Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About atownson
atownson
Explorer
Member since:
09-18-2018
01-30-2025
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 31 |
| Karma Received | 0 |
| Member Since | 09-18-2018 |
Activity Feed
- Karma Re: How to remove weak ciphers? for coreyCLI. 01-30-2025 06:21 AM
- Karma Re: Splunk Manager Admin Permission Problem for lguinn2. 01-19-2024 06:28 AM
- Karma Re: ERROR BTreeCP - checkpoint failed: removal of dir /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old failed: Directory not empty for chrisyounger. 12-15-2023 06:36 AM
- Karma Re: Diagrams of how indexing works in the Splunk platform (the ‘Masa diagrams’) for ppablo. 08-15-2023 06:27 AM
- Karma Re: Can you disable the management port (8089) on clients via the Deployment Server? for laserval. 05-04-2023 01:16 PM
- Karma Re: Can you disable the management port (8089) on clients via the Deployment Server? for ephemeric. 05-04-2023 01:15 PM
- Karma How do you send events from a custom command asynchronously without waiting for the whole command to finish? for yogevyuval. 09-16-2022 06:20 AM
- Karma Re: Remove "First time logging in? Splunk's default credentials are" for sloshburch. 02-14-2022 04:56 PM
- Karma Re: Is there way to generate list of date for given month in Splunk for cmerriman. 02-11-2022 08:19 AM
- Karma Re: How can I use CLONE_SOURCETYPE to send a cloned modified event to a 3rd party without indexing the cloned event? for rphillips_splk. 01-26-2022 01:33 PM
- Karma Re: Custom streaming search command error for christopherrobe. 11-02-2021 04:37 AM
- Karma Re: Macro with validation isnum() does not work even if the input argument is numeric for niketn. 10-19-2021 12:34 PM
- Karma Setting token programatically when token has selectFirstChoice=true for delewis13. 10-14-2021 02:18 PM
- Karma Re: Export to csv on click of button for vnravikumar. 10-14-2021 12:28 PM
- Karma Re: Export to csv on click of button for vnravikumar. 10-14-2021 12:24 PM
- Karma Re: Why is the dropdown input width not increasing? for vnravikumar. 10-14-2021 05:37 AM
- Karma Re: How to use a $ in a form search? for aelliott. 10-06-2021 06:14 PM
- Karma Re: time-based lookups and kvstore for skalliger. 09-23-2021 03:43 PM
- Posted Re: slave-apps doesn't like my app on Getting Data In. 08-04-2021 01:25 PM
- Karma Re: slave-apps doesn't like my app for vanvan. 08-04-2021 01:25 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
08-04-2021
01:25 PM
I can confirm the same behavior with such apps as config_explorer. Thanks for the workaround.
... View more
10-16-2020
11:17 AM
Does anyone know how to log INFO and WARN log_level events to $SplunkHome\var\log\splunk\splunk-powershell.ps1.log or $SplunkHome\var\log\splunk\splunkd.log for debug purposes using the powershell input? Using the code below in the script terminates it: Write-Error -Message 'INFO test' 10-16-2020 12:47:05.4859538-5 ERROR Executing script=& "$SplunkHome/etc/apps/foo/bin/foo.ps1" for stanza=foo failed with exception=INFO test The script does run correctly. I would just like to have some debug options. Thanks.
... View more
Labels
- Labels:
-
development
04-09-2020
05:04 AM
The LINE_BREAKER value above should work. It should break the events based on a line return and the 79 dashes, but still retain the dashes because they're not in the capture group.
... View more
04-08-2020
07:55 AM
My suggestion is below. This should break your events based on the dashes (assuming there are no spaces before the dashes and there are always 79 dashes). I don't see a valid timestamp in the events so timestamp recognition is effectively disabled.
props.conf
[yourSourceType]
LINE_BREAKER = ([\r\n]+)-{79}
BREAK_ONLY_BEFORE_DATE = false
TRUNCATE = 0
DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 0
Maybe that'll help.
... View more
04-08-2020
07:36 AM
Give the below a shot. You'll need to check the line breaking (LINE_BREAKER) to verify the events are broken properly. And you'll need to list all possible values of the 'Type' field separated by a pipe in the regular expression (EXTRACT). I've listed 'directory' and 'file'. This should give you the correct search-time field extractions.
[storage:data]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n]+) *Type +
NO_BINARY_CHECK=null
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true
EXTRACT-data=^ *(?<Type>directory|file) +(?<AppliesTo>[^ ]+) +(?<Path>.+) +(?<Snap>[^ ]+) +(?<Hard>[^ ]+) +(?<Soft>[^ ]+) +(?<Adv>[^ ]+) +(?<Used>[^ ]+) *$
For a clustered environment:
props.conf on indexers:
[storage:data]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n]+) *Type +
NO_BINARY_CHECK=null
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true
props.conf on search heads:
[storage:data]
EXTRACT-data=^ *(?<Type>directory|file) +(?<AppliesTo>[^ ]+) +(?<Path>.+) +(?<Snap>[^ ]+) +(?<Hard>[^ ]+) +(?<Soft>[^ ]+) +(?<Adv>[^ ]+) +(?<Used>[^ ]+) *$
... View more
04-08-2020
07:06 AM
Greetings experts,
I have an alert configured to output the search results to a lookup file. And I need to be able to match one of the fields with a wildcard. The process seems straightforward enough, but my search using the lookup is matching the literal wildcard character (*) instead.
Here's what I have so far.
Simplified scheduled alert search that populates the lookup:
* | eval MachineNodeWildcard=Machine."-*"
Lookup definition (transforms.conf on search head):
[machines]
batch_index_query = 0
case_sensitive_match = 0
filename = Machines.csv
match_type = WILDCARD(MachineNodeWildcard)
max_matches = 1000
min_matches = 0
CSV file sample (with header):
host,"_time",Machine,MachineNodeWildcard
host1,1586334808,machineA,"machineA-*"
SPL using lookup (host is returned null):
| makeresults
| eval MachineNodeWildcard="machineA-1"
| lookup machines MachineNodeWildcard OUTPUT host
This SPL works but isn't what I need (host is resolved):
| makeresults
| eval MachineNodeWildcard="machineA-*"
| lookup machines MachineNodeWildcard OUTPUT host
There are several other inquiries about wildcard fields in lookups, but I was unable to find a suitable solution from them. Thank you.
... View more
11-07-2019
05:55 AM
FYI, for users monitoring the file based on modified time this solution will not work because the softlink's modified time is not updated in tandem with the target's modified time.
... View more
11-06-2019
06:11 AM
This seems like a viable workaround. Thank you.
... View more
11-05-2019
11:52 AM
A quick note: we need to index exactly [hostname].xml. There are other XMLs that could be in the dir that we do not want indexed and there's no required pattern for the hostname.
... View more
11-05-2019
11:35 AM
There are other files that would/could match the wildcard pattern that we would not want to index. We're currently using the wildcard method and it's indexing files we don't want. So specifically we need to monitor for [hostname].xml.
... View more
11-05-2019
10:15 AM
We have a set of servers defined within a server class using a deployment server. The deployment apps include an inputs.conf for each server within the class. One file we're monitoring includes the hostname of the local machine. How do you resolve the hostname inside the inputs.conf? I would assume it would be a variable or token but not sure what.
Example:
ServerA => [monitor:///path/to/file/ServerA.xml]
ServerB => [monitor:///path/to/file/ServerB.xml]
I did find a similar question or two in answers but did not find an appropriate resolution.
... View more
