About rishiehari

rishiehari · ‎12-14-2012

I have the same problem. So could you be more detailed in your explanation for this. Thanks

rishiehari · ‎12-11-2012

You will have to change the configuration file of splunk. Name of the file : "props.conf" Location (Recommended) : $SPLUNK_DIR\etc\system\local\ Any new sourcetype you had created would have an entry similar to this [config] NO_BINARY_CHECK =1 pulldown_type = 1 SHOULD_LINEMERGE = true Edit wherever you want it to, and you can create new sourcetypes here as well. Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf

rishiehari · ‎12-11-2012

Im sorry. This question was a repetition. The answer is I must be using CHART instead of table. .. | chart values(status) by circuit,slot is the solution. Thanks everyone.

rishiehari · ‎12-11-2012

Current Sample Event : Dec 4 02:11:19: Span id: 26, status: No Signal ( e1, slot 5 #3 ) Current Sample Query : .. | rex field=_raw "status: (? [^(]+)" | rex field=_raw "e1, (? [^#]+) #(? [^)]+)" | table circuit,slot,status Current Sample Output : circuit slot status 1 0 slot 2 Remote Loss of Sync 2 0 slot 3 No Signal 3 1 slot 3 OK 4 2 slot 1 Remote Loss of Sync Expected Output : Slot-> 1 2 3 4 5 Circuit | 1 Loss OK NO Loss OK 2 No Loss OK NO Loss 3 OK NO Loss OK NO 4 Loss OK NO Loss NO I'm looking at arriving at a similar table so that I can use *.js to put up colors in the table so that a person can identify for the circuits failed in the slot in a single stroke Thanks

Posts	4
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎12-05-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Values of a field inside table

Re: Cant authenticate with Splunk API ??

Re: Edit manually created Source types

Re: Values of a field inside table

Values of a field inside table