About tcoq

tcoq · ‎07-10-2016

I found a less complicated solution for my case based on map command: ... table country client artnumber | | map maxsearches=15 search="|`getImageURL(2,$artnumber$)`"

tcoq · ‎07-08-2016

It is the same problem like the upper advice. Inside of the macro is a dbx sql-query which must be at the beginning of a search. So I need to do a subsearch...

tcoq · ‎07-08-2016

I am using a subsearch, because inside of the macro there is a dbx-query search to a secondary database.(DB-Connect) DBX must be at the beginning of a search and only a subseach allows to put it at the beginning...

tcoq · ‎07-07-2016

Hi everybody, I have this search, using a macro called getImageURL(2) : ... table country client artnumber | eval sql = if(client==2,[|`getImageURL(2,artnumber )`], sql) If I type artnumber directly, e.g. "1234", everything is fine. If I use the artnumber field, the macro does not accept the field value as a parameter. (it is interpreting it as a string) Does anyone know how to use the field value of "artnumber"? Best regards in advance Steffen

tcoq · ‎01-06-2014

examples will pretty nice

tcoq · ‎11-27-2013

Hi, I find the soulution: Accelaration is not working with * on index! BR Steffen

tcoq · ‎11-27-2013

Hi together, I tried to use report acceleration but it seems to be that is not working. In "Report Acceleration Summaries" my Summary Status is always "Pending". I tried to modify my report to a very simple form but it is also "Pending": index="live_bu_*" Action="initial entry" | SourceToCountry | rename source AS Land | rename count AS Sessions | stats count as Session by Land Any ideas why it is always "Pending"? Best regards Steffen

tcoq · ‎11-14-2013

Great, thank you for this link. But I see chapter: "Searches that run longer than their scheduled intervals:" From my understanding there could by some cases where it's not direct visible for me, if there occurs some gaps? So acceleration is the prefered way to handle critical data? I can try this. Best regards...

tcoq · ‎11-14-2013

Hi together, I'am using summary indexing to aggregate big amounts of critical data in 5 minute frames. Now I'am asking myself is summary-indexing for critical (business) data a good solution by scheduled timeframes? What is splunk doing if there is e.g. a maintenanance window about 1 hour? Is there a gap in the data? What is the best practise how to handle these cases to avoid gaps? Best regards Steffen

tcoq · ‎10-28-2013

Hi together, I'am trying to get some XML input into Splunk, but everytime the first character ("<") is missing. Due to this, Splunk cannot read XML correctly: (on two different sources) from example-source: www.ecb.europa.eu/stats/eurofxref/eurofxref-daily.xml this input: <xml version="1.0" encoding="UTF-8"?><gesmes:Envel... is getting this: xml version="1.0" encoding="UTF-8"?><gesmes:Envel... Is there anyone who knows why the first character is missing? Best regard Steffen

tcoq · ‎10-16-2013

I grep on Splunk log and found this messages: 10-16-2013 10:48:31.146 +0200 WARN AdminManager - Handler 'localapps' has not performed any capability checks for this operation (requestedAction=list, customAction="acl", item="rest_ta"). This may be a bug.

tcoq · ‎10-16-2013

Hi Damien, thank you for your answer. I'am sorry but after upgrade to Splunk 6, Rest API configuration panel (Settings / Data input) is missing. So I thought API is not compatible with Splunk 6. I updated to V1.2 but configuration panel is also missing. Do you have any ideas why? BR Steffen

tcoq · ‎10-01-2013

Oh... i see the tag was missing after Login... I mean REST API Modular input app ...

tcoq · ‎10-01-2013

Hi together, is there a update for splunk 6 available? Best regards Steffen

tcoq · ‎09-12-2013

Great! I switched to TRUNCATE=0 and it works!

tcoq · ‎09-09-2013

I run into the same error with the given example: importutil http http://research.stlouisfed.org/fred2/data/PAYEMS.txt

tcoq · ‎09-09-2013

Hi together, I am trying to get data via REST API input, but I'am getting this message in splunkd.log: Truncating line because limit of 10000 has been exceeded with a line length >= 62248 It seems to be that my JSON file is to long/big. When I take a look into splunk, I can see my JSON which is cut off in the middle. This is still a problem, because the JSON is no longer well-formed and cannot longer pre-processed. Is there a better way to get long JSON data in? (without setting line length limit because I have got some other JSONs which a much longer than my test request) Best regards Steffen

Posts	17
Solutions	1
Karma Given	2
Karma Received	2
Member Since	‎07-09-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Insert field value into macro parameter

Report acceleration pending

Splunk summary indexing for critical data

XML Input / first character is missing

REST API Modular Input - Splunk6 - problems?

Why is JSON getting truncated?

Re: Insert field value into macro parameter

Re: Insert field value into macro parameter

Re: Insert field value into macro parameter

Insert field value into macro parameter

Re: how to split the json array into multiple new ...

Re: Report acceleration pending

Report acceleration pending

Re: Splunk summary indexing for critical data

Splunk summary indexing for critical data

XML Input / first character is missing

Re: REST API Modular Input - Splunk6 - problems?

Re: REST API Modular Input - Splunk6 - problems?

Re: REST API Modular Input - Splunk6 - problems?

REST API Modular Input - Splunk6 - problems?

Re: JSON is truncated

Re: content-length error

Why is JSON getting truncated?