Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About lmarcel
lmarcel
New Member
Member since:
07-25-2013
Friday
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-25-2013 |
Activity Feed
- Posted Re: Cisco Network app and WLC9800 on All Apps and Add-ons. Friday
- Posted Cisco Network app and WLC9800 on All Apps and Add-ons. Thursday
- Posted Re: Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 04:10 PM
- Posted Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Tagged Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Tagged Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Tagged Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Tagged Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Tagged Syslog data inputs not creating new sources on Getting Data In. 11-07-2013 01:48 PM
- Posted Re: Sort 12-hour based date/time on Splunk Search. 10-28-2013 11:52 AM
- Posted Re: Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:53 AM
- Posted Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:12 AM
- Tagged Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:12 AM
- Tagged Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:12 AM
- Tagged Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:12 AM
- Tagged Sort 12-hour based date/time on Splunk Search. 10-28-2013 10:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
Friday
Thanks for your reply. I do not get any results when I run the search because the product field ends up being IOS, not WLC, so that's what I have to solve. The Cisco Catalyst add-on version 3.0.0.0 is installed. I'll look more into this after the weekend.
... View more
Thursday
The Cisco Network app does not populate the wireless dashboard with the info sent by our Cisco 9800 Wireless LAN Controller. It can search the index and the source type is set to cisco:ios. The controller is listed in Inventory>Devices and events are listed. So my guess is that the app can't tell that it's a wireless controller because it runs ios-xe like our switches. Is there a way to tag the messages sent by the controller for it to be recognized as such? Thanks. Example message 1/15/26 11:29:15.000 AM Jan 15 11:29:15 <redacted> 1093873: Jan 15 11:29:14.002 PST: %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: Chassis 1 R0/0: wncd: Username entry (<redacted>) joined with ssid (<redacted>) for device with MAC: 105f.ad94.9dff on channel (64) host = <redacted> source = WLC9800 sourcetype = cisco:ios
... View more
Labels
- Labels:
-
dashboard
-
troubleshooting
11-07-2013
04:10 PM
Thanks for your reply. It turns out to be a GUI problem (in my view) because if I just search for index=ecb or index=network, I can see all the data, properly indexed!
I am just used to go to the Search app, and click on the Data Summary button to select the source or host I want to look at. Apparently the Data Summary window is not updating for me. But the data is being received and indexed, that's all I wanted.
... View more
11-07-2013
01:48 PM
I used to have 2 UDP syslog data inputs: UDP://514 going to the default index, UDP://515 going to a new index. They were successfully collecting syslog messages from network equipment. I noticed yesterday that they haven't indexed anything for a while. Disabling and re-enabling the data inputs briefly allowed some messages to be indexed but then it stopped again.
Today I deleted both data inputs and entered new ones.
Splunk\etc\apps\search\local\inputs.conf shows this:
[udp://514]
connection_host = ip
sourcetype = syslog
disabled = 0
index = network
source = Network
[udp://49200]
connection_host = ip
index = ecb
sourcetype = syslog
source = EmergencyCallBox
In the Search app, when I click on the Data Summary button, the Network and EmergencyCallBox sources I'm expecting are not listed, the syslog sourcetype is not updated. I still see udp:514 listed as a source.
I'm using Splunk 6.0 on Windows 2008 R2. Rebooting the OS and Splunk didn't help.
If I run index=_internal source=*metrics.log* per_source_thruput series=EmergencyCallBox I see results ( series=Network also gives me results).
Do I have to manually create the source and sourcetype? If so, where?
Any suggestions are welcome.
... View more
10-28-2013
11:52 AM
For the sake of completion, here is what I ended up using:
index=eaccess Card_Name="John*"
| rename _time as Date/Time
| fieldformat Date/Time = strftime('Date/Time',"%m/%d/%y %I:%M:%S %p")
| table Date/Time, Location
| sort Date/Time
If the sort command is left out, clicking on the table header won't change the sorting order.
... View more
10-28-2013
10:53 AM
Thank you very much, I didn't realize that the output of convert() was a string. It's working now. Thanks!
... View more
10-28-2013
10:12 AM
I have a dashboard table based on the search:
index=eaccess Card_Name="John*"
| convert timeformat="%m/%d/%y %I:%M:%S %p" ctime(_time) as Date/Time
| table Date/Time, Location | sort -Date/Time
The Date/Time field displays correctly but when clicking on the header to sort, the AM/PM part of the date/time is not taken into account, e.g.: 01:59:29 PM comes before 06:45:15 AM which comes before 12:58:10 PM.
If the sort command not able to handle 12-hour time format?
Any help would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
