About pdjhh

pdjhh · ‎12-26-2019

So if I went into thyat field extractor you linked to I need to click the option to 'writer the regular expression myself'. I then have the par tof the regular expression that extracts the value but it won't work because splunk wants the bit to tell it what that key name will be as well. So for my exmaple of parts above ( this will be 5 separate extractions) my regex to grab the value is (?<=#parts)\s(.?)[\r\n] and this works. But splunk needs me to cahnge that to have the key name in it as well. In this case 'Parts'. So that needs to be built into the regex and it looks to be along the lines of (?...) but I don't know how to merge this into that regex.

pdjhh · ‎12-26-2019

Yeh I'd already tried that and it couldn't quite get my 5 extractions right. So I worked out the correct regex for all 5 but can't manually add it as it wants the key name somehow as well as the value which the regex pulls.

pdjhh · ‎12-26-2019

That is a cool search and extraction thanks to4kawa. I'll definitely be able to use something like that in my project. As mentioned though I do want to extract these fields when the data comes in so I've got them ready to work with within my app. So I want to be able to go into field extractions and create the extraction in there. What I can't find documentation on is changing the regex that extracts the data into splunk regex that extracts it and then applies it to a field name. Like doing this bit but in the fields extraction creation section of the splunk gui - #(?[^\s]+)( (?.+))? - that obviously assigns the value to the field_name.

pdjhh · ‎12-26-2019

Actually, also. I'm trying to find the field after the work summary so it might not be project x but anything after the string of #summary and up to the carriage return at the end of the line.

pdjhh · ‎12-26-2019

Trid this too but doesn 't work: _raw "(?<=#summary)\s(?P(.?)+)"

pdjhh · ‎12-26-2019

Thanks for this. This a a search time extraction though isn't it. How can I apply this logic and get the same results with an index time extraction?

pdjhh · ‎12-25-2019

So per above for the summary for example. The raw data is: "#summary project x" I would like to end up with a field named Summary and a value of project x In regex101 (?<=#summary)\s(.?)[\r\n] retrieves the value "project x"

pdjhh · ‎12-25-2019

Hi there. I've managed to work out some regex to grab the data I want when using regex101 but I'm having trouble porting it into Splunk because Splunk also needs the correct intormation in the right place to name that extracted field I believe. The data I've got looks like this: summary project x parts 1 a part person1 4 person2 invoice And the regex that gets the values after the keys is: (?<=#summary)\s(.?)[\r\n] or (?<=#parts)\s(.?)[\r\n] or (?<=#invoice)\s[0-9]* The first two will have carriage returns at the end and that last one won't hence the different approach for that one. I don't know where or what to add to get Splunk to call the first field Summary for example or Parts for the second as you can see. I realise it's going to be something like in there somewhere but can't work out where. Thanks.

pdjhh · ‎12-05-2019

What I'm attempting to do is trawl through a bunch of calendar events, extract various fields and table those out looking for particular things that have or haven't been done, This is working (currently using data exported from calendars rather than getting ti with the api or the app) but I've come up against another issue. When I find an event where this particular action hasn't taken place then a report tells me of that. I then get that action done but am now wondering how can I update my data set with a field to flag that this task has been done. I'd like to write a new field that remaind within the data set after I've created it. Realis this isn't kinda how splunk works as the data has already been indexed when it got ingested by splunk but wondering if there's a way other that updating the original data then ingesting it again.

pdjhh · ‎12-05-2019

Thanks I'll have a look at using the api and feed back here.

pdjhh · ‎12-04-2019

Wondering if I can extract google calendar events and particularly the description field.

pdjhh · ‎07-10-2017

Hi, I've got a csv file with the a date field against events in the format 1-July-2016. Can I create a sourcetype to recognise this as the timestamp for this data set? Thanks.

pdjhh · ‎06-14-2016

This problem looks to have been caused by pushing hashed passwords in the apps to the new heavy forwarders. This doesn't work with hashed passwords (effecting app deployment) but you need to work around as per the following article: http://docs.splunk.com/Documentation/Splunk/6.0.1/Security/Deploysecurepasswordsacrossmultipleservers

pdjhh · ‎06-12-2016

Hi there. We have our data ingestion ssl flows distributed to our heavy forwarders within an app. So the certs and outputs.conf are just under app/local and this has worked fine until now. What has happened is we have had a windows HF in the past whereas we've just stood up Linux HFs. The app gets pushed to the new linux HF but the secure connection will not come up. The errors I'm seeing are these on the indexer side: ERROR TcpInputProc - Error encountered for connection from src=x.x.x.x:59918. error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol Searching that error points to lots of things such as tls versions, compression on or off etc but as my config is all within the files in the app then this new forwarder has the same config as the old windows one which talks to the indexer succesfully. Just wondering if there's any secret ssl security within that's preventing this working? I've tried regenerating the sslPassword in case it was that but no go. Thanks.

pdjhh · ‎06-08-2016

We've had Splunk look into this with us and after a bit of time they are coming back basically saying not to use eventcount in clustered environments. I'll quote so that you can make your own interpretation of the words for now: Splunk: "Eventcount will check with all the buckets including the excessive/replicated and primary buckets and is not recommended to be used for event count in the index cluster env" Me: "are you saying the recommendation is not to use eventcount in a clustered environment? " Splunk: "Yes. eventcount is not recommended to count events for comparison in a clustered environment. Feedback has been sent to document team to update the Splunk docs. "

pdjhh · ‎06-06-2016

Focussing on one index then it's the same: index=xyz | stats count as "Events" gives a result of 63 million and something | eventcount index=xyz gives a result of 64 million and something How can these differ? Especially with the eventcount figure being more? Interestingly | metadata type=hosts index=xyz | stats sum(totalCount) gives the exact same value as what I'm calling the 'real' search of index=xyz | stats count. A similar tstats gives the same figure as well so it's only the eventcount search that's returning a different value..

pdjhh · ‎05-30-2016

Hi. A site we are on has attemtped to migrate data from one splunk cluster to another. We've come in late to help and have fixed most things up but they are noticing a difference in their eventcount type searches and real event searches. So index=* | stats count by index gives one set of numbers but eventcount summarize=false index=* gives quite different numbers, an amount less. I'm thinking the metadata values have been messed up during their copy activities and wonder if they can be rebuilt? Thanks.

pdjhh · ‎03-15-2016

It seems that if you specify the database in the query it works. select * from database..table where start_date >= dateadd(mi, -10, getdate())

pdjhh · ‎03-15-2016

Hi there. I'm trying to make a sybase connection but I"m getting a 'table_name not found' error. The dba has tested the same query using my credentials and it works so must be something my end. I've got 3 sybase driver options and default database options but I can't find any that will work. I'm trying manually entering a jdbc url and have tried the following (dba reckons I've been searching master not the one I'm supposed to be). jdbc:sybase:Tds:hostname:port/database The above isn't working, any ideas? Thanks.

pdjhh · ‎03-15-2016

I had to get someone with an SAP account to download it for us in the end.

Posts	73
Solutions	4
Karma Given	3
Karma Received	10
Member Since	‎01-05-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Field extractions

Can I extract calendar events with this tool?

Timestamp extraction

SSL flows within deployed app

Differences in eventcount results and 'real' searc...

DBX Sybase connection

Trying to connect to sybase db.

How do I manage the content of my alert?

Chart count of results per day.

How do i determine the database and log file sizes...

Re: Field extractions

Re: Field extractions

Re: Field extractions

Re: Field extractions

Re: Field extractions

Re: Field extractions

Re: Field extractions

Field extractions

Re: Can I extract calendar events with this tool?

Re: Can I extract calendar events with this tool?

Can I extract calendar events with this tool?

Timestamp extraction

Re: SSL flows within deployed app

SSL flows within deployed app

Re: Differences in eventcount results and 'real' s...

Re: Differences in eventcount results and 'real' s...

Differences in eventcount results and 'real' searc...

Re: DBX Sybase connection

DBX Sybase connection

Re: Trying to connect to sybase db.