About carljohan

carljohan · ‎10-19-2015

Thank you for your feedback. The data from the different operations need to be separated due to contractual reasons. Any suggestion on how we can accomplish that in a less strange (bad) way?

carljohan · ‎10-19-2015

Thanks Muebei. But that would require us to do a full Splunk install on the DB servers, not only a universal forwarder. Right?

carljohan · ‎10-19-2015

We are planning to have a Splunk setup where we have: 1 server running a Splunk indexer 2 servers per operation from which log files are forwarded by universal indexers We are then planing to store each operations index on the operations own server instead of on the Splunk indexer. All servers are on the same network. Is this setup doable?

carljohan · ‎09-29-2014

I found a solution for my problem. Set earliest=@d+6h to accommodate for the timezone difference to start off day. Then move the events 6 hours by adding eval _time=_time-21600. Works like a charm for me! Example: sourcetype=events earliest=@d+6h| eval _time=_time-21600|timechart c

carljohan · ‎09-25-2014

Im trying to create a dashboard like the one below. But I want the events that happen in New York to appear in local New York time and the ones that happen in Singapore to appear in local Singapore time. Now the New York events appear with 6 hours delay. So yesterday evenings event (in local New York time) appear to have happened today.

carljohan · ‎09-24-2014

I think my timezones are configured correctly. A user configured with UTC-4 on his account is sees events in UTC-4 correctly. But it seems like UTC+4 events are translated to the local time of the user account. Example: User 1 has an account configured to UTC +4. An event which takes place 2014-09-24 09:00 AM in UTC -4 is displayed as 4:00 PM for that user. User 2 has an account configured to UTC -4. An event which takes place 2014-09-24 09:00 AM in UTC -4 is displayed as 09:00 AM for that user.

carljohan · ‎09-24-2014

I have a dashboard with two panels. Panel 1 displays todays events for an index with timezone UTC +4 Panel 2 displays todays events for an index with timezone UTC -4 I would like for both panels to display events 00:00 - 23:59 in the local timezone. The problem is that my account is in UTC +4 timezone. So it does not show me only today in the UTC -4 panel but also parts of yesterday. How do I solve it?

carljohan · ‎08-15-2014

Yes I am using a textbox. The logs are in 999763206619 format and the input is in 0763206619 format. The query you provided works when I try it in a search field but not in my custom app with the textfield input.

carljohan · ‎08-12-2014

carljohan · ‎08-12-2014

I am not getting it to work. Can I share something which would display the outcome and help you understand why? This is the search I am performing: index=* sourcetype=sms [|gentimes start=-1 | eval msisdn="0763206619" | eval msisdn="999".ltrim(msisdn,"0") | fields msisdn] |table _time, msisdn, sms

carljohan · ‎08-12-2014

Where in the following search query should I add the regex? index=* event="*" msisdn="$customer_msisdn$" |table _time, msisdn, sms

carljohan · ‎08-07-2014

I have tried the following but it did not work: msisdn="0123456789"| eval msisdn=substr(msisdn,2)|eval msisdn="999".msisdn|table _time, msisdn, sms

carljohan · ‎08-07-2014

I have created an app which has a single input for MSISDN. The user enters the MSISDN in local 10-digit format ex: 0123456789 The events in my logs are in international format ex: 999123456789 So I need to remove the leading 0 and add 999 to the input prior conducting the search. I have no idea how to do this so all help is appreciated.

carljohan · ‎03-28-2014

Thanks MuS! With some modifications of your search the solution is: index=_internal message ="yes" OR message ="no"| eval message=lower(message) | eventstats count(eval(message ="yes")) as yes_count count(eval(message ="no")) as no_count by msisdn | where yes_count>0 AND no_count>0 | table _time, msisdn, message

carljohan · ‎03-28-2014

Hi MuS This gave me all msisdn that sent either: yes no yes or no I only want msisdn that send yes and no.

carljohan · ‎03-28-2014

I have a logfile in the following format: [2014-27-03 20:57:15.875 CST] [receivedSmsFileLogger] - message = "Yes", msisdn = "00000000" [2014-27-03 21:06:21.787 CST] [receivedSmsFileLogger] - message = "Yes", msisdn = "11111111" [2014-27-03 21:10:28.529 CST] [receivedSmsFileLogger] - message = "Yes", msisdn = "22222222" [2014-27-03 21:30:51.651 CST] [receivedSmsFileLogger] - message = "No", msisdn = "11111111" [2014-27-03 21:47:39.900 CST] [receivedSmsFileLogger] - message = "Yes", msisdn = "33333333" I would like to find any msisdn which sent both yes and no in the same day and display them like: 2014-27-03 21:06:21.787 CST] [receivedSmsFileLogger] - message = "Yes", msisdn = "11111111" 2014-27-03 21:30:51.651 CST] [receivedSmsFileLogger] - message = "No", msisdn = "11111111" Any suggestions on how that search query would be written? UPDATE: Solution as per MuS answer: index=_internal message ="yes" OR message ="no"| eval message=lower(message) | eventstats count(eval(message ="yes")) as yes_count count(eval(message ="no")) as no_count by msisdn | where yes_count>0 AND no_count>0 | table _time, msisdn, message

carljohan · ‎11-14-2013

They are indexed on the local splunk instance. No forwarders are included in the setup.

carljohan · ‎11-14-2013

I tried with ^ERROR which gives me the following transforms.conf and restarted Splunk but it did not work. [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = ^ERROR DEST_KEY = queue FORMAT = indexQueue

carljohan · ‎11-14-2013

I posted the complete .conf content. What should I change in the REGEX?

carljohan · ‎11-14-2013

I have a log file namned: wrapper.log This log file has two different type of events defined with the prefix INFO or ERROR. I want to index only the ERROR events but am not getting it to work. Im on a mac. Here is my log file: ERROR | jvm 1 | 2013/05/03 10:47:52 Test_error INFO | jvm 1 | 2013/05/03 10:48:52 Test ERROR | jvm 1 | 2013/05/03 10:49:52 Test_error INFO | jvm 1 | 2013/05/03 10:50:52 Test ERROR | jvm 1 | 2013/05/03 10:51:52 Test_error INFO | jvm 1 | 2013/05/03 10:52:52 Test ERROR | jvm 1 | 2013/05/03 10:53:52 Test_error inputs.conf: [monitor:///Users/carljohan/logs/wrapper.log] disabled=false sourcetype = ESB_Wrapper props.conf: [ESB_Wrapper] SHOULD_LINEMERGE=false LINE_BREAKER = ([\r\n]+)[0-9]+-[0-9]+-[0-9]+\s+ TIME_FORMAT = %Y/%m/%d %H:%M:%S,%3N TRANSFORMS-set= setnull,setparsing tranfsforms.conf [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = (\W|^)ERROR(\W|$) DEST_KEY = queue FORMAT = indexQueue With this setup all events are still being indexed. What am I doing wrong?

carljohan · ‎10-13-2011

Thanks Ayn, I have looked at xmlkv but cant get it to work. Can you give me a example of how i would use it to extract the ResultCode?

carljohan · ‎10-13-2011

Hi, I have a logfile with the following syntax: 2011-10-13 09:34:29,309 [-] [HttpClientWorker-9] INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg"> <ResultHeader xmlns=""> <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId> <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version> <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId> <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId> <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode> <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc> </ResultHeader> <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" /> </AdjustAccountResultMsg></soapenv:Body> How do I get the SequenceId, ResultCode and ResultDesc values?

Posts	22
Solutions	1
Karma Given	12
Karma Received	2
Member Since	‎07-27-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Run indexes on different servers

One dashboard with multiple timezones

Manipulating inputs prior search in app

Find results based on field value of 2 events

Index selected events of log file

Collect values from semi-xml log

Re: Run indexes on different servers

Re: Run indexes on different servers

Run indexes on different servers

Re: One dashboard with multiple timezones

Re: One dashboard with multiple timezones

Re: One dashboard with multiple timezones

One dashboard with multiple timezones

Re: Manipulating inputs prior search in app

Re: Manipulating inputs prior search in app

Re: Manipulating inputs prior search in app

Re: Manipulating inputs prior search in app

Re: Manipulating inputs prior search in app

Manipulating inputs prior search in app

Re: Find results based on field value of 2 events

Re: Find results based on field value of 2 events

Find results based on field value of 2 events

Re: Index selected events of log file

Re: Index selected events of log file

Re: Index selected events of log file

Index selected events of log file

Re: Collect values from semi-xml log

Collect values from semi-xml log

Are you a member of the Splunk Community?