Hi , i  want to ignore some comment line and last comment  store value in field. for example  , I have log where first  3 line field is in commented for Version, Date, Software #Ver: 1.0 #Date: 2020-04-18 11:10:15 #Software: ABC for Web 11.8.0-414 how to write the regex expression for this where i can store last field value my regex REGEX = ^\#  but it is dropping all lines with leading hash how to store  Software value in field but other previous  field  value can drop ... View more

Hi , We noticed errors in the splunkd.log. These are all the messages from Timeliner that appears on the search head : Error 11-11-2020 18:15:23.008 +0100 WARN  Timeliner - Error requesting remote event from https://xyz return code 404 11-11-2020 18:15:23.011 +0100 ERROR Timeliner - 50 Events missing due to corrupt or expired remote artifact(s). 11-11-2020 18:15:28.389 +0100 ERROR Timeliner - 50 Events missing due to corrupt or expired remote artifact(s). 11-11-2020 18:15:29.204 +0100 ERROR Timeliner - 36 Events missing due to corrupt or expired remote artifact(s). 11-11-2020 18:15:29.686 +0100 ERROR Timeliner - 50 Events missing due to corrupt or expired remote artifact(s). 12-04-2020 20:24:12.263 +0100 WARN  Timeliner - Error requesting remote event from https://xyz, return code 404 12-04-2020 20:24:12.266 +0100 ERROR Timeliner - 50 Events missing due to corrupt or expired remote artifact(s). Could you, please, check and advise on this? ... View more

Hi , I have data where  i  want to read comment line and store value in field. for example  , I have log where first  4 line field is in commented for Version, Date, System, Software #Version: 1.0 #Date: 2020-04-18 11:10:15 #System: 10.244.32.81 - SCWSA-7HBA-0001.nbnco.local #Software: ABC for Web 11.8.0-414 My query  : i have 4 field in datamodel for ver , date, system, software .now i want to store commented data in this field. so how to write the regex expression for this so-that i can see value in datamodel for this commented line ... View more

Hi All , I am facing one issue for indexing. I have .csv file from external resource and this .csv file size is 11236KB. also configured data (access log) in data input. want to generate report for AD Group details. In .csv file and data(accesslog) , one field (user_id) is common so when we trying to generate report so .csv file is taking more time indexing and getting error fail to reopen lookup (.csv ) file. Can you please help me on this ? ... View more

Hi , Recently , I have upgraded my app with splunk8.0 but unable to settings-->data -->data input--> getting blank space. could you please help me on this " which configuration changes required so that i can see GUI screen?" ... View more

Hi All, I wish to create a regex that should work with multiple log format using 2 type log format. 1) log format: 5 auth_mechanism: SSO_ISE auth group [syslog_pass1] regex =(?P<user_agent>\s+[(\S+)])(?P<cust_field>(?:\s+(?:\")?([^\"$]+))?) FORMAT= user_agent::$1 cust_field::$2 2) In second log format , one new field(proxy_id) is added in between user_agent ad cust_field. Log Format: 5 3 auth_mechanism: SSO_ISE auth group [syslog_pass2] regex =(?P<user_agent>\s+[(\S+)])(?P<proxy_instance_id>\s+[(\S+)])(?P<cust_field>(?:\s+(?:\")?([^\"$]+))?) FORMAT= user_agent::$1 proxy_id::$2 cust_field::$3 we wrote 2 regex for different log format.but field extration is not happening properly if log is coming in this log format: 5 auth_mechanism: SSO_ISE but so i am getting field value for user_agent is 5 , proxy_id is a , cust_field is auth_mechanism: SSO_ISE. how to correct the regex for getting correct value of field ? ... View more

Hi , i have AD server configuration GUI page in my app where i am setting user_id , password, Group in data input . so after setting text password and saving page, i can see GUI is showing text password , not encrypted password. What edits do I need to make in my configurations to hide passwords when i am configuring AD server password? here is file app1.xml ====================================== <endpoint name="data/inputs/app_reporting"> <header>AD Server Details</header> <breadcrumb> <parent hidecurrent ="False"> data input stats </parent> <name>AD Server Details</name> <element name= 'sourceFields' type=" fieldset "> <view name="list"/> <view name="edit"/> <view name="create"/> <elements> <element name="name" label="AD or LDAP Configurations"> <view name="list"/> <view name="create"/> <key name="exampleText">Configure this instance to monitor files and directories for AMP logs </key> </element> <element name="servername" type="textfield" label="AD ServerName"> <view name="list"/> <view name="edit"/> <view name="create"/> <key name="exampleText">Give AD Server to connect</key> </element> <element name="username" type="textfield" label="AD UserName"> <view name="list"/> <view name="edit"/> <view name="create"/> <key name="exampleText">Give AD user to connect</key> </element> <element name="passcode" type="password" label="AD Password"> <view name="edit"/> <view name="create"/> <key name="exampleText">Give AD user`s password to connect</key> </element> <element name="group" type="textfield" label="AD GroupName"> <view name="list"/> <view name="edit"/> <view name="create"/> <key name="exampleText">Give AD group to connect</key> </element> </elements> </element> <element name="eai:acl.app" label="App"> <view name="list"/> <key name="processValueList">"app_reporting"</key> </element> ... View more

Hi , I need your help to set a filter between min and max value. example : want to print value between range ( value >-2 and value < 5 ) I have created two dropdown box create two filter FILTER score > "$minwbrs_score$" FILTER score < "$maxwbrs_score$" ---> issue Here, I am facing an issue in an XML parsing for operator < (less than) This is the Error : XML Syntax Error: StartTag: invalid element name ... View more