Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About sureshkrovi
sureshkrovi
Explorer
Member since:
10-09-2018
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 10-09-2018 |
Activity Feed
- Got Karma for Is there a way to generate SOAP request programmatically from web sphere logs(data elements logged in) using Splunk API(if any)?. 06-05-2020 12:50 AM
- Got Karma for Is there a way to generate SOAP request programmatically from web sphere logs(data elements logged in) using Splunk API(if any)?. 06-05-2020 12:50 AM
- Posted Re: Splunk Jira Integration - Search returns no records on Splunk Search. 12-13-2018 11:34 AM
- Posted Splunk Jira Integration - Search returns no records on Splunk Search. 12-11-2018 09:32 PM
- Tagged Splunk Jira Integration - Search returns no records on Splunk Search. 12-11-2018 09:32 PM
- Posted Re: How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-26-2018 04:26 PM
- Posted Re: In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-19-2018 03:16 PM
- Posted Re: How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-16-2018 12:50 PM
- Posted Re: In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-16-2018 11:23 AM
- Posted Re: In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-16-2018 11:19 AM
- Posted How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-15-2018 03:44 PM
- Tagged How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-15-2018 03:44 PM
- Tagged How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-15-2018 03:44 PM
- Tagged How do you enable email alerts in the trial version of Splunk Enterprise? on Alerting. 11-15-2018 03:44 PM
- Posted In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-15-2018 01:34 PM
- Tagged In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-15-2018 01:34 PM
- Tagged In Splunk DB Connect, why is field data truncating after double quotes? on All Apps and Add-ons. 11-15-2018 01:34 PM
- Posted Re: Why is my dashboard panel query only working in search mode(verbose)? on Dashboards & Visualizations. 11-15-2018 10:46 AM
- Posted Re: Why is my dashboard panel query only working in search mode(verbose)? on Dashboards & Visualizations. 11-15-2018 10:14 AM
- Posted Re: Why is my dashboard panel query only working in search mode(verbose)? on Dashboards & Visualizations. 11-15-2018 10:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
12-13-2018
11:34 AM
Not sure if anyone get a chance to look into this post.I'm still getting no result found and not sure if all my configurations are in tact .Query I tried and the jira log update below.Wondering if my app is able to connect to Jira .
|jira jqlsearch "issueType ='story'"
decoder.py", line 382, in raw_decode\n raise ValueError("No JSON object could be decoded")\nValueError: No JSON object could be decoded\n', 'search': ['jqlsearch', "issueType ='story'"]}
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\jira\bin\jira_rest.py", line 631, in
handle_args(sys.argv[1:])
File "C:\Program Files\Splunk\etc\apps\jira\bin\jira_rest.py", line 624, in handle_args
handle_jql_args(args)
File "C:\Program Files\Splunk\etc\apps\jira\bin\jira_rest.py", line 606, in handle_jql_args
run_jsqlsearch(jql, use_internal_field_names, show_comments, time_field, max_results=max_results, kv_string_fields=kv_string_fields)
File "C:\Program Files\Splunk\etc\apps\jira\bin\jira_rest.py", line 489, in run_jsqlsearch
... View more
12-11-2018
09:32 PM
Hi,
Am trying to integrate Jira with Splunk enterprize and followed below steps.
1. Installed Add-on for Jira https://splunkbase.splunk.com/app/1438/
2. Updated Splunk\etc\apps\jira\bin\config.ini with Jira server details
[jira]
hostname = jira.ads.org
username =
password =
jira_protocol = https
jira_port = 443
3. Created local folder "Splunk\etc\apps\jira\local" and copied jira.conf.Not sure the relevance of this step as no Jira details updated here, but followed the setup instructions
When trying to run search query "| jira filters" ,Seeing below error in Splunk\var\log\splunk\Jira.logs.Any help would be appreciated.
ValueError: No JSON object could be decoded
... View more
- Tags:
- splunk-enterprise
11-26-2018
04:26 PM
Thanks you for pointing out .I've realized some steps to be taken when I used open source smtp servers that blocks messages by stating less secured application are blocked to use smtp server.All good once I enabled access to splunk
... View more
11-19-2018
03:16 PM
Thanks Rich,It worked.Here is the SQL version I used
SELECT ID,
ERROR_ID,
REGEXP_REPLACE(ERROR_STACK,
'[^0-9A-Za-z :._,]', '') AS ERROR_STACK,MESSAGE,SYSTEM_ERROR_CODE,SYSTEM_ERROR_MESSAGE, ENVIRONMENT_INFO,CREATED_ON,CREATED_BY,CHANGED_ON,CHANGED_BY
FROM Q$ERROR_INSTANCE
WHERE ID > ?
ORDER BY ID ASC
... View more
11-16-2018
12:50 PM
I don't think I've errors,It just not sending email.Here are the configurations if it helps.Please note that I can see notifications if I switched alert type and believe that endorse issue with email trigger.Please let me know if you need more details.
Enabled:
Yes. Disable
App:
search
Permissions:
Shared Globally. Owned by admin. Edit
Modified:
Nov 16, 2018 12:44:30 PM
Alert Type:
Scheduled. Hourly, at 45 minutes past the hour. Edit
Trigger Condition:
Number of Results is > 0. Edit
Actions:
1 Action
Alert iconSend email
Edit
... View more
11-16-2018
11:23 AM
Oracle SQL query is straight forward
SELECT * FROM tablename WHERE ID > ?
ORDER BY ID ASC
... View more
11-16-2018
11:19 AM
Here is db_inputs.conf
[default]
query_timeout = 30
max_rows = 0
fetch_size = 300
batch_upload_size = 1000
# 10MB
max_single_checkpoint_file_size = 10485760
index = default
(Edit - I changed the conf file entry to "code" so it doesn't do goofy things... 🙂 )
... View more
11-15-2018
03:44 PM
Hi ,
Just wanted to check if there is a way to get email alerts enabled in the Splunk Enterprise trial version. I see emails are not getting triggered and I wanted to check if this could be done in any other way.
Thanks,
... View more
11-15-2018
01:34 PM
Hi,
I've indexed Oracle table data that has a field to store special character "(double quote). I see Splunk trim the data after double code while ingesting the field into index.
e.g DB column ERROR_STACK has value
-ORA-06512: at "ApplicationName.PKG_SNP", line 4804
ORA-06512: at "ApplicationName.PKG_SNP", line 4553
ORA-06512: at "ApplicationName.PKG_SNP", line 4302
ORA-06512: at "ApplicationName.PKG_SNP", line 4051
Index field in Splunk has only -ORA-06512: at
Is there a way to get the full field value added in Splunk that has special characters?
... View more
11-15-2018
10:46 AM
Never mind,this is resolved.fields should be before lookup not at the end as the filter(where clause) is getting null created_date if we put fields at end that fails the query.
... View more
11-15-2018
10:14 AM
One more observation is in search mode I see message "No data found yet" while query is running ,but in dashboard execution I didn't see this message.
Is anything we can suspect query execution time?e.g dasbhboard execution stops when query takes long time
... View more
11-15-2018
10:09 AM
what yourfieldlists refer here.Is it single field or do I need to mention all the fields.I tried this option but didn't work out.Note that ERROR_CATEGORY_NAME is the lookup output field
|eval createdOn1=strftime(createdOn, "%Y-%m-%d")|where createdOn1>=earlyDate AND createdOn1
... View more
11-14-2018
03:36 PM
Thanks martin for the response,I tweaked the query to use strpttime() and strftime() in right places.It's working good.Here is the final query used.
index="booking_history" | dbxlookup lookup=PROVIDER_LOOKUP |eval earlyDate=strftime("$time_range.earliest$", "%Y-%m-%d")| eval latestDate=strftime("$time_range.latest$", "%Y-%m-%d")| eval apptDate=strptime(APPT_DATE, "%Y-%m-%d %H:%M:%S")|eval apptDate1=strftime(apptDate, "%Y-%m-%d")|where apptDate1>=earlyDate AND apptDate1<=latestDate |table APPT_DATE VISIT_TYPE_CID VISIT_TYPE_NAME earlyDate latestDate apptDate1 | chart count(VISIT_TYPE_CID) over apptDate1 by VISIT_TYPE_NAME
... View more
11-14-2018
02:27 PM
Hi,
I've observed that my dashboard panel query(that has stats) has returned no records when I have stats in it. But, when I tried to run the same query in the search page by selecting verbose mode, it returned the result.
When I remove stats, it's working in the dashboard panel, but I need to count the records using stats per the requirement. Would like to check if there is a way to set verbose mode in a saved dashboard panel query
index=db_errors | dbxlookup lookup=QERROR|eval earlyDate=strftime("1541836800", "%Y-%m-%d")| eval latestDate=strftime("1542268800", "%Y-%m-%d")| eval createdOn=strptime(CREATED_ON, "%Y-%m-%d %H:%M:%S")|eval createdOn1=strftime(createdOn, "%Y-%m-%d")|where createdOn1>=earlyDate AND createdOn1
... View more
11-13-2018
04:21 PM
Is there a way to customize oracle drivers in splunk.I did configure default ones available with splunk enterprize 7.2.0.Wondering what I can do to fix this in my local installation.Most of the above posts referring java jdbc code ,not sure how to interpret that in splunk.
Please note that the static query with hardcoded time stamp is working good.some how splunk raising column setup passes the data type as java.lang.String that has issues while comparing against java.oracle.TimeStamp.
Working Version:
SELECT <> FROM <> where create_ts > to_timestamp('01-11-2018 08:15:03', 'DD-MM-YYYY HH24:MI:SS') order by create_ts ASC
Issue When replaced string date with ? by configuring it to timestamp raising column
SELECT <> FROM <> where create_ts > to_timestamp(?, 'DD-MM-YYYY HH24:MI:SS') order by create_ts ASC
... View more
11-13-2018
12:06 PM
I'm trying to index oracle table by setting up raising column on time stamp with timezone that was set to data type TIMESTAMP(6) WITH TIME ZONE(e.g value 08-SEP-17 08.01.39.330434000 AM UTC) in oracle database.
Getting error when time stamp is set to DD-Mon-YY HH:MI:SS TZH:TZM for create_time raising column
java.lang.ClassCastException: java.lang.String cannot be cast to oracle.sql.TIMESTAMPTZ
Any help would be appreciated.
... View more
- Tags:
- splunk-enterprise
11-09-2018
01:11 PM
Hi,
Can you please help me to understand how to use the time input token range for the below scenarios? I'm having issues dealing with the time range filter in dashboard query.
Oracle table added to splunk using DBconnect
ProviderID Booked_Date Time Visit_Type
1 11/1/2018 10AM Office
1 11/1/2018 11AM Telephone
2 11/2/2018 10AM Telephone
3 11/5/2018 3PM Office
Look up crated to get Name for provider ID that is working good with static query.
index="booking_history" | dbxlookup lookup=PROVIDER_LOOKUP | eval myDate=strptime(BOOKED_DATE, "%Y-%m-%d")
| where myDate=strptime("11/1/2018", "%Y-%m-%d") | chart count(VISIT_TYPE_CID) over APPT_DATE by VISIT_TYPE_NAME
Time input field(form( created with token "time_input" and below query returns no records though splunk have events.
index="booking_history" | dbxlookup lookup=PROVIDER_LOOKUP | eval myDate=strptime(BOOKED_DATE, "%Y-%m-%d")
| where myDate>=strptime("$time_input.latest$", "%Y-%m-%d") AND myDate<=strptime("$time_input.latest$", "%Y-%m-%d") | chart count(VISIT_TYPE_CID) over APPT_DATE by VISIT_TYPE_NAME
Note: Getting long integers when trying to retrieve "time_input" from UI.
Thanks.
... View more
10-09-2018
03:42 PM
2 Karma
I'm new to Splunk and exploring options. I want to know if I can extract/generate the SOAP request from WAS logs(using any of Splunk features e.g API's) that has required data elements logged in.
Would like to check If any API is available to automate this instead of using regular expression to extract data elements into a output file and then use out of box functionality to generate the soap request from output file.
... View more
