About jaminquimby

jaminquimby · ‎01-31-2014

I just started with Splunk I am indexing historical data for the first time. I have messed up a few times and had to uninstall and reinstall. I am still setting up my forwarders: two IIS folder locations and 1 SQL table with 4 columns nothing special. It said I had to correct the violation and I am curious on how to do that. I am also curious as if my search is disabled or if my new forwarder I not working. How do I know if the forwarder is broke or search is disabled? I am on day 2 of using Splunk and like most problems in IT it boils down to licensing. *

jaminquimby · ‎01-31-2014

Correct by midnight to avoid violation This pool is over poolsz=524288000 bytes, please correct before midnight auto_generated_pool_download-trial download-trial pool_over_quota

jaminquimby · ‎01-31-2014

I am new to Splunk and I am trying to understand forwarders. I ran my first test and I imported 65,000 null values with a timestamp, guid and shot over the limit. Why not create a single user version in trial mode for a month at least I could test the forwarders without it hurting my indexing dont know if I said that right because I really dont understand what counts as a index. Also I have years of historical data why not give us the ability to import that data over time so we dont go over the index in a given day. Is a index a search index, a import index, a row index. Not sure.

jaminquimby · ‎01-30-2014

I will not mark myself as having the right answer because it seems self serving. But for anyone who is looking to parse Microsoft's Storage Reports. BREAK_ONLY_BEFORE_DATE = true KV_MODE = XML LINE_BREAKER = (<item>) MUST_NOT_BREAK_AFTER = (ReportData/>) MUST_NOT_BREAK_BEFORE = (<ReportData) NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_PREFIX = (<PeakUsag) pulldown_type = 1

jaminquimby · ‎01-30-2014

I have figured it out. BREAK_ONLY_BEFORE_DATE = true KV_MODE = XML LINE_BREAKER = ( ) MUST_NOT_BREAK_AFTER = (ReportData\/>) MUST_NOT_BREAK_BEFORE = (<ReportData) NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_PREFIX = (<PeakUsag) pulldown_type = 1

jaminquimby · ‎01-30-2014

I am new to Splunk and am trying to figure out how to parse a xml file. This is a generic xml file coming from Microsoft Storage Reports The XML <?xml version="1.0"?><StorageReport version="2.0"><ReportHeader ReportTitle="Quota Usage Report" GeneratedAt="1/30/2014 1:05:06 AM" MachineName="Server1" ReportTypeDescription="Lists the quotas that exceed a certain disk space usage level. Use this report to quickly identify quotas that may soon be exceeded so that you can take the appropriate action." ReportDescription="" TimestampRenderingPhaseStart="1/30/2014 1:05:08 AM" TimestampGenerationEnding="1/30/2014 1:05:08 AM" MaxDisplayItems="1000" Type="FsrmReportType_QuotaUsage" FilesCount="189" IsStandardFileList="False"><ReportNamespaces><Namespace ID="0">K:\</Namespace></ReportNamespaces><ReportFilters><Filter Name="Minimum Quota used percent" Value="0%" /></ReportFilters><ReportWarnings /></ReportHeader><ReportData><Item><Folder>k:\fs_Folder1</Folder><FolderURL>\\Server1\k$\fs_Folder1</FolderURL><RemotePath><Path>\\Server1\STORE1$\fs_Folder1</Path></RemotePath><Owner>BUILTIN\Administrators</Owner><Limit>1073741824</Limit><Used>4598678528</Used><PercentUsed>428.29</PercentUsed><PeakUsage>4602409984</PeakUsage><PeakUsageTime>1/29/2014 11:49:57 AM</PeakUsageTime><Description></Description></Item><Item><Folder>k:\fs_Folder2</Folder><FolderURL>\\Server1\k$\fs_Folder2</FolderURL><RemotePath><Path>\\Server1\STORE1$\fs_Folder2</Path></RemotePath><Owner>BUILTIN\Administrators</Owner><Limit>1073741824</Limit><Used>3881845760</Used><PercentUsed>361.53</PercentUsed><PeakUsage>3922589696</PeakUsage><PeakUsageTime>1/28/2014 3:41:41 PM</PeakUsageTime><Description></Description></Item></ReportData><ReportSummary><ReportTotals QuotaCount="189" Used="94984972288" /><NamespaceTotals QuotaCount="189" Used="94984972288" /></ReportSummary></StorageReport> The Props.conf SHOULD_LINEMERGE = true KV_MODE=xml BREAK_ONLY_BEFORE=<Item LINE_BREAK =<Item NO_BINARY_CHECK =1 TRUNCATE=100000000 MV_ADD = true DATETIME_CONFIG = CURRENT

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎01-02-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do I correct a license violation?

Help with Props.config and XML Parsing

Re: How do I correct a license violation?

How do I correct a license violation?

Re: What happens when I exceed my licensed limit?

Re: Help with Props.config and XML Parsing

Re: Help with Props.config and XML Parsing

Help with Props.config and XML Parsing

Are you a member of the Splunk Community?