Hi all, How can I do to put my real users birthdays on eval, instead 1951-03-30? My birthdate field is data_nascimento. Thanks and regards! ... View more

Hi Amohlmann, I´m new splunk user and not familiar with splunk commands yet. Did you have success to your request? I don´t undertand the expression that you are using. I need the same of you, extract the user age from birth date. Can you help me, please? My field is birthdate and have this formatting: %d%m%y. After yhis, my ideia is create 3 age groups. Example: 1 - Up 18 years old 2 - 18 - 25 years old 3 - 25+ years old Does anybody can help me? Thanks and regards! ... View more

Splunk DB Connect V2 ... View more

Splunk DB Connect V2. Below any error that I see on splunk log: 12/08/2015 11:53:18 [ERROR] [init.py] No rpc server enabled Traceback (most recent call last): File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/init.py", line 185, in dispatch methodOutput = method() File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbquery.py", line 57, in handle_GET self.dbx2 = rpc_service_channel(self.userName, self.sessionKey, host=self.host, verified=False, use_raw_handler=True) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/rpcutils.py", line 30, in rpc_service_channel rpc = get_local_rpc(user, sessionKey, use_raw_handler=use_raw_handler) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/rpcutils.py", line 50, in get_local_rpc raise Exception("No rpc server enabled") Exception: No rpc server enabled 12/08/2015 12:01:28 [ERROR] [search_command.py] Traceback (most recent call last): File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/splunk_sdk-1.3.1.a-py2.7.egg/splunklib/searchcommands/search_command.py", line 316, in process self._execute(operation, reader, writer) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/splunk_sdk-1.3.1.a-py2.7.egg/splunklib/searchcommands/generating_command.py", line 79, in _execute for record in operation(): File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxquery.py", line 123, in generate raise Exception(content) Exception: No rpc server enabled 2015-12-08 11:45:00 ERROR ServiceSocket:107 - An unknown error occurs, the exception class name is java.lang.NullPointerException. java.lang.NullPointerException at java.util.StringTokenizer. (Unknown Source) at java.util.StringTokenizer. (Unknown Source) at com.splunk.dbx2.CachedIterator.next(CachedIterator.java:129) at com.splunk.dbx2.CachedIterator.next(CachedIterator.java:20) at com.splunk.dbx2.ws.ServiceSocket.onWebSocketBinary(ServiceSocket.java:95) at org.eclipse.jetty.websocket.common.events.JettyListenerEventDriver.onBinaryMessage(JettyListenerEventDriver.java:64) at org.eclipse.jetty.websocket.common.message.SimpleBinaryMessage.messageComplete(SimpleBinaryMessage.java:68) at org.eclipse.jetty.websocket.common.events.AbstractEventDriver.appendMessage(AbstractEventDriver.java:64) at org.eclipse.jetty.websocket.common.events.JettyListenerEventDriver.onBinaryFrame(JettyListenerEventDriver.java:58) at org.eclipse.jetty.websocket.common.events.AbstractEventDriver.incomingFrame(AbstractEventDriver.java:155) at org.eclipse.jetty.websocket.common.WebSocketSession.incomingFrame(WebSocketSession.java:309) at org.eclipse.jetty.websocket.common.extensions.ExtensionStack.incomingFrame(ExtensionStack.java:214) at org.eclipse.jetty.websocket.common.Parser.notifyFrame(Parser.java:220) at org.eclipse.jetty.websocket.common.Parser.parse(Parser.java:258) at org.eclipse.jetty.websocket.common.io.AbstractWebSocketConnection.readParse(AbstractWebSocketConnection.java:613) at org.eclipse.jetty.websocket.common.io.AbstractWebSocketConnection.onFillable(AbstractWebSocketConnection.java:468) at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:620) at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:540) at java.lang.Thread.run(Unknown Source) Thanks for help! ... View more

Hi Rich! I have validated on MySQL command line and there we are the correct date and time of event (December 30, 2014). This is the correct data. On MySQL query inside splunk (befor index) the timestamp on DATA COLUMN its correct (December 30, 2014). The incorrect date is on search event, according to the images that I sent you. Please, take a look ate the timeendpos and timestartpos fields on files. The events with incorrect date, the timestartpos are ALWAYS 12 value. Please, take a look at the new image below: http://imageshack.com/a/img903/4308/1qoIWH.png From 21.590 events, only 54 have incorrect date, that match with the timestartpos = 12 value. Do you understood? I hope this help us to troubleshooting. Thanks and regards! Luis Carlos Skype: lcb.lucas ... View more

Hi Rich! I have validated on MySQL command line and there we are the correct date and time of event (December 30, 2014). This is the correct data. On MySQL query inside splunk (befor index) the timestamp on DATA COLUMN its correct (December 30, 2014). The incorrect date is on search event, according to the images that I sent you. Please, take a look ate the timeendpos and timestartpos fields on files. The events with incorrect date, the timestartpos are ALWAYS 12 value. Please, take a look at the new image below: http://imageshack.com/a/img903/4308/1qoIWH.png From 21.590 events, only 54 have incorrect date, that match with the timestartpos = 12 value. Do you understood? I hope this help us to troubleshooting. Thanks and regards! Luis Carlos Skype: lcb.lucas ... View more

yes. But only in a few events, not total of events. ... View more

Hi Rich7177! Thanks for your attention! Below the image links for your requests: 02 files (db query and event search) of incorrect date - http://imageshack.com/a/img908/4213/H77my6.png - http://imageshack.com/a/img911/7484/OWugur.png 02 files (db query and event search) of correct date - http://imagizer.imageshack.us/a/img903/6195/g8Sdtq.png - http://imageshack.com/a/img908/1958/ty4va3.png 01 file of "set parameters" inside DB Ipunt configuration. - http://imageshack.com/a/img910/7704/JD28WZ.png Let me know if you need another data. Thanks again for your attention! Luis Carlos Skype: lcb.lucas ... View more