About vectorsc

vectorsc · ‎03-07-2013

oddly, the inputs and such we were using and the methods we used were identical to the way you were doing it. It still didn't work in 4.3.2. That said, we were able to change the double quoted commas to something else (pipe symbol) and that worked just fine. Most aggravating. I will likely re-attempt this issue at a later date in 5.x

vectorsc · ‎11-27-2012

It was the timestamp algo...but in a super strange fashion. It locked on to another timestamp and everything blew up.

vectorsc · ‎11-27-2012

It was the timestamp algo...but in a super strange fashion. It locked on to another timestamp and everything blew up.

vectorsc · ‎09-25-2012

Example Line: "Stuff to be, together as one item",nextvalue,andanother,andso-on When using splunk auto header detection and DELIMS="," this blows up and shifts the non-quoted fields back, and gives the values: Field1: "Stuff to be Field2: together as one item" Field3: nextvalue Field4: andanother Field5: andso-on Any way around this other than a massive regex? if if you did make a massive regex (we did actually), how would you make it cope with the following: LINE1: "Stuff to be, together as one item",nextvalue,andanother,andso-on LINE2: "Stuff to be, together as one item, and this stuff too, and there might be 10 of them...",nextvalue,andanother,andso-on

vectorsc · ‎09-25-2012

No - exploding is just the term that popped to mind after spending a week building the event extraction for this data. The indexer still runs afterwards. Unfortunately, I cannot provide a sample data set. This data is highly (instantly fired) confidential, and scrubbing it of proprietary information would likely kill any usefulness due to changing it up. I can tell you: a) it is a very large text file, CSV formatted. b) field extraction does not occur on the indexer, only on the search head. c) the file usually has a header and then 5000+ lines of single line/single event data. 4) The sourcetype is custom, and the only modifier on the sourcetype is no linemerging. V) I have piped the data in over a network port with identical results. f) No clue what goes here, but the differences in line number schemes makes this entry into my list utterly necessary.

vectorsc · ‎09-23-2012

No NQF, have moved from using the forwarder to netcatting straight to the indexer, so I know its dying at the indexing engine and not at the forwarder.

vectorsc · ‎09-21-2012

Good times....good times. Splunk is refusing to index past 42 lines of my data regardless of what I do. This is WC on my file. 5929 > 86549 > 2439613 report.csv I have tried the following: 1. Set linemerge to false. This allowed splunk to break my data down in to separate events properly. It is 5929 lines, one event per line. 2. Set this item up as a monitor input on my universal forwarder. 42 great lines of everything OK, the CRUNK it stops. 3. Looked at the file - there are no special characters whatsoever other than EOL at the breaking point. 4. Netcatted the file to a TCP port on the indexer itself. Gave me 42 beautiful events before exploding. 5. Oneshot that thing. No help. I KNOW that 42 is the meaning of life...but....but...

vectorsc · ‎09-09-2012

I cannot seem to get HiddenPostProcess geoip lookups to work. I know I'm passing the IP field down to the subsearches, but I am not getting results on Google Maps when I run the geoip script in it. If I geoIP in the original HiddenSearch, it works fine. Thoughts?

vectorsc · ‎08-24-2012

So using Google Maps I have a series of events that are showing up in Japan. These events have Lat and Lon values that end in xx.0. When I click on a cluster to drilldown the search that is spawned cuts everything after the decimal point off of the _geo value it's looking for. For example, the drilldown should say | search _geo="38.0,144.0". Instead it says | search _geo="38,144" and never returns any results. Any way to get it to quit this?

vectorsc · ‎08-16-2012

This was 100% accurate and the answer of moving the JobProgressIndicator to the top level worked perfectly. Additionally, leaving it out of the XML altogether was not functional for other people looking at this question.

vectorsc · ‎08-15-2012

When using a realtime HiddenPostProcess search to power a dashboard, I find that splunk still spawns one RT search for each dashboard item. I was given to understand this would not occur? Dashboard works fine, just spawns 60 searches when run.

Posts	11
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎06-17-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Splunk unable to handle double-quoted CSV?

Splunk stops indexing my data at 42 lines no matte...

geoIP in HiddenPostProcess

Google Maps Rounding _geo field passed to GeoDrill...

HiddenPostProcess spawns a new realtime search for...

Re: Splunk unable to handle double-quoted CSV?

Re: Splunk stops indexing my data at 42 lines no m...

Re: Splunk stops indexing my data at 42 lines no m...

Splunk unable to handle double-quoted CSV?

Re: Splunk stops indexing my data at 42 lines no m...

Re: Splunk stops indexing my data at 42 lines no m...

Splunk stops indexing my data at 42 lines no matte...

geoIP in HiddenPostProcess

Google Maps Rounding _geo field passed to GeoDrill...

Re: HiddenPostProcess spawns a new realtime search...

HiddenPostProcess spawns a new realtime search for...