Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About theouhuios
theouhuios
Motivator
Member since:
10-05-2012
06-05-2020
Community Statistics
| Posts | 339 |
| Solutions | 15 |
| Karma Given | 19 |
| Karma Received | 61 |
| Member Since | 10-05-2012 |
Activity Feed
- Got Karma for Can Splunk 5 modules like Converttodrilldownsearch be used in 4.3?. 09-29-2022 01:31 AM
- Got Karma for How to chart values over time. 06-16-2021 12:53 PM
- Got Karma for Create new dimensions from collectd. 06-05-2020 12:50 AM
- Got Karma for How do you CIDR Match a subnet in a list of subnets?. 06-05-2020 12:50 AM
- Karma Re: How to display values in the columns for a chart? for Venkat_16. 06-05-2020 12:47 AM
- Karma Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data? for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Re: Why Splunk DB Connect is not properly importing data in Splunk after configuring an Oracle database input?. 06-05-2020 12:47 AM
- Got Karma for Re: Why custom drilldown XML in pie chart doesn't populate target field?. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I unable to edit or create lookups that are local to an app using Lookup File Editor?. 06-05-2020 12:47 AM
- Got Karma for Re: How to split results which are combined in a table and export to a csv?. 06-05-2020 12:47 AM
- Got Karma for Re: How to split results which are combined in a table and export to a csv?. 06-05-2020 12:47 AM
- Got Karma for How to split results which are combined in a table and export to a csv?. 06-05-2020 12:47 AM
- Got Karma for How to split results which are combined in a table and export to a csv?. 06-05-2020 12:47 AM
- Got Karma for REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?. 06-05-2020 12:47 AM
- Got Karma for Re: Timestamp problem with DB Connect. 06-05-2020 12:47 AM
- Got Karma for Re: Permission change detected for Informatica data directory/files. 06-05-2020 12:47 AM
- Got Karma for Re: Why Splunk DB Connect is not properly importing data in Splunk after configuring an Oracle database input?. 06-05-2020 12:47 AM
- Got Karma for Re: Why Splunk DB Connect is not properly importing data in Splunk after configuring an Oracle database input?. 06-05-2020 12:47 AM
- Got Karma for Re: Why Splunk DB Connect is not properly importing data in Splunk after configuring an Oracle database input?. 06-05-2020 12:47 AM
- Got Karma for Re: Filter the source-file of logs with "rex" command to produce fields. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-25-2014
08:38 AM
TIME_PREFIX=^\<\d+\>|^
TIME_FORMAT = %Y:%m:%d-%H:%M:%S
Try this
... View more
11-25-2014
08:18 AM
1 Karma
Hello
I am new to writing Rest APi calls so please pardon my ignorance if its really simple. I wrote a rest api call which talks to cloudera and gets the events. This part works fine. The issue is it polls every 60sec( default) as I am using the Rest API Modular Input and it pulls all data instead of getting just the new events which happened.
Is there a way to tell a REST api call to get only new events? I know that I can have the time in the URL argument which will then keep data limited to only that time, but how to I dynamically change that date time value so that it automatically pulls newer data?
... View more
10-22-2014
11:24 AM
1 Karma
I am trying to connect a Netezza DB to Splunk via DB Connect. Please see the database_type.conf below .
[netezza]
displayName = NetezzaDB
jdbcDriverClass = org.netezza.driver
defaultPort = 5480
connectionUrlFormat = jdbc:netezza://{0}:{1}/{2}
testQuery = select * from _v_user
The jar file is placed in bin/lib too. I get an error Encountered the following error while trying to save: In handler 'databases': JDBC driver (org.netezza.driver) for database type NetezzaDB is not installed
-rwxr-xr-x 1 splunk splunk 345064 Oct 22 13:36 nzjdbc.jar
has anyone connected a Netezza Db to splunk?
Errors: Logs says its registering JDBC driver. But still it errors
2014-10-22 14:17:13.281 dbx1309:INFO:Generic - Registering JDBC driver=org.netezza.driver
2014-10-22 14:17:13.281 dbx1309:ERROR:DatabaseInfoCommand - Error while executing command: Error getting database connection: JDBC driver (org.netezza.driver) for database type NetezzaDB is not installed
... View more
10-07-2014
10:40 AM
try |eventstats count(number) as Value|where Value = 1
That should limit it to events which have one occurrence.
... View more
10-07-2014
05:12 AM
Can you try /var/log/apache*/access.log ? After the restart of the server with the inputs, check the list monitor and see if it list the file.
... View more
10-07-2014
05:08 AM
2 Karma
Try this for rex. Field can be used to pick any available fields which splunk provides on the left hand side and then the rex expression which you write will be applied on that field.
|rex field=source "*SNMP public community \((?<area>.*)\)""
... View more
10-06-2014
08:48 AM
You can write a search to populate that. basically a rex should do it .
When the data is indexed is splunk placing the timestamp? There will be a _time value which will denote the time of the event ( In your case its very likely that splunk places the timestamp of when the file was indexed instead of the _time of event). So if a file in july has been indexed in Aug it might place the date in Aug when the file has been indexed as the _time value.
Coming back to rex
<| rex field=source "BTM_NET_(?\w+)\.">
will give you the month. To limit the data to this you might want to do this if the _time value becomes an issue.
sourcetype=<yoursourcetype> source=*$Month$.csv | <remainingsearch>
... View more
10-06-2014
07:51 AM
Is there no time stamp? Starttime was actually an example. If no timestamp and you want to use ID as rising.column then remove the $STARTTIME$ from your output. If you have timestamp then use that field
... View more
10-06-2014
07:47 AM
Format which works for me
[dbmon-tail:///*]
host = abc
output.format = template
output.timestamp = 1
output.timestamp.column = STARTTIME
query = abcd
sourcetype = mssqlserver
tail.rising.column = STARTTIME
interval = 15
table =xyz
disabled = 0
output.template = $STARTTIME$| $START_TIME$ | $ENDTIME$ | $EventClass$ | $NTUserName$ | $LoginName$ | $SPID$ | $ObjectName$ | $HostName$ | $ClientProcessID$ | $ApplicationName$ | $EventSubClass$ | $ObjectID$ | $Success$ | $ServerName$ | $ObjectType$ | $NestLevel$ | $State$ | $Error$ | $Mode$ | $DatabaseName$ | $FileName$ | $OwnerName$ | $RoleName$ | $TargetUserName$ | $DBUserName$ | $TargetLoginName$ | $textdata$
index = 123
... View more
10-06-2014
07:44 AM
Also I see the rising.column as ID. You sure you dont want it to be the time? Also add this to the input
output.timestamp.column = STARTTIME
... View more
10-06-2014
07:43 AM
Whats the query? Can you post the output you expect it to be as
... View more
10-06-2014
07:26 AM
1 Karma
When you define an input there is an option of selecting what type of Output Format you want. You must have selected kv . Instead of that select Template and for all the columns in your outputs create a template.
For a STARTTIME field , you can have it as $STARTTIME$ in the template. You can use | or a space or any other way you want to define the separation of fields. I used | as its easy to write rex later on it. If you get stucks, post your input here. But should be pretty straight forward. Use the output fields as $$ in the template.
... View more
10-06-2014
07:10 AM
3 Karma
I faced this issue too with rows which have very big values. Instead of trying with props.conf I actually created a template for them which will get the data in a different format Eg: the format which I used . You can place the field which is the very big in the middle of the template to avoid them breaking. Ofcourse, if your event has more than 10k characters, you might want to increase the TRUNCATE value.
$STARTTIME$| $OwnerName$ | $RoleName$ | $TargetUserName$ | $DBUserName$ | $TargetLoginName$ | $textdata$
... View more
09-25-2014
10:15 AM
Does this query work when you try it in Db Query? Remove the tailing part and see if this works. If it does, then do a Cast on the time. After that change the where cwpr.CoreWorkerProcessResultId > 37000000 {{AND $rising_column$}} to {{ where cwpr.CoreWorkerProcessResultId > 37000000 AND $rising_column$ > ?}}
... View more
09-25-2014
07:24 AM
Did you make changes tin the Input and try it in the DB query to see if the new tables are reflected in the output? try to see in DB info if you can see the new tables for that DB Connection. If they show up in that, then try the query in DBQuery and check the output.
... View more
09-25-2014
07:21 AM
1 Karma
Use the java timestamp format. Not the Splunk Timestamp format in output.timestamp.format . DBConnect
Check the links below. 1st one is the Splunks DOC and the line mentioned is what Splunk says on what timestamp to use.
http://docs.splunk.com/Documentation/DBX/1.1.4/DeployDBX/Configuredatabasemonitoring
4. Specify the Timestamp format. This is a Java SimpleDateFormat pattern. The default format is configurable during setup.
This link talks about the timeformat in java.
http://docs.oracle.com/javase/7/docs/api/java/text/SimpleDateFormat.html
Hope this helps.
theou
... View more
09-23-2014
03:34 PM
Yes, That would be the reason. Try the somesoni2 method. That should work. Or else try this
rex field=_raw "\s+(?P<Email>\S+@\S+)\s+\((?P<IPADDRESS>\d+\.\d+\.\d+\.\d+)\)"
... View more
09-23-2014
10:08 AM
Which type of DB is this? SQL? You might want to try
cast( <TIMEfield>AS DATETIME)<fieldname>
... View more
09-23-2014
09:32 AM
Use max_match = 0, which will extract multiple values for a regex expression.
rex field=_raw "Recipients:\s+(?P<EMAIL>\S+)\s+\((?P<IPADDRESS>\d+\.\d+\.\d+\.\d+)\)" max_match=0
... View more
09-18-2014
05:35 AM
Those fields might not have data.
Eg: Lets say you have System= ABC and there is no corresponding data for other fields for that system in an event, then the table command will just list System and give blank result for the rest.
... View more
09-18-2014
05:32 AM
1 Karma
Have you checked the permissions for those lookup files and those Apps? You may have only read access to them.
... View more
09-18-2014
05:29 AM
Use can use rex if the data has been indexed already.
rex :
job.(?P<job>\w+)\.status=(?P<status>\S+)
... View more
09-17-2014
08:05 AM
Thanks for the idea martin. I will try it. The issue is I am not good with the JS. 🙂 Will poke around and see if I can do something like this. Will be amazing to be able to do that.
... View more
09-17-2014
08:03 AM
@Mus
I was able to get it working. Thanks for the idea. Now the only concern is that I have to make sure that the lookup is not overwritten.
... View more
09-17-2014
06:32 AM
Thanks for taking the time MuS. I have some questions though. How would I be able to edit it in the dashboard? Lookup editor edits only that file right? Do I need to place this dashboard in the Lookup App to be able to use that functionality. Sorry about the questions. Kinda confused on how to make it work on the fly for users.
And I need to maintain a lookup file for each host and then integrate it with the dashboard so that a user can change right? this part is simple. I am just confused on how to make the lookup editing part to the user in the dashboard itself.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
