Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About smolcj
smolcj
Builder
Member since:
10-02-2012
06-05-2020
Community Statistics
| Posts | 279 |
| Solutions | 10 |
| Karma Given | 92 |
| Karma Received | 46 |
| Member Since | 10-02-2012 |
Activity Feed
- Got Karma for An error occurred while rendering the page template. See web_service.log for more details. 06-18-2020 03:04 PM
- Karma Re: Is there any application through which a .doc file can be generated for abhayneilam. 06-05-2020 12:46 AM
- Karma Re: How to decrease the Size of a single value panel? for sideview. 06-05-2020 12:46 AM
- Karma Re: sourcetype is not listing for emiller42. 06-05-2020 12:46 AM
- Karma Re: Monitor a folder for indikaw. 06-05-2020 12:46 AM
- Karma Re: How to have one or more Pulldown or TextField selections be sticky across all the views in an app for sideview. 06-05-2020 12:46 AM
- Karma Re: CLI Search is NOT exactly the same in WEB GUI for jonuwz. 06-05-2020 12:46 AM
- Karma Splunk Server performance poor for meenal901. 06-05-2020 12:46 AM
- Karma Re: renaming sourcetype for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Can we disable the inspect link from the search results ?? for jonuwz. 06-05-2020 12:46 AM
- Karma Re: Can we disable the inspect link from the search results ?? for jonuwz. 06-05-2020 12:46 AM
- Karma Re: overriding certain values in default.css with application.css for jonuwz. 06-05-2020 12:46 AM
- Karma Re: Is there any application through which a .doc file can be generated for abhayneilam. 06-05-2020 12:46 AM
- Karma Re: Diff dashboard for BobM. 06-05-2020 12:46 AM
- Karma Re: URLLoader Parameters for sideview. 06-05-2020 12:46 AM
- Karma Re: Connecting more than one view for jonuwz. 06-05-2020 12:46 AM
- Karma Re: A Quick question about Application.js for sideview. 06-05-2020 12:46 AM
- Karma Re: passing a variable/token through link search for Leo. 06-05-2020 12:46 AM
- Karma can we fill the Field Values basing on the Other Field Value ? for rakesh_498115. 06-05-2020 12:46 AM
- Karma Get full join result of two logs for foloyo1314. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
11-19-2012
12:29 AM
source=$pub$|rex mode=sed field=source "s/\{1}/\\\//g" | rex mode=sed field=source "s////g"| transaction TaskBP startswith=START endswith=Succeeded
i think this will work
thank you
... View more
11-18-2012
09:55 PM
|rex mode=sed field=source "s/\\\{1}/\\\\\//g" | rex mode=sed field=source "s////g"
use this regex instead
... View more
11-18-2012
09:02 PM
Hi all,
I have an eventtype called threads. how can i find the number of threads in it? suppose under eventtype threads i have
a1
a2
a11
a12
a111.. etc....
please help.. thank you for your time 🙂
... View more
- Tags:
- number
11-15-2012
11:20 PM
http://splunk-base.splunk.com/answers/50339/timestamp-issue-in-splunk
... View more
11-15-2012
08:57 PM
is there any way to revert the admin properties?
... View more
11-15-2012
05:24 AM
yes, it is fine.. these lines comes under an even. but i have to extract it and show separately as a table..
thank you
... View more
11-15-2012
05:15 AM
as i mentioned, i am using a dropdown box in this view.i.e. user will select a source from the dropdown box and he will get some statistics of that source, number of event bla bla bla... so i used this rex along with the search used to populate the dropdown box.
hop it helped you
thanks
... View more
11-15-2012
05:12 AM
the regex i extracted is working fine in http://gskinner.com/RegExr/
somebody please tell me how to extract multivalue from same line or event(in splunk language)..
another issue is enabling or disabling something in general will make my some other extractions in trouble.. so suggest something which i can use only for this particular field
thank you
... View more
11-15-2012
04:48 AM
i am extracting "Event" and something as 2 separate fields
regex is like (?i)Thread\s(?P [^\s]+)\sblablabla\s[(?P [^]]+)]...completed.no\sstatistics
like this i am trying to extract 2 fields but only the first occurrence is extracting. shall i use TOKENIZER but i guess it is for separating same field elements.. i have already a field named event and it is extracting correctly bot not these thread fields
... View more
11-15-2012
04:39 AM
yes it have a time stamp
log is like
timestamp severity processid Event1 bla blalog info
******** log statistics*******
Thread Event1 blablabla [something]....completed.
idletime:45.56
Thread Event2 blablabla [something]....completed.no ststistics
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.
idletime:45.56
timestamp severity processid Event1 bla blalog info
timestamp severity processid Event1 bla blalog info
timestamp severity processid Event1 bla blalog info
... View more
11-15-2012
04:34 AM
The real issue is splunk reads only the first occurence of the event1 the second line is not reading as because it is in same event, how can i extract all the events?
please help
... View more
11-15-2012
04:06 AM
1 Karma
http://docs.splunk.com/Documentation/Splunk/4.3.4/Admin/RemovedatafromSplunk#Remove_data_from_indexes_with_the_CLI_clean_command
try this
thank you
... View more
11-14-2012
11:27 PM
is it because i changed some admin properties.. help me to revert it
... View more
11-14-2012
09:35 PM
3 Karma
Hi all,
"An error occurred while rendering the page template. See web_service.log for more details"
When i changed admin properties i got this error. i tried restarting service. but error persists. please help .
thank you
webservice log is like
Traceback (most recent call last):
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\rest_init.py", line 458, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-11-15 10:53:23,819 WARNING [50a47c4bc25b85b70] ifx:186 - Problem determining if fieldname exists: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/admin/ULTRAMESSAGING_FOLDER/properties/props?fillcontents=1
2012-11-15 10:54:04,509 ERROR [50a47c74465cb1f28] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\rest__init.py", line 458, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-11-15 10:54:53,681 ERROR [50a47ca59956d77b8] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "v\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\rest__init.py", line 458, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-11-15 10:58:31,335 ERROR [50a47d7f0e5c4ab38] config:81 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
Traceback (most recent call last):
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\config.py", line 79, in getServerZoneInfo
return times.getServerZoneinfo()
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\lib\times.py", line 158, in getServerZoneinfo
serverStatus, serverResp = splunk.rest.simpleRequest('/search/timeparser/tz')
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\rest__init.py", line 458, in simpleRequest
raise splunk.AuthorizationFailed(extendedMessages=uri)
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/search/timeparser/tz
2012-11-15 11:03:26,789 ERROR [50a47ea5c53a3d7f0] messages:114 - Splunkd daemon is not responding: ('[Errno 10061] No connection could be made because the target machine actively refused it',)
Traceback (most recent call last):
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\messages.py", line 81, in index
entries = splunk.entity.getEntities(uri)
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\entity.py", line 152, in getEntities
serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)
File "Splunkhome\Python-2.7\Lib\site-packages\splunk\rest__init_.py", line 418, in simpleRequest
raise splunk.SplunkdConnectionException, str(e)
SplunkdConnectionException: Splunkd daemon is not responding: ('[Errno 10061] No connection could be made because the target machine actively refused it',)
2012-11-15 11:03:36,769 INFO [50a469edd525863c8] root:134 - ENGINE: Bus STOPPING
... View more
- Tags:
- error
11-14-2012
05:06 AM
AYN, the log is defined so, these part of the log comes under some log summary.. so even if it come in next line, it is of same event details.
... View more
11-14-2012
05:00 AM
All these logs come under one event, so even if i use (?m) only the first event name is extracting
... View more
11-14-2012
04:26 AM
Hi all,
Regex is troubling me when i have to extract a field compared with previous line. My log is like
Thread Event1 blablabla [something]....completed.
idletime:45.56
Thread Event2 blablabla [something]....completed.no ststistics
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.no ststistics
Thread Event5 blablabla [something]....completed.
idletime:45.56
how to extract those idle time related with Event1? i have extracted the evantnames as field, but i am not getting any idea to continue the search with a regex.. please help..
Thank you for your time
Question edited
i am sorry that i am confusing you people.. i will try to be more precise about my question.
1.timestamp : [threadname] : threadid :logdetails
2.timestamp : [threadname] : threadid
...........log summary............
Thread Event1 blablabla [something]....completed.no ststistics
Thread Event2 blablabla [something]....completed.
idletime:33
busytime:88
Thread Event3 blablabla [something]....completed.no ststistics
Thread Event4 blablabla [something]....completed.
idletime:55
busytime:99
3.timestamp : [threadname] : threadid :logdetails
4.timestamp : [threadname] : threadid :logdetails
so issue here is, splunk reads only the first field that is it will read the italicized inputs, but i need it to read all the data in BOLD. i know that this issue is because splunk extract only the first value from a line and ignores the repeated ones and here all these information comes under one event and because of that splunk is ignoring the repeated values
so now please help me to solve this issue
thank you
... View more
11-14-2012
04:19 AM
thanks AYN it worked well with ctime
..| convert ctime(_time) as time|stats earliest(time)
... View more
11-14-2012
03:45 AM
Hi,
Using _time we will get the time of the event. so by using earliest(_time), time is produced as the result. is there any function to return both date and time. i.e. time stamp together.
thank you for your time
... View more
- Tags:
- timestamps
11-08-2012
03:23 AM
1 Karma
Hi all, I am sorry to ask you this question, which has already answered several times before.
Do i have to remove those indexed data before midnight. i failed to do it. will it be a issue later. or the message will disappear after 14 days?
Thank you
... View more
- Tags:
- license-violation
11-08-2012
01:20 AM
not familiar with Hadoop. i think u can update the hidden search including this regex.
thanks
... View more
