This widget could not be displayed.
This widget could not be displayed.
- " class="nav-category">Office Hours: Ask the Experts
- This widget could not be displayed.
- " class="nav-category">Splunk Development
This widget could not be displayed.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spellanser
spellanser
Explorer
Member since:
01-31-2016
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 01-31-2016 |
Activity Feed
- Karma When will Splunk Enterprise 8.0.1 be released? for isbjorn. 06-05-2020 12:50 AM
- Karma Re: When will Splunk Enterprise 8.0.1 be released? for ffloimair. 06-05-2020 12:50 AM
- Karma Re: When will Splunk Enterprise 8.0.1 be released? for dfgrtKJH. 06-05-2020 12:50 AM
- Karma Is there a way to create a parsing logic that takes heading in the log as the name of the splunk field ? for Hemnaath. 06-05-2020 12:49 AM
- Karma Re: How to prevent splunk from merging few JSON strings into single event? for s2_splunk. 06-05-2020 12:49 AM
- Karma Re: Prevent warning from splunk CLI then running "splunk apply shcluster-bundle" for adonio. 06-05-2020 12:48 AM
- Karma Re: Decode indexer name hashes (GUID) from license_usage.log for Jason. 06-05-2020 12:46 AM
- Posted Re: When will Splunk Enterprise 8.0.1 be released? on Splunk Enterprise Security. 12-09-2019 02:47 AM
- Posted Re: When will Splunk Enterprise 8.0.1 be released? on Splunk Enterprise Security. 12-08-2019 11:00 PM
- Posted Re: Is there a way to create a parsing logic that takes heading in the log as the name of the splunk field ? on Getting Data In. 06-25-2019 05:19 AM
- Posted Re: Is there a way to create a parsing logic that takes heading in the log as the name of the splunk field ? on Getting Data In. 06-25-2019 03:54 AM
- Posted Re: What is the optimum value for maxThreads and maxSockets when configuring server.conf? on Deployment Architecture. 02-11-2019 06:54 AM
- Posted Re: How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-02-2018 06:06 AM
- Posted Re: How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 08-02-2017 02:32 AM
- Posted How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-31-2017 10:05 AM
- Tagged How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-31-2017 10:05 AM
- Tagged How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-31-2017 10:05 AM
- Tagged How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-31-2017 10:05 AM
- Tagged How to prevent splunk from merging few JSON strings into single event? on Getting Data In. 07-31-2017 10:05 AM
- Posted Re: Prevent warning from splunk CLI then running "splunk apply shcluster-bundle" on Deployment Architecture. 04-15-2017 06:26 AM
Topics I've Started
12-09-2019
02:47 AM
Thank you for answer!
... View more
12-08-2019
11:00 PM
@s2_splunk @bosburn_splunk @ppablo_splunk @esix_splunk
Hello!
May be you can help us to clarify something about 8.0.1 release date?
It's very important information, due to the critical bug: https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/FixDatetimexml2020
We should update our installations while we still have some time or downgrade our cluster version.
... View more
06-25-2019
05:19 AM
Yes, of course you can.
But If somehow the log format will change or you will enable new security audits with new event types, then you should rewrite all of your custom field extraction rules.
I think it is bad to maintain manual field extractions for such type of log.
... View more
06-25-2019
03:54 AM
Same problem. It's very confusing to see such way to parse wineventlogs.
We bypassing this issue with mvexpand hack.
... View more
02-11-2019
06:54 AM
Where is no recommendations, just described the defaults values calculation.
... View more
07-02-2018
06:06 AM
Thank you, will try it!
... View more
08-02-2017
02:32 AM
Thank you for answer. I was confused with this in wiki article, which you mentioned:
Since splunk 6, some source can be parsed for structured data (like headers, or json) and be populated at the forwarder level. see http://docs.splunk.com/Documentation/Splunk/6.1.2/Data/Extractfieldsfromfileheadersatindextime#Forwa... Those setting have to be on the forwarders (and indexers if they monitor files)
Looks like it's not work at all.
Also i have question, what is the right way to distribute props.conf to indexers on cluster of Splunk Enterprise? Using master and master-apps or creating new custom application?
... View more
07-31-2017
10:05 AM
Example raw data:
{"field1": "value1", "field2": "value2", ..., "string": "1" }
{"field1": "value1", "field2": "value2", ... ,"string":"2"}
{"field1": "value1", "field2": "value2", ..., "string":"3" }
{"field1": "value1", "field2": "value2", ..., "string":"4" }
Splunk merge few of raw data string into single event, as result you got 2 events.
Event 1:
{"field1": "value1", "field2": "value2", ..., "string": "1" }
{"field1": "value1", "field2": "value2", ... ,"string":"2"}
{"field1": "value1", "field2": "value2", ..., "string":"3" }
Event 2:
{ [-]
field1: value1
field2: value2
...
string: 4
}
So, 80% of events looks like event 1 in example. But some events caught by single row and parsed as JSON type.
Using cluster of Splunk Enterprise and splunkforwarder for data delivery, version 6.5.5.
I have tried to setup props.conf on splunkforwarder (app which work with JSON log files), tried to use different LINE_BREAKER:
1. (\})
2. \}
3. "(^)\{"
Current props.conf:
[json-logs]
SHOULD_LINEMERGE = false
KV_MODE = json
LINE_BREAKER = (\})
TIME_PREFIX = \"time\": \"
Have same problem not only with JSON format logs, looks like props.conf line breaking options not work at all.
What I am doing wrong?
... View more
04-15-2017
06:26 AM
Thank you guys!
... View more
04-14-2017
05:52 AM
Hi!
Then running splunk apply shcluster-bundle -target https://host.com:8089 it always return warning:
Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]:
How get rid of this warning? Or force yes it with CLI flag? It's required, to run this command from script.
Thanks!
... View more
