Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Rajshekhar
Rajshekhar
New Member
Member since:
06-09-2011
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-09-2011 |
Activity Feed
- Posted changing Indexer receiver port on Security. 11-25-2011 12:15 AM
- Tagged changing Indexer receiver port on Security. 11-25-2011 12:15 AM
- Tagged changing Indexer receiver port on Security. 11-25-2011 12:15 AM
- Posted Re: text files being ignored on Getting Data In. 11-23-2011 12:20 AM
- Posted Re: text files being ignored on Getting Data In. 11-21-2011 09:11 AM
- Posted Re: text files being ignored on Getting Data In. 11-21-2011 06:55 AM
- Posted Re: text files being ignored on Getting Data In. 11-21-2011 06:12 AM
- Posted text files being ignored on Getting Data In. 11-20-2011 11:16 PM
- Tagged text files being ignored on Getting Data In. 11-20-2011 11:16 PM
- Tagged text files being ignored on Getting Data In. 11-20-2011 11:16 PM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 09:00 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 08:53 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 08:44 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 08:28 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 07:54 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-16-2011 06:13 AM
- Posted Re: convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-15-2011 10:55 PM
- Posted convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-15-2011 12:46 AM
- Tagged convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-15-2011 12:46 AM
- Tagged convert pseudo XML file content to readable format on Dashboards & Visualizations. 11-15-2011 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-25-2011
12:15 AM
We have indexer installed on windows server which is connected to many forwarders(linux servers).
Right now we are using port 9997 as receiver port in Indexer server, we have lots of data in indexer.
Now we need to change the receiver port from existing 9997 to some other port.
1)after changing the port in Splunk indexer, will I be able to search all the past data which was indexed using port 9997?
2)Will I get latest data using new port without any issues?
3)Are there any special modifications we need to do for this to work properly?
Please let me know how I can change the port without causing any issues in existing data.
Thanks|
... View more
11-21-2011
06:12 AM
Also in somefile.out file from other host I see below log
/usr/sap/IX4/SYS/profile/s:key
ignored file (crc conflict, needs crcSalt)/s:key
From above log it should not show this file when searched, but when I searched for this file it gives me results for this file and I can see the file has indexed, which should not have happened I guess..its very strange!
Please help to resolve the above 2 issues.
Thanks in advance!
... View more
11-20-2011
11:16 PM
We have below monitor stanza in inputs.conf file
[monitor:///usr/sap/IXD/SYS/profile]
disabled = false
index = erp
crcSalt = SOURCE
This profile folder contains 3 important text files DEFAULT.PFL, IXD_DVEBMGS17_spwdfvml0248, START_DVEBMGS17_spwdfvml0248
which we want splunk to monitor. But its monitoring only DEFAULT.PFL file, when searched in indexer its not giving any results, Tried with all wild character search but no use.
Please advice how to solve this issue, this is very critical for us as these files are very important to be monitores in all our several servers.
... View more
- Tags:
- file
- monitoring
11-16-2011
09:00 AM
Thanks for your help 🙂
... View more
11-16-2011
08:53 AM
Yes I will definitely do that. Would you please provide your mailId to me so that in future if I need any help on Splunk it would be easy for me to communicate.
... View more
11-16-2011
08:44 AM
Thank you very much! Now I can see the output as desired
... View more
11-16-2011
08:28 AM
I am giving below search string:
host="spwdfvml0249" index="erp_maxdb" source= "/sapdb/data/wrk/IXV/KnlMsg" | table _COMP,_TEXT
it says no matching fields exist and below that 97888 matching events and in detailed area it says No results found.. Please advice
... View more
11-16-2011
07:54 AM
Thank you so much for answering..
On the left hand side under other interesting fields if i select All 67 fields I can see COMP, FILE and other fields.
... View more
11-16-2011
06:13 AM
I have configured splunk to index the XML file, and its displaying the results as below.
<MSG_ARGS
_FILE="RTEConf_ParameterAccessKernelInterface+noPIC.cpp"
_LINE="1141"
_TIME="2011-11-11 19:01:41.000"
_MESSAGEVERSION="1"
PARAMETER="ADMIN"
VALUE="1"
Please let me know how to divide the fields and show only those fields in tabular format
... View more
11-15-2011
10:55 PM
I want extract few fields(for example, _TEXT, _COMP) and show only those fields in tabular format.
How can I do this. Please assist
... View more
11-15-2011
12:46 AM
We have a file content in the format
</MSG>
<MSG _NO="3" _ID="15" _COMP="RunTime" _TEXT=" $PARAMETER$=$VALUE$">
<MSG_ARGS
_FILE="RTEConf_ParameterAccessKernelInterface+noPIC.cpp"
_LINE="1141"
_TIME="2011-11-11 19:01:41.000"
_MESSAGEVERSION="1"
PARAMETER="ADMIN"
VALUE="1"
This is in pseudo XML format and we want this to be convereted to readable format. At OS level we execute the command spwdfvml0249:sqdixv 96> protconv /sapdb/data/wrk/IXV/KnlMsg > knldiag.txt_1511
to convert and read. How can we do this in splunk? is there any option to parse this data to readable format. Please help
Thanks|Rajshekhar
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
