Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sdaruna
sdaruna
Explorer
Member since:
01-07-2015
06-05-2020
Community Statistics
| Posts | 36 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 01-07-2015 |
Activity Feed
- Karma Re: How to split one Line into multiple lines while search for sundareshr. 06-05-2020 12:47 AM
- Got Karma for How to parse JSON data at search-time?. 06-05-2020 12:47 AM
- Got Karma for How to wrap cell data into one line in Splunk tables?. 06-05-2020 12:47 AM
- Posted Re: How to convert JSON Keys and values as columns in splunk on Getting Data In. 08-09-2016 01:39 PM
- Posted How to convert JSON Keys and values as columns in splunk on Getting Data In. 08-08-2016 06:02 PM
- Tagged How to convert JSON Keys and values as columns in splunk on Getting Data In. 08-08-2016 06:02 PM
- Posted Re: how to apply xmlkv for result of other query on Splunk Search. 02-12-2016 08:34 AM
- Posted how to apply xmlkv for result of other query on Splunk Search. 02-12-2016 06:47 AM
- Posted Re: How to parse JSON data at search-time? on Getting Data In. 02-10-2016 01:53 PM
- Posted Re: How to parse JSON data at search-time? on Getting Data In. 02-10-2016 12:55 PM
- Posted How to parse JSON data at search-time? on Getting Data In. 02-10-2016 12:22 PM
- Tagged How to parse JSON data at search-time? on Getting Data In. 02-10-2016 12:22 PM
- Tagged How to parse JSON data at search-time? on Getting Data In. 02-10-2016 12:22 PM
- Posted Re: After adding a custom field in Splunk, why am I getting error "In handler 'oneshotinput': Argument "dateofdata" is not supported by this handler."? on Splunk Dev. 02-01-2016 07:26 AM
- Posted After adding a custom field in Splunk, why am I getting error "In handler 'oneshotinput': Argument "dateofdata" is not supported by this handler."? on Splunk Dev. 01-31-2016 09:50 PM
- Tagged After adding a custom field in Splunk, why am I getting error "In handler 'oneshotinput': Argument "dateofdata" is not supported by this handler."? on Splunk Dev. 01-31-2016 09:50 PM
- Tagged After adding a custom field in Splunk, why am I getting error "In handler 'oneshotinput': Argument "dateofdata" is not supported by this handler."? on Splunk Dev. 01-31-2016 09:50 PM
- Posted How to access Date Partitioned files in HDFS dynamically using virtual index on Splunk Search. 01-24-2016 11:04 AM
- Tagged How to access Date Partitioned files in HDFS dynamically using virtual index on Splunk Search. 01-24-2016 11:04 AM
- Posted Re: Search by source name in virtual index does not show results on Splunk Search. 01-18-2016 08:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-09-2016
01:39 PM
I have so many key value pairs under "value" field. So it is not possible to specify each and every key of "value" field.
... View more
08-08-2016
06:02 PM
Hi,
I want to flatten json data to columns for my report purpose. I might not be explaining my requirement properly, here is what my data and result has to be.
Input:
{
"name" : "srini",
"value" {
"1": "val1",
"2" : "val2",
"3" : "val3"
}
}
Output:
name, name.key, name.value
------------------------------------------
srini 1 val1
srini 2 val2
srini 3 val3
... View more
- Tags:
- splunk-enterprise
02-12-2016
08:34 AM
Hi Javier,
No that is not what i want. I want to apply xmlkv on the results of the search, so that i can get the data directly from the broken xml.
... View more
02-12-2016
06:47 AM
Hi,
I have huge xml and i have written a query to break the xml.
Let me explain with small example ( though i am doing this on a bigger file, i am showing this for understanding)
My main xml:
<Head>
<Doc>
<node>{data..}</node>
<node>{data..}</node>
</Doc>
<Doc>
<node>{data..}</node>
<node>{data..}</node>
</Doc>
<Doc>
<node>{data..}</node>
</Doc>
</Head>
I have written query to get the xml nodes. Now the results will be like this.
My query is like this:
index = "<index>" | xmlkv | spath output=node path=<MY_XPATH> | mvexpand node |table node
After that, results would look like below.
<node>{data..}</node>
<node>{data..}</node>
<node>{data..}</node>
<node>{data..}</node>
<node>{data..}</node>
Now, How can i apply xmlkv to get the data out of the results above.?
i do not want to apply it on actual xml, as it is huge and do not need all the data.
Thank You,
Regards,
Srini.
... View more
- Tags:
- splunk-enterprise
02-10-2016
01:53 PM
As said earlier, i can get xml file or json file. While indexing the data, i just need to load whole file. Because, end users need to see whole file.
But, our processing framework needs splitted data.
I have json as below.
{
"Document": {
"-xmlns:xsi": "http://www.w3.org/2001/XMLSchema-instance",
"-xsi:noNamespaceSchemaLocation": "EPA_GEODATA_v1.0.xsd"
},
"FacilitySite": [{
"LatitudeMeasure": "31.59",
"LongitudeMeasure": "-85.278333",
"Program": {
"ProgramCommonName": "TRIS",
"ProgramAcronymName": "TRIS"
}
}, {
"LocalityName": "ABBEVILLE",
"LocationAddressStateCode": "AL",
"Program": {
"ProgramCommonName": "TRIS",
"ProgramAcronymName": "TRIS"
}
}]
}
can i get child json document as below.
"Program": {
"ProgramCommonName": "TRIS",
"ProgramAcronymName": "TRIS"
}
-----------------------------
"Program": {
"ProgramCommonName": "TRIS",
"ProgramAcronymName": "TRIS"
}
... View more
02-10-2016
12:55 PM
Hi Javier,
I cannot specify any format while indexing data. for xml, if i specify xmlkv and use spath, it works fine. but, i am not sure about the json.
... View more
02-10-2016
12:22 PM
1 Karma
I am getting different types of data from source. It can be XML or JSON.
For XML, I am just indexing whole file and later at search-time, I am using xmlkv + xpath to parse and get the data that I want.
For JSON, I need to index whole file, but is there a way that I can parse at search time similar to the above.?
... View more
02-01-2016
07:26 AM
Hi Stephane,
I do not need the exact indexed time. I could index any date data at any time. But, i need to fetch data by date when receiving.
It was same error, if i tried to set _indextime field through program.
... View more
01-31-2016
09:50 PM
Hi,
I need to add a field which represents the date of the indexed data. I need to fetch the results in a search based on data. So, I tried to add a custom field in Splunk.
I added a new field in fields.conf file as follows.
[dateofdata]
INDEXED = True
INDEXED_VALUE = False
As I need to index the data using Splunk Java API, I used it as follows.
Service service = new Service("localhost", 8089);
connect(loginArgs);
Args eventArgs = new Args();
eventArgs.put("sourcetype", "whole_file");
eventArgs.put("host", "local");
eventArgs.put("dateofdata","20160125");
IndexCollection myIndexes = service.getIndexes();
Index index = myIndexes.get("my_index3");
index.upload(
"/Users/srini/imp_work/xml_dump/2016-01-16/xml_file_1.xml",
eventArgs);
I got the following error when I executed it.
Exception in thread "main" com.splunk.HttpException: HTTP 400 --
In handler 'oneshotinput': Argument "dateofdata" is not supported by this handler.
at com.splunk.HttpException.create(HttpException.java:84)
at com.splunk.HttpService.send(HttpService.java:452)
at com.splunk.Service.send(Service.java:1293)
at com.splunk.HttpService.post(HttpService.java:308)
at com.splunk.EntityCollection.create(EntityCollection.java:95)
at com.splunk.Index.upload(Index.java:1131)
at com.srini.splunk.SplunkExample.main(SplunkExample.java:31)
... View more
01-24-2016
11:04 AM
Hi,
I have hdfs folders as below.
/bla/bla/bla/20160121
/bla/bla/bla/20160122
/bla/bla/bla/20160123
How to access the data matched in any specific date only for a given query.? lets say, i would like to get data from 20160121 folder only. I do not want to create one virtual index for each folder, coz we gonna have date for all 365 days in a year.
... View more
- Tags:
- splunk-enterprise
01-18-2016
08:29 AM
In fact, i missed a point here. The source will be name in virtual indexes will have full path.
I tried below one and worked.
index="hdfs_index" | eval source = replace(source, ".*/", "") | search source="xml_file_0.xml" | table _raw
... View more
01-18-2016
07:15 AM
Hi,
i need to get the raw data of file based on source file name. For that i have used below query.
source="xml_file_1.xml" | table _raw
This is giving results only for local indexes, but not the virtual indexes.
I tried below queries as well,
index ="hdfs_index" | search source="xml_file_1.xml" | table _raw
index ="hdfs_index" WHERE source="xml_file_1.xml" | table _raw
But, none has given results.
What went wrong.
Is there a way that i can match the source file name.?
... View more
- Tags:
- splunk-enterprise
01-15-2016
02:06 PM
Thank you somesoni.. I would give it a try and let you know.. Are you splunkr.? if so, is there a way to reach you over mail or so.?
... View more
01-15-2016
01:53 PM
Hi rdaga,
Yes. There is chance that they might have in same directory.
Is there any solution if they reside in different directory.?
... View more
01-15-2016
12:58 PM
Hi,
I might have not mentioned my view properly.
Lets say, i have two types of data
1) JSON
2) CSV
3) XML.
I need to get whole file for JSON and XML, and i need to get the data split when reading CSV. CSV Data goes to one index and xml data goes to other.
In this case, can we get the data shown with their respective requirements.? i.e, get the whole file data for xml and json and splitted data for csv.
Can we do that with props.conf.?
... View more
01-15-2016
03:01 AM
Hi I am looking for some solution that does not depend on props.conf. I already created source type but how could I apply that to virtual index.? That is the question
... View more
01-13-2016
07:43 PM
Hi, this documentation which mentions about props.conf does apply the source type to every index. I want it to have only for specific index.
... View more
01-13-2016
05:41 PM
Hi,
I have data in HDFS and I am creating Virtual Indexes to access the data. However, I need to make get the whole file content as an event. For that, I have already created one source_type, which will get the whole file data. How can I apply the source_type to virtual indexes.?
... View more
01-01-2016
12:34 PM
For each node, i need nodedata and registry id. I tried using two xpaths, but they are coming out as two different groups.
... View more
01-01-2016
12:19 PM
Hi Sundaresh,
I would really thank you for your patience and help. The below is the format like which i am expecting output with registry id and node.
I could not paste it properly in the comment, so i have added it in question it self. Please see the latest edit in question.
... View more
01-01-2016
07:09 AM
NO, sundaresh, I meant, i want both node and the registry id. How can i get two outputs from spath at the same time. >
... View more
12-31-2015
04:29 PM
Hi,
but, the attribute registry id is not coming. Is it coming for your search.? How could you get that.?
... View more
12-31-2015
07:32 AM
In reference to my other post
https://answers.splunk.com/answers/337397/how-to-break-xml-in-search-time.html
I am adding other way of the question.
I have total xml data in a field like below.
<?xml version="1.0" encoding="UTF-8"?>
<Document xsi:noNamespaceSchemaLocation="EPA_GEODATA_v1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<FacilitySite registryId="110007915364">
<FacilitySiteName>GREAT SOUTHERN WOOD PRESERVING INC</FacilitySiteName>
<LocationAddressText>1100 HIGHWAY 431 NORTH</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
</FacilitySite>
<FacilitySite registryId="110000369084">
<FacilitySiteName>REMBRANDT FOODS- ABBEVILLE</FacilitySiteName>
<LocationAddressText>496 INDUSTRIAL PARK RD</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310</LocationZIPCode>
</FacilitySite>
<FacilitySite registryId="110055437718">
<FacilitySiteName>RITE AID #7092</FacilitySiteName>
<LocationAddressText>514 KIRKLAND STREET</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310-2700</LocationZIPCode>
<LatitudeMeasure>31.56149</LatitudeMeasure>
</FacilitySite>
</Document>
I need to break the entire field into multiple rows. like below.
----------------------------------------------------------------------------------------
<FacilitySite registryId="110007915364">
<FacilitySiteName>GREAT SOUTHERN WOOD PRESERVING INC</FacilitySiteName>
<LocationAddressText>1100 HIGHWAY 431 NORTH</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
</FacilitySite>
----------------------------------------------------------------------------------------
<FacilitySite registryId="110000369084">
<FacilitySiteName>REMBRANDT FOODS- ABBEVILLE</FacilitySiteName>
<LocationAddressText>496 INDUSTRIAL PARK RD</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310</LocationZIPCode>
</FacilitySite>
----------------------------------------------------------------------------------------
<FacilitySite registryId="110055437718">
<FacilitySiteName>RITE AID #7092</FacilitySiteName>
<LocationAddressText>514 KIRKLAND STREET</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310-2700</LocationZIPCode>
<LatitudeMeasure>31.56149</LatitudeMeasure>
</FacilitySite>
Please let me know how could i do it. I tried rex, but i do not think that can give multiple rows out of one.
... View more
- Tags:
- splunk-enterprise
12-30-2015
02:15 PM
Hi,
rex is working to extract data in between xml tags for me, but i am unable to split content into nodes. please find below xml sample and the rex i tried.
<?xml version="1.0" encoding="UTF-8"?>
<Document xsi:noNamespaceSchemaLocation="EPA_GEODATA_v1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<FacilitySite registryId="110007915364">
<FacilitySiteName>GREAT SOUTHERN WOOD PRESERVING INC</FacilitySiteName>
<LocationAddressText>1100 HIGHWAY 431 NORTH</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
</FacilitySite>
<FacilitySite registryId="110000369084">
<FacilitySiteName>REMBRANDT FOODS- ABBEVILLE</FacilitySiteName>
<LocationAddressText>496 INDUSTRIAL PARK RD</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310</LocationZIPCode>
</FacilitySite>
<FacilitySite registryId="110055437718">
<FacilitySiteName>RITE AID #7092</FacilitySiteName>
<LocationAddressText>514 KIRKLAND STREET</LocationAddressText>
<LocalityName>ABBEVILLE</LocalityName>
<LocationAddressStateCode>AL</LocationAddressStateCode>
<LocationZIPCode>36310-2700</LocationZIPCode>
<LatitudeMeasure>31.56149</LatitudeMeasure>
</FacilitySite>
</Document>
Rex command i used:
index = "cbb_sample" | rex ".)>(?.)<\/FacilitySite>" | table Node
I want to get three rows out of the above data.
... View more
12-30-2015
07:02 AM
Hi,
I need to index whole file data into splunk for a reason and i need to break that while searching. I understood and could break it while indexing, using source_type.
But, i need to do it in search time and breaking string could be dynamic. Lets say, i need to break it with <Employee> once and some times with <Department> and etc.
Is there a way to do it using splunk search language.?
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
