About Stevelim

Stevelim · ‎08-02-2023

If anyone is stuck like me, the solution I had was to re-run with the same version of Splunk before running the latest installer.

Stevelim · ‎08-02-2023

I am performing a migration of an 8.2.2 Splunk instance into a new VM. I have copied the entire $SPLUNK_HOME (D:\Splunk) folder into the new VM machine and ran the installer. The installer fails with rollback. I have the logs with me and here is an excerpt of the failure: MSI (s) (DC:AC) [14:20:49:588]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI3EE8.tmp, Entrypoint: FirstTimeRunCA FirstTimeRun: Warning: Invalid property ignored: FailCA=. FirstTimeRun: Info: Properties: splunkHome: D:\Splunk. FirstTimeRun: Info: Execute first time run. FirstTimeRun: Info: Enter. Args: "D:\Splunk\bin\splunk.exe", _internal first-time-run --answer-yes --no-prompt FirstTimeRun: Info: SystemPath is: C:\Windows\system32\ FirstTimeRun: Info: Execute string: C:\Windows\system32\cmd.exe /c ""D:\Splunk\bin\splunk.exe" _internal first-time-run --answer-yes --no-prompt >> "C:\Users\********\AppData\Local\Temp\splunk.log" 2>&1" FirstTimeRun: Info: WaitForSingleObject returned : 0x0 FirstTimeRun: Info: Exit code for process : 0x2 FirstTimeRun: Info: Leave. FirstTimeRun: Error: ExecCmd failed: 0x2. FirstTimeRun: Error 0x80004005: Cannot execute first time run. CustomAction FirstTimeRun returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 14:20:57: InstallFinalize. Return value 3. Anyone has any insights?

Stevelim · ‎07-22-2019

The issue with this technique is that I need the format to be 22-Jul for example. Changing the eval strtime command to strftime(_time,"%d-%b") works but only for a month of data. I eventually need this to go over a year worth of data which will end up with this arrangement of headers if I go with this: 01-JAN | 01-FEB .. | 01-DEC | 02-JAN |

Stevelim · ‎07-17-2019

Given a week worth of timestamped data like the following: 1st FEB Time = "010219 0100" Category = "A" Value = "1.1" Time = "010219 0100" Category = "B" Value = "1.3" Time = "010219 0110" Category = "A" Value = "2.1" <- Last data for A on 1st FEB Time = "010219 0110" Category = "B" Value = "2.2" <- Last data for B on 1st FEB 2nd FEB Time = "020219 0100" Category = "A" Value = "1.1" Time = "020219 0100" Category = "B" Value = "1.3" Time = "020219 0110" Category = "A" Value = "1.1" <- Last data for A on 2nd FEB Time = "020219 0110" Category = "B" Value = "1.2" <- Last data for B on 2nd FEB ... Assuming my keys are extracted correctly, how can I display a table of this format: Category 01-FEB 02-FEB... A 2.1 1.1 B 2.2 1.2 I am able to get to this point with the following query: <Base Search> | dedup date_mday, date_month, TagName | eval date = strftime(_time,"%Y%m%d-%b") | xyseries TagName, date, Value and get the following results: Category 20190219-Feb 20190219-Feb A 2.1 1.1 B 2.2 1.2 How can I rename manipulate the header such that they are all in chronological order with the correct header names? For context, the data will be searched for an entire year. I was able to get close to the presentation but encountered an ordering issue, for example, all the 01-X grouped together, 01-JAN, 01-FEB, 01-MAR and so on

Stevelim · ‎05-05-2019

The issue with an overlay is that it goes all the way to the bottom of the y axis. In the rangemarker example, you can see that it is a range in the middle of the chart, ie. (4 to 6 in your example).

Stevelim · ‎05-05-2019

I am trying to achieve the same visualization as documented over here: https://wiki.splunk.com/Community:Search_Report:_How_to_Add_a_Range_Marker_by_Advanced_XML My understanding is that this is deprecated but are there anyway I can get this up in the latest version of Splunk?

Stevelim · ‎12-20-2018

Great to hear!

Stevelim · ‎10-26-2018

To write back, you can trigger a REST Call to the Tag in question. You will however, need the use of the IoT Gateway instead of the IDF for Splunk Plugin. So steps in general: Create an alert based on your requirement Trigger Script Script sends a HTTP Post to the correct end point in Kepware Kepware "writes" to trigger the machine shut down

Stevelim · ‎10-07-2018

This works great! I learnt a lot from the regex pattern as I was primary stuck on how to extract the huge chunk of table. I would love to extract the raw to something splunk friendly but unfortunately that is out of my control.

Stevelim · ‎10-04-2018

I figured what I can extract most of the fields out of the box via Splunk. I will like the key value pair to be something along: 15:30:33 No1_OFFSET = 14.3 15:30:33 No2_OFFSET = 14.5 15:30:33 No1_Direction = Counter 15:30:33 No2_Direction = Reverse Is this possible?

Stevelim · ‎10-04-2018

My apologies, I realised I did not think deep enough about how it will appear in Splunk since I was originally working on it in Excel. So in Excel, I am able to just fit it columns but I forgot that in Splunk it will be associated with time. My end state is to be able to say do a search and create a time series chart of all the No = 1. | No = 1 and it should return me with something like: 15:30:33 OFFSET = 14,3 <- From first log file 15:30:33 OFFSET = 15.2 <- From second log file of similar format After which I can then append a | timechart avg(OFFSET) by No to see all the OFFSET. I hope it makes sense.

Stevelim · ‎10-04-2018

I have a raw data set that goes like this: Logtime: 20181010_15:30:34 ID: V12 ArrivalTime: 15:30:33 No OFFSET DIRECTION LOAD 1 14.3 Counter 100 2 14.5 Reverse100 ExitTime: 15:30:34 Max: 1000 MIN: 900 What will be the best way to parse this data using Splunk?

Stevelim · ‎03-01-2018

We now have a technical guide on how to send to Splunk Cloud here @ https://www.kepware.com/en-us/support/resource-library/technical-notes/sending-data-kepserverex-splunk-cloud/

Stevelim · ‎09-18-2017

I have tried this. The issue is that the data will appear as this: NameValue A = 1 B = 2 C = 3... I can of course do a mvexpand but I will like A,B,C to be the key for me to search easily meaning I can do this: | search A < 2 and so forth

Stevelim · ‎09-17-2017

I have base search that was able to get me to this form in Splunk: Name Value A 1 B 2 C 3 I need to create a new key value pair that goes A = 1, B = 2, C = 3 and so forth. Is this possible without regex?

Stevelim · ‎07-21-2016

| stats values(Realm) as Realm, values(Role) as Role

Stevelim · ‎07-14-2016

Hey, to list out unique values, you should look into stats command as well Base search to filter out the correct events | table_time | eval Date =strftime(_time, "%Y%m%d") | stats list(Date) Here's an example: index=* Value>60 | eval Date = strftime(_time, "%Y%m%d") | stats values(Date) as Date | mvexpand Date

Stevelim · ‎07-14-2016

Hey Sundaresh, I tried this out with a restart, I didnt notice anything. Also, i added the transforms.conf under etc/system/local Am I doing this right?

Stevelim · ‎07-13-2016

Not exactly sure how to phrase this, but how can I remodel my data input via Splunk? For example, my raw data looks like this: Tag= Parameter Value =2 Parameter = 2 in Splunk such that I can search for Parameter = Some Value

Stevelim · ‎07-12-2016

base search | appendcols [ search index=idx1 sourcetype=load host="*" ut=*|rename host as dns_name | table dns_name, ut ]

Stevelim · ‎07-12-2016

Yep, did that work?

Stevelim · ‎07-11-2016

For a clustered deployment, you should look into the deployer instead http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/PropagateSHCconfigurationchanges

Stevelim · ‎07-06-2016

You might want to use a case statement instead: input Lookup search | eval Results =case(count == 0, "Yes", count >= 0, "No") You can also refer to this quick reference: https://www.splunk.com/content/dam/splunk2/pdfs/solution-guides/splunk-quick-reference-guide.pdf

Stevelim · ‎06-24-2016

In case the SNMP Modular input dont work, check out Kepware's SNMP Driver. It is GUI driven, combined with the IDF, you can accquire and listen to the SNMP traps. https://www.kepware.com/products/kepserverex/drivers/snmp/

Stevelim · ‎06-23-2016

Are you using the default Splunk Map tiles? You can populate with the OSM Map tiles which allows you to zoom into a greater detail,

Posts	55
Solutions	6
Karma Given	12
Karma Received	5
Member Since	‎01-17-2015

Online Status	Offline
Date Last Visited	‎08-02-2023 10:37 PM

Why is there Windows Installation Rollback error?

Creating a table with chronological headers

Range Marker

Can you help me parse the following raw data set u...

Merging two sets of multivalue data in an order wi...

How to parse my sample raw data to so I can search...

What is this bar called? And how do I change the c...

Some form of Display for Counting Down

Recognizing Unicode

How to extract a key and value from the Raw data?

Re: Windows Installation Rollback error

Why is there Windows Installation Rollback error?

Re: Creating a table with chronological headers

Creating a table with chronological headers

Re: Range Marker

Range Marker

Re: How to exclude computer account name from resu...

Re: With the OPC Data Explorer app, how do I contr...

Re: Can you help me parse the following raw data s...

Re: Can you help me parse the following raw data s...

Re: Can you help me parse the following raw data s...

Can you help me parse the following raw data set u...

Re: How to configure Kepware IDF to send OPC data ...

Re: Merging two sets of multivalue data in an orde...

Merging two sets of multivalue data in an order wi...

Re: Consolidating table entries

Re: Dedup all redundant data in a column...having ...

Re: How to parse my sample raw data to so I can se...

How to parse my sample raw data to so I can search...

Re: How to join this search with our existing sear...

Re: How to add a new app from the deployment serve...

Re: How to add a new app from the deployment serve...

Re: How to use inputlookup to check if hosts in a ...

Re: SNMP Modular Input: Is it possible to listen f...

Re: How to map data locally on a map