2015 13:54:56.304 -0500 INFO LMTracker - Setting feature=ResetWarnings state=DISABLED_DUE_TO_LICENSE (featureStatus=2)
... View more
05-28-2015
11:56 AM
[root@localhost local]# cat deploymentclient.conf
[target-broker:deploymentServer]
targetUri = 192.168.56.111:8089
and below are the error text from the Universal Fowarder ( My Deployment Client )
[root@localhost splunk]# grep -i "Error" splunkd.log
05-28-2015 13:44:10.946 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.
05-28-2015 13:54:58.114 -0500 ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf.
... View more
05-28-2015
11:50 AM
Hi,
I have configured my universal forwarder as a deployment client and my search head as a " deployment server"
but still when I go to the forward management console of Search Head, I could see 1 application, 1 server class, but 0 deployment client
and beside that, it is showing "DEPLOYMENT ERRORS" .
could you please let me know how to solve this problem ?
Note : I have verified my deployment client is connecting to the right deployment server ( ./splunk show deploy-poll ) . I am not able to understand , even after doing every thing correct why it is showing like "DEPLOYMENT ERRORS" . I have SearchHead and UF in oracle VM.
... View more
02-26-2015
04:30 AM
I have used fieldformat Field_One=tostring(Field_One) + "%" also but again in the number it is showing % but in the visualization it is not showing the graph .
... View more
02-26-2015
04:08 AM
1 Karma
Hi,
I have a search which is showing the percentage of success and failure, but when I am adding "%" sign along with the numbers, I am not able to see the graph as this becomes a string.
| eval Field_one=round((Failure/Total)*100,2)." %" | eval Field_two=round((Success/Total)*100,2). " %" | .....
Now that "%" is added to both fields, it is causing the graph to not be shown and there is no data displayed for these two fields. When I remove "%" I am able to see the data on the graph.
My requirement is to see the numbers with % sign in the dashboard.
Please help !!
... View more
02-06-2015
05:28 AM
I am using scripted authentication which as working fine, suddenly it stopped, other team members are able to login except me. If I am trying to login from a different machine, it is giving the same error :
Your session has expired. Log in to return to the system
I am login in to my computer with password which does LDAP authentication and the same password is for login to Splunk for that to do we have scripted authentication in splunk and also AAA authentication permission has been granted to access the splunk.
But I am able to login to other Search Head , I have only problem with the search head 20.
... View more
02-06-2015
03:40 AM
Any solution is highly appreciated !! Please Help !!
... View more
02-05-2015
03:28 AM
1 Karma
When I am trying to login to my Search Head I am getting the below error under the login page of Splunk :
Your session has expired. Log in to return to the system
My other team members are able to login in without any problem , this problem is happening only for me alone. Till yesterday all was fine. suddenly it has started like this. I have checked trying login in from different PC but again the same stuff.
Please help !!
... View more
02-03-2015
05:23 AM
Nothing was changed !! that's why it is strange , suddenly it happened.
... View more
02-03-2015
04:05 AM
We have this configured from the past 1 year, so all fine , no issues until yesterday, suddenly I dont know, Quantine issue appears :
02-03-2015 09:47:19.246 +0100 INFO TcpOutputProc - Removing quarantine from idx=XXXXX:9997
02-03-2015 09:47:39.247 +0100 WARN TcpOutputProc - Cooked connection to ip=XXXXX:9997 timed out
02-03-2015 09:47:39.248 +0100 WARN TcpOutputProc - Cooked connection to ip=XXXXX:9997 timed out
02-03-2015 09:47:39.248 +0100 WARN TcpOutputProc - Cooked connection to ip=XXXXX:9997 timed out
02-03-2015 09:47:39.248 +0100 WARN TcpOutputProc - Applying quarantine to ip=XXXXX port=9997 _numberOfFailures=2
... View more
02-03-2015
03:19 AM
1 Karma
Hi,
I have a UF in which Splunk_TA_nix application is installed and it was working fine but suddenly it started giving these errors in splunkd.log which causes discountinuty of sending the data to the Indexers.
02-03-2015 12:05:39.119 +0100 INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
02-03-2015 12:05:50.632 +0100 WARN TcpOutputProc - Cooked connection to ip=XXXXXXXXXXX:9997 timed out
02-03-2015 12:05:56.872 +0100 INFO ExecProcessor - Ran script: /opt/SP/apps/splunkforwarder/Splunkforwarder-5.0/etc/apps/Splunk_TA_nix/bin/ps.sh, took 74.28 milliseconds to run, 11510 bytes read
02-03-2015 12:05:57.594 +0100 INFO ExecProcessor - Ran script: /opt/SP/apps/splunkforwarder/Splunkforwarder-5.0/etc/apps/Splunk_TA_nix/bin/cpu.sh, took 1043.8 milliseconds to run, 1003 bytes read
02-03-2015 12:06:00.636 +0100 WARN TcpOutputFd - Connect to XXXXXX:9997 failed. Connection refused
02-03-2015 12:06:00.636 +0100 ERROR TcpOutputFd - Connection to host=XXXXXXXXXXX:9997 failed
02-03-2015 12:06:00.636 +0100 WARN TcpOutputProc - Applying quarantine to ip=XXXXXXXX port=9997 _numberOfFailures=2
I have an outputs.conf which is as follows :
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = AABBCCDD:9997
useACK=true
sendCookedData = true
[tcpout-server://AABBCCDD:9997]
Note : AABBCCDD is the load balancer server ip
Data is appearing in the dashboard but not in the continous manner, it is missing for last 3 hours , sometimes it is missing for last 30 mins. Please HELP !!
Cheers,
... View more
- Tags:
- data
01-15-2015
05:58 AM
I have done :
in props.conf
[AAA_GOOD]
SHOULD_LINEMERGE = false
TRANSFORMS-set = setnull,setparsing,add_host,BBB_MORE
in transforms.conf
[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = AAA\s[good
DEST_KEY = queue
FORMAT = AAA_Index
[add_host]
SOURCE_KEY = MetaData:Host
REGEX = ^host::(.*)$
FORMAT = HS="$1" $0
DEST_KEY = _raw
[BBB_MORE]
REGEX=^(.?)\s(\d+-\d+-\d+)\s(\d+:\d+:\d+,\d+)\sAAA\s[good]\s[\d+]\s(\w+)\s::\s(.)
FORMAT=$1 AA=aa BB=bb CC="$2T$3" DD=$4 EE=$5
DEST_KEY = _raw
Please let me know if this is correct.
I am using my own index name "AAA_Index" instead of "indexQueue" in props.conf suggested by you. Is it correct ?
... View more
01-15-2015
04:29 AM
I am giving \s for denoting spaces and also giving \ before .
I have a string like
blah blah AAA [good.verygood.wow] blah blah
... View more
01-15-2015
04:15 AM
If my value is something like :
AAA\s[good\sverygood\swow]
then it should be like
[^AAA\s[good.verygood.wow]] right ? please suggest !!
... View more
01-15-2015
03:54 AM
Hi,
I have a lot in which the below lines are coming
AAA good
BBB good
AAA good
CCC good
DDD bad
AAA bad
I want to nullify the lines which does not have "AAA good" sting. please help me in writing the transforms.conf :
[AAA_GOOD]
REGEX = (?!)AAA\sgood
DEST_KEY = queue
FORMAT = nullQueue
Please help !!
... View more
- Tags:
- Negation
- transforms
12-27-2014
10:56 AM
Where it should be mentioned , please give me the code snippet
... View more
12-26-2014
04:29 AM
Hi MuS,
thanks for the prompt reply but this example is totally different from mine. my question is entirely different.
... View more
12-26-2014
02:40 AM
Hi,
I have a dropdown with the list of countries like IN, UK, KR,JP etc which is in COUNTRY field . Now , I have multiple dashboard panels for one of the panels data does not appear for IN COUNTRY and it is showing "No results found. Inspect .... But my requirement is instead of showing this message it should show "No data is there for IN Country".
Which every the Country I will select, if it does not find any data then it should throw a message like "No data is there for JP Country" ( If there is not data for JP Country )
Please help !!
... View more
12-04-2014
11:17 PM
Many thanks it helped me to get the desired result !!
... View more
12-04-2014
07:29 AM
and moreover in my question it was that .. I want to index all those lines which are not starting with 'aa' I mean a combination of space and tab followed by "aa"
... View more
12-04-2014
07:23 AM
I have just seen that my patter is something like :
aa yes it is good
aa he he not bad
So every time before "aa" there is a space or tab I dont know but there is a blank. so it means a line is starting with either space or tab and then followed by 'aa'.
Please help in this !!
... View more
12-04-2014
06:09 AM
Hi,
I have a file which has a data in which many lines are starting with "aa", so I don't want to index all the lines starting with "aa", I only want to index those lines which are not starting with "aa" and also I want these lines to be indexed in a particular index called "AAA". So I want a configuration for this in transforms.conf.
Thanks in advance !!
... View more
12-04-2014
12:59 AM
But again, after creating views, I am searching my view name in the search button in the same application where I have created the view but it is still invisible ( that is the main problem ) view is not visible.
I can only find view through putty in my unix box. Once I copy from my user local to app local then only my view is visible in splunkweb.
Please let me know if you need more clarification on this !! My problem is that I am not able to find my view, then how do I change the permission. View is not visible at all unless I am moving it from user local directory to the app local directory.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
