Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bkumarm
bkumarm
Contributor
Member since:
12-02-2015
06-05-2020
Community Statistics
| Posts | 102 |
| Solutions | 4 |
| Karma Given | 45 |
| Karma Received | 11 |
| Member Since | 12-02-2015 |
Activity Feed
- Got Karma for Re: How to generate storage and license usage reporting in a distributed Splunk deployment?. 08-20-2021 01:29 AM
- Got Karma for Re: how to configure multiple indexing queues in indexes.conf? What is the impact if we configure two indexing queues and then reduce to one?. 06-05-2020 12:49 AM
- Got Karma for How to get events that do not contain a particular string or a pattern?. 06-05-2020 12:49 AM
- Karma Re: how to extract date from filename and add it with time from event in the same file for JDukeSplunk. 06-05-2020 12:48 AM
- Karma Re: How to report Detailed Disk usage in a distributed environment? for gjanders. 06-05-2020 12:48 AM
- Karma Re: Does the license master have disk usage info from all slaves (all indexes, sourcetypes, sources) to report on? for MuS. 06-05-2020 12:48 AM
- Karma Re: Does the license master have disk usage info from all slaves (all indexes, sourcetypes, sources) to report on? for MuS. 06-05-2020 12:48 AM
- Karma Re: Does the license master have disk usage info from all slaves (all indexes, sourcetypes, sources) to report on? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to generate storage and license usage reporting in a distributed Splunk deployment? for dcarmack_splunk. 06-05-2020 12:48 AM
- Karma Re: How to back up and restore indexed data when upgrading our indexer clustering environment from Splunk 6.2 to 6.3? for ChrisG. 06-05-2020 12:48 AM
- Karma Re: How to back up and restore indexed data when upgrading our indexer clustering environment from Splunk 6.2 to 6.3? for muebel. 06-05-2020 12:48 AM
- Karma Re: How to back up and restore indexed data when upgrading our indexer clustering environment from Splunk 6.2 to 6.3? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Why is the knowledge bundle directory filling up after 6.5.1 upgrade? for pkeller. 06-05-2020 12:48 AM
- Karma Re: Why is the knowledge bundle directory filling up after 6.5.1 upgrade? for Lowell. 06-05-2020 12:48 AM
- Karma Re: How to setup Splunk App for Stream in a Distributed environment? for jsie_splunk. 06-05-2020 12:48 AM
- Karma Re: How to setup Splunk App for Stream in a Distributed environment? for mdickey_splunk. 06-05-2020 12:48 AM
- Karma Re: What is the Difference beween time of capture and index time in splunk app for stream? for mdickey_splunk. 06-05-2020 12:48 AM
- Karma Re: Where to get Splunk icons for architecture and deployment diagrams? for javiergn. 06-05-2020 12:48 AM
- Karma Re: Where to get Splunk icons for architecture and deployment diagrams? for javiergn. 06-05-2020 12:48 AM
- Karma Re: Where to find comparison between Splunk releases 6.2, 6.3, and 6.4? for MuS. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-30-2018
07:29 AM
I need a list of refids that have MY_STR_METHOD_ACTION and ERRMSG : Main problem: Sub problem message
Example:
2018:08:22:22:39:51.731 myhostname 3:INFO MY_IDENTIFIER1_TEST 548026790130303164 454
2018:08:22:22:39:51.731 myhostname 3:INFO MY_STR_METHOD_ACTION1.COMPONENT1 TEST 548026790130303164
2018:08:22:22:39:51.752 myhostname 1:ERR1 MY_SERVICE_TYPE STRTST 548026790130303164 ERRMSG : Main problem1: Sub problem message11
the output should be
548026790130303164 MY_STR_METHOD_ACTION1.COMPONENT1 ERRMSG : Main problem1: Sub problem message11
... View more
09-27-2018
03:02 AM
I have raw events that look as below:
2018:08:22:22:39:51.731 myhostname 3:INFO MY_IDENTIFIER_TEST 548026790130303164 454
2018:08:22:22:39:51.731 myhostname 3:INFO MY_STR_METHOD_ACTION.COMPONENT TEST 548026790130303164
2018:08:22:22:39:51.752 myhostname 1:ERR1 MY_SERVICE_TYPE STRTST 548026790130303164 ERRMSG : Main problem: Sub problem message
=====================================
I want to create a table that have equal "548026790130303164" values in 2dn and and 3rd row.
need help in getting the right search query.
I want the three column table output like below:
548026790130303164 "MY_STR_METHOD_ACTION.COMPONENT" "ERRMSG : Main problem: Sub problem message"
... View more
08-05-2018
09:14 AM
already answered ... it was a small fix that was required in transforms
... View more
08-05-2018
09:13 AM
Finally I got this working. Figured out that the solution did not work earlier because of a line breaking issue at transforms.
Thanks for all your time.
I am accepting this answer
... View more
08-05-2018
08:48 AM
@DalJeanis what I need is to filter all events that DO NOT have the string "There was a this ERROR occured " exact match. And then I will need to extract fields from those events to generate reports.
... View more
08-05-2018
04:23 AM
The first part does not matter, I want to filter all events that contain
" There was a this ERROR occurred" .
I did try @DalJeanis approach, couldn't get a complete solution though.
... View more
08-04-2018
09:14 PM
@niketnilay , in the current case, I do not have access to backend to configure transforms. I have been provided access to an index that has these events . I need to use regex or search to filter/extract required fields.
... View more
08-04-2018
10:45 AM
1 Karma
I have events coming in the below format
"2018:04:04:11:19:59.926 testhostname 3:INFO TEST:NOTE FLAG 1234567894567890 praimaryflag:secondflag:action:debug message can be exception : There was a this ERROR occured "
and there are events that have different messages too such as :
2018:04:04:11:19:59.926 testhostname 3:INFO TEST:NOTE FLAG 1234567891267895 praimaryflag:secondflag:action:debug message can be exception : There was something else
2018:04:04:11:19:59.926 testhostname 3:INFO TEST:NOTE FLAG 12345686794567891 praimaryflag:secondflag:action:debug message can be exception : Just a debug log no worries
2018:04:04:11:19:59.926 testhostname 3:INFO TEST:NOTE FLAG 1234567894567819 praimaryflag:secondflag:action:debug message can be exception : There was a different ERROR
I want to extract all events that do not contain
Case 1. " debug message can be exception : There was a this ERROR occured"
Case 2. " There was a this ERROR occured"
Need help getting the right search query or rex for this.
... View more
02-26-2018
09:52 PM
My problem is, I am unable to get the transforms to extract the message body, in such a way that I can map it into a lookup table field.
... View more
02-26-2018
09:51 PM
Yes, that would be final solution. we want to catch all such errors and alert user.
There are apps being deployed by large number of users. Hence we need a generic approach.
The idea is to first - parse the event and get the message part. secondly, check if the message with the one we have in a lookup table. Third step generate alert message and initiate corrective action.
... View more
02-26-2018
04:35 AM
Splunk admins are facing regular challenge in understanding the error message and what corrective action need to be taken? or just ignore the internal errors.
sometimes these error messages are huge and may need cleanup or marking them for someone else's notice.
Example logs:
02-26-2018 05:04:49.872 +0000 ERROR ExecProcessor - message from "/scripts/test.sh" Ifconfig is obsolete! For replacement check ip.
02-26-2018 05:04:49.872 +0000 ERROR ExecProcessor - message from "/scripts/test.sh" Because testband address has 20 bytes, only the first 8 bytes are displayed correctly.
02-26-2018 05:04:49.871 +0000 ERROR ExecProcessor - message from "/scripts/test.sh" Ifconfig uses the ioctl access method to get the full address information, which limits hardware addresses to 8 bytes.
02-26-2018 00:01:25.118 -0500 ERROR FrameworkUtils - Incorrect path to script: /.binrunshell.cmd. Script must be located inside $SPLUNK_HOME/bin/scripts.
02-26-2018 00:01:25.118 -0500 ERROR ExecProcessor - Ignoring: "/.binrunshell.cmd mymsg"
02-26-2018 00:01:13.717 -0500 ERROR HttpListener - Exception while processing request from 127.0.0.1 for /output_mode=json: Could not find object id=asdflkj
I would like to combine all the Execprocessor say ignore.
All FrameworkUtils error as send email to developer.
Any idea on how can we extract the error message part from these events and correlate( group) them ? I need help in getting the regex for doing it.
Any other approach is also welcome.
... View more
02-26-2018
04:09 AM
we are trying to use the btool scripted input app:
This app is currently indexing the configsfrom btool commands with the line breaking is for each line within the config file.
Our requirement needs individual config parameter within each stanza to be correlated.
i.e. the event breaking should be at Stanza level
any idea how to achieve this?
... View more
12-28-2017
02:12 AM
1 Karma
Going by analysis and few trials on a sandbox with limited data, the explanation is clear. Hence accepting this answer.
... View more
12-20-2017
04:37 AM
your answer is very close to what I am trying to understand.
None of these documents are having description of multiple queues in indexer ( such as 2 parsing queue, 2 indexing queue). I understand scaling is achieved by adding indexers. however that is not I am looking for.
please correct me if I am wrong in my statement.
... View more
12-19-2017
04:14 AM
There is no specific requirement for this. we want to understand various mechanisms to improve performance (overall) and one place is queueing.
we just wanted to understand how to configure multiple queues? any examples?
and what is impact on performance ( such as CPU usage, memory usage).
what is the major difference in having single queue over multiple queue ?
... View more
12-18-2017
10:38 PM
We have a requirement which our architects think needs to have multiple indexing queue.
can anyone provide a reference example configuration for createing two queues?
which conf files we need to maintain? and
what is the impact of having two queues?
With reference to the above: Suppose we find out that setting multiple indexing queue is not working as expected, then what is the impact of reducing indexing queue numbers to only one?
... View more
09-06-2017
06:33 AM
The cleaning up of bundles does need a restart of the Indexer. hence let me know do we need to restart the indexer if I use this script? what is the impact of running this script as cron on a daily basis? what is the downtime?
Thanks,
... View more
08-16-2017
05:04 AM
Though there is no specific answers discussed, the solution I found is to use the _indexingtime . As for now there is nothing called time of arrival in Splunk . Frankly this should be recorded, so we will have the delay factor accounted for. So time of event generation, time of arrival at Splunk and Indexing time should be used to analyze the delay introduced overall.
I am not perfect ..so if you have any other solution please suggest ... open to ideas !!!
... View more
08-10-2017
02:26 AM
your questions triggered me to look more detail and lead to resolution I posted below.
Thank You !!!
... View more
08-10-2017
02:23 AM
Though late, I thought it would be good to post the resolution:
The new version of DMC in Splunk provides all features I need.
Also I realized that we can monitor these parameters from the Master Node and Deployment server too.
... View more
07-25-2017
10:58 PM
Thanks Niket, your clue helped us resolve the issue.
in your props.conf, []
TIME_FORMAT=%H%M%S.%6N
we had also problem in filename, that we fixed.
-Bharath
... View more
07-25-2017
06:52 AM
I see that the http://docs.splunk.com/Documentation/Splunk/6.3.4/Data/HowSplunkextractstimestamps
says it does by default. but it is not working for me
... View more
07-25-2017
06:29 AM
2 Karma
We have log files with names like: " my-file-log1.2017-07-25.name.log"
The events in the log are like this:
060047.342061Z INFO ASDFTestStatusMsg::eval: Passed(123/567892)
The time format in the events is: HHmmss.SSSSSS or HHmmss.SSS
Requirement is to add the date from filename into all the events at index time.
I also need help in converting the time into proper timestamp.
any solutions suggested?
Thanks,
Bharath
... View more
07-20-2017
06:19 AM
I referred the MC documentation ad added search peers on one of the boxes. This is really awesome feature that provides useful reports on critical data.
... View more
07-18-2017
06:54 AM
did you mean I have to forward internal logs into one host? it may become a breakdown point.. because if I loose the host, the monitoring data would be gone ..correct?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
