Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About narenpg
narenpg
Explorer
Member since:
11-23-2018
02-25-2026
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-23-2018 |
Activity Feed
- Posted Re: ingesting csv headers with double quotes and % on Splunk Cloud Platform. 03-07-2025 08:24 AM
- Tagged Re: ingesting csv headers with double quotes and % on Splunk Cloud Platform. 03-07-2025 08:24 AM
- Posted ingesting csv headers with double quotes and % on Splunk Cloud Platform. 03-04-2025 08:22 AM
- Posted Re: i am not seeing export classic dashboard to csv on Dashboards & Visualizations. 02-18-2025 04:52 PM
- Posted i am not seeing export classic dashboard to csv on Dashboards & Visualizations. 02-18-2025 01:25 PM
- Tagged i am not seeing export classic dashboard to csv on Dashboards & Visualizations. 02-18-2025 01:25 PM
- Posted Re: how to send UF to on-perm and cloud on Security. 12-06-2024 06:14 AM
- Posted how to send UF to on-perm and cloud on Security. 12-05-2024 08:31 AM
- Posted Re: event line break in props on Getting Data In. 11-22-2024 07:03 AM
- Posted Re: event line break in props on Getting Data In. 11-21-2024 02:33 PM
- Posted event line break in props on Getting Data In. 11-21-2024 01:31 PM
- Got Karma for create multiple servicenow incidents based on a single query. 06-05-2020 12:50 AM
- Posted Re: extract custom filed and display value in the table output on Splunk Search. 05-06-2020 08:58 AM
- Posted Re: extract custom filed and display value in the table output on Splunk Search. 05-06-2020 08:57 AM
- Posted Re: extract custom filed and display value in the table output on Splunk Search. 05-06-2020 08:40 AM
- Posted extract custom filed and display value in the table output on Splunk Search. 05-06-2020 08:39 AM
- Tagged extract custom filed and display value in the table output on Splunk Search. 05-06-2020 08:39 AM
- Posted create multiple servicenow incidents based on a single query on All Apps and Add-ons. 11-23-2018 08:40 AM
- Tagged create multiple servicenow incidents based on a single query on All Apps and Add-ons. 11-23-2018 08:40 AM
- Tagged create multiple servicenow incidents based on a single query on All Apps and Add-ons. 11-23-2018 08:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
03-07-2025
08:24 AM
This seems to be working in the "Add Data" testing, but after adding this sourcetype when i search i dont see the headers. Actually the header starts on line 2, so i added "File Preamble" to skip the first line and start ingesting the headers from line 2 but it is skipping it. What am i missing?
... View more
- Tags:
- splunkcloud
03-04-2025
08:22 AM
I am trying to ingest a csv file which has headers with double quotes " and %. They are separated by comma. But after ingestion if two field names has same name except one has # and the other one has % then it merges both of them into one field while using table output. How to fix this issue. If splunk does`nt support csv headers then i have to remove before ingesting them. Any ideas.
... View more
Labels
- Labels:
-
Splunk Investigate
-
troubleshooting
02-18-2025
04:52 PM
I cannot download from the results pane as well. Here Export is greyed out. I am the admin but i cannot download as csv.
... View more
02-18-2025
01:25 PM
I am trying to export the dashboard into a csv file. But i am not seeing CSV under export. How do i enable the csv export.? My data is in table format.
... View more
- Tags:
- victoria experience
Labels
- Labels:
-
Classic dashboard
12-06-2024
06:14 AM
Thanks. We have one perm license too. This on-perm env will be used for 2 days every quarter.
... View more
12-05-2024
08:31 AM
We have currently configured to send the logs to splunk cloud also we are setting up a DR on-perm server, now the question is how to configure the UF to send to both the cloud and DR (On-Perm). NO issues with the cloud environment. Is it possible to send it to both? On the UF the certificate is for splunk cloud and i am not sure how to add our on-perm certificate.
... View more
Labels
- Labels:
-
SSL
11-22-2024
07:03 AM
1. Yes This is the constant delimiter ---------------------------- This is an Example (He/She) ----------------------------- 2. It picks up every 7th line and skips others. I think that is because i used \n+ right? 3. I should have used "splunk btool props list" instead of inputs.. I ran the command and i see only one LINE_BREAKER for that sourcetype. Thanks for the info on BREAK_ONLY_BEFORE What is the Regex i should use it on the LINE_BREAKER?
... View more
11-21-2024
02:33 PM
1. It truncates hyphen - before the "This is an Example" now i added ([\r\n+])(.*)(This is an Example).* it captures everthing. But the events are broken into single lines. I have set SHOULD_LINE_MERGE = false. 2. Yes props.conf is on the proper component 3. i verified using this command splunk btool inputs list --debug (there is no other setting that is overwriting LINE_BREAKER) NOTE: can i use BREAK_ONLY_BEFORE instead of LINE_BREAKER
... View more
11-21-2024
01:31 PM
---------------------------- This is an Example (He/She) -----------------------------
Version: 21.04.812-174001
Date/time: 2024-10-18/01:00:06 (2024-10-18/05:00:06 UTC)
User/aplnid: /2370
ComputerName/-user: Ann/King
Windows NT version 6.2, build no. 9200 /10872/6241785241
-> Loading program
----------------------------------------------------------------------------------------------------
---------------------------- This is an Example (He/She) -----------------------------
Version: 21.04.812-174001
Date/time: 2024-10-18/01:00:06 (2024-10-18/05:00:06 UTC)
User/aplnid: /2370
ComputerName/-user: James/Bond
Windows NT version 6.2, build no. 9200 /10872/6241785241
-> Start APL (pid 8484)
----------------------------------------------------------------------------------------------------
---------------------------- This is an Example (He/She) -----------------------------
Version: 21.04.812-174001
Date/time: 2024-10-18/01:00:06 (2024-10-18/05:00:06 UTC)
User/aplnid: /2370
ComputerName/-user: Martin/King
Windows NT version 6.2, build no. 9200 /10872/6241785241
-> Initialising external processes
---------------------------------------------------------------------------------------------------- I am trying to break events at "This is an Example" [mysourcetype] TIME_FORMAT = %Y-%m-%d/%H:%M:%S TIME_PREFIX = Date\/time:\s+ TZ = US/Eastern LINE_BREAKER = (.*)(This is An Example).* SHOULD_LINEMERGE = false This works when i test in "Add Data" but it is not working under props.conf. All the lines are merged into one event. What is the issue in this?
... View more
Labels
- Labels:
-
props.conf
-
universal forwarder
05-06-2020
08:58 AM
Oops Sorry it is working... There was a typo.. Thanks a lot
... View more
05-06-2020
08:57 AM
I did use the regex101 for this.. After using your regex, i am still not seeing the output for the table orderEnteredBy. Do i have to use makeresults
... View more
05-06-2020
08:40 AM
Somehow the name value is missed from my post
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"
... View more
05-06-2020
08:39 AM
Query
index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log"
|convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S"
|rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")"
|table time orderEnteredBy
It matches the word orderEnteredBy but when i tried to get the name into the table it shows empty..
Here is the log
availableBalance":{},"projectedBalance":{}}},"productSummary":{"symbol":"RPACX","displayValue":"RPACX","cusip":"32254T759","assetType":"MUTUAL_FUND","description":"UFACRESCENT FUND N/L","settlementDuration":4,"omnibusProduct":true},"orderEnteredBy":"JANEDOE","orderUpdatedBy":"SYS_USER","dirtyFSTT":false,"messagesSummary":{"messagesCount":2,"errorsCount":0,"warningsCount":0,"infosCount":0},"assetType":"MUTUAL_FUND","fundServTransactionTypeDetails":{"cdscValueOverridable":false,"netAssetValue":"NAV_OTHER","rightsOfAccumulation":{"additionalHoldings":0,"manualOverride":false,"additionalHoldingsValid":true}
... View more
- Tags:
- splunk-cloud
Labels
- Labels:
-
field extraction
-
rex
-
table
11-23-2018
08:40 AM
1 Karma
I have a query which has multiple OR statements and if it matches more than 1 error then it needs to generate multiple incidents. Is this possible? I dont want separate queries for each errors?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-25-2026
01:09 PM
|
