Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About alemarzu
alemarzu
Motivator
Member since:
03-10-2014
11-22-2024
Community Statistics
| Posts | 321 |
| Solutions | 35 |
| Karma Given | 35 |
| Karma Received | 49 |
| Member Since | 03-10-2014 |
Activity Feed
- Posted Re: How to Identify which HF is sending logs/metrics on Getting Data In. 11-22-2024 07:47 AM
- Got Karma for Re: How to split data into separate sourcetypes with transforms. 07-16-2024 01:04 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 05-25-2022 08:23 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 04-11-2022 10:45 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 01-06-2022 10:44 AM
- Posted Re: Windows Eventlog Blacklist Failing on Getting Data In. 06-09-2021 08:52 AM
- Posted Re: Using regex in field extraction on Splunk Search. 06-09-2021 08:40 AM
- Posted Re: CSVファイルのデータが一部文字化けして欠損する on Monitoring Splunk. 06-08-2021 02:43 PM
- Posted Re: Failed to load source for Event Timeline Viz visualization on Dashboards & Visualizations. 01-11-2021 12:38 PM
- Karma Re: ITSI Service Analyzer doesn't show anything for timothywatson. 01-11-2021 12:26 PM
- Got Karma for Re: Has anyone Splunked Trello data?. 01-04-2021 07:54 PM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 03:02 AM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 02:57 AM
- Got Karma for Re: Clarification on search query to detect outliers. 10-26-2020 11:11 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-24-2020 02:27 AM
- Posted Re: Clarification on search query to detect outliers on Splunk Enterprise Security. 10-24-2020 12:40 AM
- Posted Re: help on where condition on Dashboards & Visualizations. 10-23-2020 06:28 PM
- Posted Re: How to configure UF to send data to splunk stand alone instance? on Splunk Enterprise. 10-23-2020 06:04 PM
- Posted Re: TA-DMARC scheme error on All Apps and Add-ons. 10-23-2020 05:44 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-23-2020 05:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-28-2016
08:02 AM
Try adding this to your props.conf
BREAK_ONLY_BEFORE = \d{4}-\d{2}-\d{2}\s
SHOULD_LINEMERGE = true
... View more
01-28-2016
07:31 AM
I am trying to configure Splunk Mobile Access on one of our customers, and I couldn't find much information regarding its requirements.
We are mounting a DMZ and the first thing we need is to open the ports, but I am not sure which of them, we made it work inside our LAN, but our customer is expecting us to tell them which ports should be open and on which direction.
As far as we know, ports 8000 and 8089 are needed inbound, but as the Splunk Mobile App can receive notifications, I guess that some other port should be opened, some outbound port.
And one more thing, in this page http://docs.splunk.com/Documentation/MobileApp/2.2.0/Install/Requirements and to be more precise "Limitations", what if I'm using the Splunk Mobile App WITH Splunk Add-on for Mobile Access, do I have to use other instead of 8000 & 8089 ?
KR, alemarzu.
... View more
01-26-2016
05:56 AM
Hi there Renems,
Try with this,
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
SEDCMD=s/svc;.*?Storage_Class//g
LINE_BREAKER=([\r\n]*)(?:[A-Z]{1,}\d{1,})(?=;\d{4}\/\d{2}\/\d{4})
... View more
01-25-2016
05:15 AM
Hi ashoksamal,
Do you mind sharing an entire event sample so I can help you ?
... View more
01-22-2016
08:51 AM
Ok then, try with this one,
NOT "\"IMPORTANT\": {}," | rex mode=sed "s/...//g" | rex max_match=0 field=_raw "(?s)(?!\IMPORTANT\":\s{)\s{9,}\"(?.?)\":" | rex max_match=0 field=_raw "(?s)(?!\IMPORTANT\":\s{)\s{9,}.?(?::|:\s+)(?\d+)" | table timestamp KEYS VALUES
Let me know if it works.
EDIT: Improved. You have to scape quotation marks after the NOT operator, notice the doble quotes. This will filter events without "KEYS".
... View more
01-22-2016
04:49 AM
Great xrtan, do you mind sharing the answers, it may help other members.
... View more
01-21-2016
12:04 PM
If you need some help with it just let me know.
... View more
01-21-2016
11:17 AM
Awesome spike, glad I could help!
... View more
01-21-2016
11:07 AM
Sure,
sourcetype="_json" | rex mode=sed "s/\.\.\.//g" | rex max_match=0 field=_raw "(?s)\s{9,}\"(?<KEYS>.*?)\":" | rex max_match=0 field=_raw "(?s)\s{9,}.*?(?:\:|\:\s+)(?<VALUES>\d+)" | table timestamp KEYS VALUES
... View more
01-21-2016
10:38 AM
1 Karma
Spike,
Are this results acceptable for you ?
http://postimg.org/image/5ofc2b29v/
... View more
01-21-2016
09:35 AM
Yes, you can troubleshoot any .conf file u need.
... View more
01-21-2016
07:50 AM
U were right, thx 😉
... View more
01-21-2016
07:38 AM
1 Karma
I just realized that the regex you gave us has an invalid structure. Do you mind sharing a sample data so I can build the proper regex ?
... View more
01-21-2016
07:14 AM
It's okey, it wont be in /system/local. Check under $SPLUNK_HOME/etc/apps/launcher/local it's going to be there.
You could also run this from the CLI for troubleshooting that particular .conf file
$SPLUNK_HOME\bin> splunk cmd btool inputs list
... View more
01-21-2016
06:42 AM
Hi fairje,
Try this regex,
(?i)(?<App_Name>\S+(?:\.exe))
... View more
01-21-2016
06:15 AM
1 Karma
Hi spike,
Did you try using max_match=0, which means unlimited matches ?
| rex max_match=0 field="A" "(?<C>[\da-z\.-]+\.[a-z\.]{2,6})\n(?<D>\d{1,3})"
Notice that I've also removed the curly brackets.
... View more
01-21-2016
05:32 AM
In $SPLUNKFORWARDER_HOME/var/log/splunk you will find splunkd.log you may find a hint there.
Did you read this ?
https://answers.splunk.com/answers/223604/why-is-no-data-being-indexed-after-deploying-the-s.html#answer-345964
... View more
01-21-2016
05:13 AM
Hi Flynn,
Have you installed the Supporting Add-on for Active Directory (LDAP-search) ?
Take a look in here for any error message, $SPLUNK_HOME/var/log/splunk/SA-ldapsearch.log
Add-on Docs (troubleshooting): http://docs.splunk.com/Documentation/SA-LdapSearch/2.1.2/User/UseSA-ldapsearchtotroubleshootproblems
Did you map "winfra-admin" role to your user account ?
Did you deploy "TA-DomainController-NTx" Add-on on your Domain Controller based on OS version ?
You should read this http://docs.splunk.com/Documentation/MSApp/1.2.0/MSInfra/TroubleshoottheSplunkAppforWindowsInfrastructure
Hope it helps.
... View more
01-21-2016
04:35 AM
1 Karma
Hi uktechnologyservices,
Try like this,
[tcpout]
defaultGroup = My_Cluster_1
[tcpout:My_Cluster_1]
server = 10.1.4.32:9997,10.1.4.33:9997
... View more
01-20-2016
12:57 PM
It's okey mate, dont worry about it.
Check this out, based on your sample data again, this regex should match (n) amount of fields.
s/(?<==)(\d+\.\d{1,}+|\d+)(?=.*?key=bad)/X.XX/g
EDIT: regex101 example, https://regex101.com/r/uM9nW8/1
... View more
01-20-2016
12:23 PM
Did you tried to search those events directly on the Heavy Forwarder first ? (udp:514)
What about rules on your firewall, did you check them ?
... View more
01-20-2016
12:14 PM
Cool then 😉
Dont worry about it!
... View more
01-20-2016
05:14 AM
1 Karma
You wont need to, just drop them in your search head.
... View more
01-19-2016
11:15 AM
Hi twinspop,
Try to follow this example using your sample data.
01/19/2016 11:34 v1=1 v2=2 v3=3.45 v4=4 key=bad
01/19/2016 11:22 v1=6 v2=7 v3=8.45 key=good v4=9
With the given SEDCMD regex below, using Positives Lookbehind/Lookahead.
[your_sourcetype]
SEDCMD = s/(?<=v1=).*(?=\sv2=.*?\skey=bad)/X.XX/g s/(?<=v2=).*(?=\sv3=.*?\sv4=.*?\skey=bad)/X.XX/g s/(?<=v3=).*(?=\sv4=.*?\skey=bad)/X.XX/g s/(?<=v4=)\d(?=\skey=bad)/X.XX/g
Hope it helps.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-22-2024
07:49 AM
|
Karma given to
