Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About vijayakumarkb
vijayakumarkb
Explorer
Member since:
08-06-2018
03-26-2025
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-06-2018 |
Activity Feed
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-27-2020 12:12 AM
- Karma Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 for isoutamo. 08-27-2020 12:12 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 07:21 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 06:22 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 06:01 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 05:13 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 04:47 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 04:26 AM
- Posted Re: TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 04:14 AM
- Posted TIME_FORMAT issue with 10:21:00 and 06:10:21 on Splunk Search. 08-26-2020 04:09 AM
- Posted Re: Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 09:18 PM
- Posted Re: Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 05:16 AM
- Posted Re: Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 03:50 AM
- Posted Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 03:49 AM
- Tagged Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 03:49 AM
- Tagged Splunk DBX and Oracle TCPS connection - Getting error on All Apps and Add-ons. 03-17-2020 03:49 AM
- Posted Re: clientIP and date in logs, but in Date seconds are ignored. on Getting Data In. 01-20-2020 05:42 AM
- Posted Re: clientIP and date in logs, but in Date seconds are ignored. on Getting Data In. 01-17-2020 02:12 AM
- Posted Re: clientIP and date in logs, but in Date seconds are ignored. on Getting Data In. 01-17-2020 02:11 AM
- Posted clientIP and date in logs, but in Date seconds are ignored. on Getting Data In. 01-15-2020 05:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-27-2020
12:12 AM
Hi, looks like the issue is solved, finally I used combination of something like below [access_log] SHOULD_LINEMERGE = false NO_BINARY_CHECK = true DATETIME_CONFIG = MAX_TIMESTAMP_LOOKAHEAD = 150 TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z TIME_PREFIX = dateTime="\[ Thanks for all the help, I have never seen someone going this far to reproduce and find a solution like u did, outstanding...
... View more
08-26-2020
07:21 AM
yes i have small z %z
... View more
08-26-2020
06:22 AM
ClientIP="00.00.00.00" remotehost="00.00.00.00" acceptHeader="-" dateTime="[26/Aug/2020:04:13:19 +0000]" remoteUser="-" firstLine="POST /api/1" this is the full log, i put MAX_TIMESTAMP_LOOKAHEAD = 200 stil it didnt work
... View more
08-26-2020
06:01 AM
My issue is 26/Aug/2020:05:12:08 +0000 logs(in host) are coming under 26/08/2020 05:08:00.000 in splunk
26/Aug/2020:00:11:25 +0000 logs(in host) are coming under 26/08/2020 04:25:00.000 in splunk so i think 08 +0000 is matching with time 05:08:00.000
:25 +0000 is matching with time 25:00.000 and showing wrong results. this is is happening only on :00 seconds, eg : 04:25:00.000, 04:26:00.000, 04:27:00.000 etc
... View more
08-26-2020
05:13 AM
26/Aug/2020:05:12:08 +0000 log is coming under 26/08/2020 05:08:00.000
... View more
08-26-2020
04:47 AM
it didnt fix the issue this issue is only coming at second is 00. all other times it is fine. Splunk Time zone is PST and host log file date is GMT Wrong
04:25:00.000
dateTime="[26/Aug/2020:00:11:25 +0000]" firstLine="POST /api HTTP/1.1" httpStatus=200; bytesSent=1458 - responseTime=9 Correct
04:43:29.000
dateTime="[26/Aug/2020:11:43:29 +0000]" firstLine="POST /api HTTP/1.1" httpStatus=200; bytesSent=1450 - responseTime=239
... View more
08-26-2020
04:26 AM
Thanks for the answer, let me try this, will update you.
... View more
08-26-2020
04:14 AM
formatted, sorry for that
... View more
08-26-2020
04:09 AM
I have a time format issue with Splunk logs . events are not coming correctly against the correct timestamp. in props.conf i have SHOULD_LINEMERGE = false
TIME_PREFIX = \[
TIME_FORMAT = %d/%b/%Y:%H:%M:%S %Z
MAX_TIMESTAMP_LOOKAHEAD = 26 but the issue is both 26/Aug/2020:10:21:00 and 26/Aug/2020:06:10:21(logs below) are coming under the time 26/Aug/2020:10:21:00. Below are the logs dateTime="[26/Aug/2020:10:21:00 +0000]" remoteUser="-" firstLine="POST /api/1 HTTP/1.1" httpStatus=200; bytesSent=120 - responseTime=127
dateTime="[26/Aug/2020:06:10:21 +0000]" remoteUser="-" firstLine="POST /api/2 HTTP/1.1" httpStatus=200; bytesSent=1512 - responseTime=14 so when doing timechart span=1s i am getting wrong results why the time matching not working correctly? Any help
... View more
03-17-2020
09:18 PM
Thanks, i did that, but where can we see the ORA errors.
i don't see them in the logs
... View more
03-17-2020
05:16 AM
I use Oracle DB version 12.2 and OJDBC jar 8, tried with 7 also.
... View more
03-17-2020
03:50 AM
using version splunkdbx 3
... View more
03-17-2020
03:49 AM
Hi
I was trying to connect to my oracle db using TCPS. but getting below error
IO Error: Received fatal alert: handshake_failure, connect lapse 68 ms., Authentication lapse 0 ms.
steps i did.
in connection, enabled SSl checkbox
1. in java 1.8/ cacerts - imported the corporate root certificates.[ this works for sqlDeveloper and connecting from java]
2. since it didnt worked adde the root certificates to truststore and keystore in /etc/apps/splunk_app_db_connect/certs
this also didnt worked.
3. added ojdbc8.jar into driver folder
But still it is giving me error, other TCP connections are working fine.
Kindly help
... View more
01-20-2020
05:42 AM
Thanks a lot team, it worked. Happy 🙂
... View more
01-17-2020
02:12 AM
sample of data
ClientIP="10.111.222.333" acceptHeader="application/json; charset=UTF-8" dateTime="[15/Jan/2020:05:02:08 +0000]"
... View more
01-17-2020
02:11 AM
[access_log]
SHOULD_LINEMERGE = false
This is the only entry in props.conf
... View more
01-15-2020
05:17 AM
I have a strange issue, not sure if this could be the reason.
In my logs. Client IP and Date is logged, but in splunk in Time Column, the date is displayed with seconds as zero
Eg : log as below
ClientIP="10.111.222.333" acceptHeader="application/json; charset=UTF-8" dateTime="[15/Jan/2020:05:02:08 +0000]"
so in Date column it is shown as 1/15/20 5:02:00.000 AM instead of 1/15/20 5:02:08.000 AM
This happens only when the clientIP value contains 3 numbers in the last field. ie this ip last field is 333 so when we have 3 numbers in the last field, splunk is ignoring the seconds in Date column.
Correctly displaying
Eg : log as below
ClientIP="10.111.222.44" acceptHeader="application/json; charset=UTF-8" dateTime="[15/Jan/2020:07:06:05 +0000]"
so in Date column it is shown as 1/15/20 7:06:05.000 AM, so clientIP last value is 44, only 2 numbers, so it is displaying correctly.
Anyone have any idea? Any help appreciated.
... View more
12-09-2019
04:44 AM
I updated in splunk_app_db_connect\bin\dbx2\C.py to
JRE_WANT_VERSION = "11", but the error message is gone, but task server is failing to resart.
Any help
... View more
12-09-2019
01:33 AM
Hi All,
As part of system upgrade, we upgraded all oru app servers to java 11. we need to upgrade our Splunk DBX also pointing to Java 11
I tried to change via UI in Settings-General, but it is throwing error
{'jre_using': 'Using Oracle Corporation JRE version 11, Java HotSpot(TM) 64-Bit Server VM', 'jre_need': 'Need Oracle Corporation JRE version 1.8', 'message': 'Unsupported JRE detected'} validate java command: /ngs/app/dsp/tools/CurrentJDK11/bin/java.
When updated in dbx_settings.conf, no error shown, but i am not sure if the Splunk is running in java11.
Kindly help, if Splunk DBX supports java 11 or how can we upgrade to Java11.
... View more
03-25-2019
10:11 PM
Thanks Harsh for the help. let me test it
... View more
03-25-2019
06:19 AM
I presume the events are split by line in the actual source file?
Yes events are split
... View more
03-25-2019
06:18 AM
sorry %Y-%m-%d %H:%M:%S,%3N
... View more
03-25-2019
06:17 AM
let me try with %Y-%m-%d %H:%M:%S,%N3
... View more
03-25-2019
06:06 AM
should i be using %Y-%m-%d %H:%M:%S:%3N
... View more
03-25-2019
05:53 AM
Thanks for the Answer Nick..
I added the solun, but it got all the events clubbed into one event.
for Eg :
[logLevel=ERROR] - 2019-03-25 01:39:24,980 +0000 -- "ConsumerService-9-ConnectionPool-Thread-24" com.DeliveryHandler -- message="INFO: First Time" timestamp="1553477964923"
[logLevel=ERROR] - 2019-03-25 01:39:52,094 +0000 -- "ConsumerService-9-ConnectionPool-Thread-25" com.DeliveryHandler -- message="INFO: First Time" timestamp="1553477992048"
both above events got merged and came as single event.
... View more
