thanks a lot @vliggio ... View more

just an update on this issue(just in case anyone has the same issue) the events were being written in the log file with a delay, by default the time_before_close is 3 seconds. I had to change this to 5 seconds and also also set the multiline_event_extra_waittime=true in inputs.conf time_before_close = 5 multiline_event_extra_waittime = true From Splunk documentation on these parameters, time_before_close = <integer> * Modtime delta required before Splunk can close a file on EOF. * Tells the system not to close files that have been updated in past seconds. * Defaults to 3. multiline_event_extra_waittime = [true|false] *By default, Splunk Enterprise sends an event delimiter when (1) it reaches EOF of a file it monitors and (2) the last char it reads is a newline. *In some cases, it takes time for all lines of a multiple-line event to arrive. *Set to true to delay sending an event delimiter until the time that Splunk Enterprise closes the file, as defined by the time_before_close attribute, to allow all event lines to arrive. *Default to false. ... View more

I have tried with All time and _index_earliest=-5m but still the same result. 5 lines in the above sample is getting split into 5 different events (with same time stamp). All those 5 lines should be a single event and not split at all ... View more

It's a distributed setup with 2 SH and 4 IDX 1. No transforms.conf 2. I have deployed it in the indexers through the deployment server 3. Yes, I have restarted all the splunk instances 4. I'm using last 15 min in the search time range picker. ... View more

Hi Somesoni2, I have few trades that are available in both the indexes but still appears in the above query. index=XXX_inbound SMT55/BOND_TR has multiple version, I just want to take the latest versions and compare against the first index. For eg: 0001414386 The trade is available in index1, as version 4 But the same trade is available in index2, as version 3 and version 4. I just want to take the latest version and compare it against index 1. ... View more

Hi Somesoni2, The query was useful with indexes=1 where the trades in one index is not available in the other index is quite helpful. I have found that the DBConnect has not pulled few trades. Thanks a lot for the query ... View more

While trying the above query - I'm getting Error in 'stats' command: The argument 'index_values' is invalid. ... View more

Hi Somesoni2, Thanks for the query, I want to make sure the tradeid in index 1 is available in index 2, basically no difference between first index and second index. If there is a difference, then it means the tradeid's are not available in either of the index. will where clause indexes=2 should be used here? . just only the differences should be shown if there is no difference no results - - all good. if there is a difference only those trades needs to be shown -- need to check those trades let me know if I'm not clear ... View more

It has split all the 5 lines to single events. I want all the 5 lines to be a single event and not split at all ... View more

Apologies for late reply, I have restarted after the props.conf changes still no luck. ... View more

Hi dkeck, Thanks for the response. I have tried the below props.conf and still its not working, the events are getting split differently each time. SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE = ^Relay The events start with Relay as shown in the sample, I have tried adding TRUNCATE=0 and MAX_EVENTS = 5 along with the above configs but doesn't make any difference ... View more

thanks a lot FrankVI, it was the props.conf that was being deployed in UF but was not on the indexer. I have created the entries in the /etc/system/local and it started to work ... View more

tried both of them but its not splitting mate, below is the props.conf im using [sourcetype] TRUNCATE = 0 KV_MODE = json #INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true SHOULD_LINEMERGE = false LINE_BREAKER = "uri":+[^\}]+\}(,[\r\n]+) #MUST_BREAK_AFTER = DATETIME_CONFIG = #pulldown_type = 1 ... View more

I have tried the line breaker but still its not breaking as expected, Below is the sample, [ { "line": 1, "elements": [ ], "name": "App Application EUR Fwds Check", "description": "", "id": "App-application-eur-fwds-check", "keyword": "Feature", "uri": "AppFeature.feature" }, { "line": 1, "elements": [ ], "name": "App Application Fwds Desk Check", "description": "", "id": "App-application-fwds-desk-check", "keyword": "Feature", "uri": "AppFwdsDeskCheck.feature" }, { "line": 1, "elements": [ ], "name": "App Application GBP Fwds Check", "description": "", "id": "App-application-gbp-fwds-check", "keyword": "Feature", "uri": "AppGBPFwdsCheck.feature" }, { "line": 1, "elements": [ ], "name": "App Application Liabilities Check", "description": "", "id": "App-application-liabilities-check", "keyword": "Feature", "uri": "AppLiabilitiesCheck.feature" }, { "line": 1, "elements": [ ], "name": "App Application Spot Check", "description": "", "id": "App-application-spot-check", "keyword": "Feature", "uri": "AppSpotCheck.feature" }, { "line": 1, "elements": [ ], "name": "App Application USD Fwds Check", "description": "", "id": "App-application-usd-fwds-check", "keyword": "Feature", "uri": "AppUSDFwdsCheck.feature" } ] ... View more

I have tried this in the UF props.conf, earlier when i used the _json internal source type I was not able to figure out why the entries were not getting indexed, but now im able to see the events just need help with the line breaker for this JSON sourcetype [sourcetype] TRUNCATE = 0 KV_MODE = json NO_BINARY_CHECK = true SHOULD_LINEMERGE = false #MUST_BREAK_AFTER = "uri":+\s+"+\w+.+\w+"+\s+\}, LINE_BREAK = "uri":+\s+"+\w+.+\w+"+\s+\}, DATETIME_CONFIG = and i'm planning to break the line from this instance, from the sample, but the problem is its not working after the line break and its breaking each line. "uri": "YYYYYYYEURFwdsCheck.feature" } ... View more

I have added a sample JSON which is having issue in Splunk, All I could see in the internal indexes is parsing error but was not clear on where the error is. I have added a props.conf in UF and search head, I have changed the inputs.conf to pick this custom source type rather than the internal _json In UF, [sourcetype] DATETIME_CONFIG = NO_BINARY_CHECK = true INDEXED_EXTRACTIONS = JSON category = Custom pulldown_type = 1 In Search Head, [sourcetype] KV_MODE = none AUTO_KV_JSON = false ... View more