Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About max8006
max8006
Explorer
Member since:
12-21-2018
03-06-2023
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 12-21-2018 |
Activity Feed
- Posted How can I apply split and regex TSV at the same time? on Splunk Search. 02-14-2023 02:44 AM
- Karma Re: Use Paessler PRTG Modular Input with Indexer Cluster for richgalloway. 02-03-2023 10:57 AM
- Karma Re: Use Paessler PRTG Modular Input with Indexer Cluster for richgalloway. 02-03-2023 10:57 AM
- Posted Re: Use Paessler PRTG Modular Input with Indexer Cluster on Getting Data In. 02-03-2023 07:07 AM
- Posted Is it possible to use Paessler PRTG Modular input with indexer cluster? on Getting Data In. 02-02-2023 05:32 AM
- Posted WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file on Splunk Search. 12-23-2018 09:35 AM
- Tagged WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file on Splunk Search. 12-23-2018 09:35 AM
- Posted Re: What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-23-2018 12:19 AM
- Posted Re: What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-22-2018 11:33 AM
- Posted Re: What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-22-2018 06:35 AM
- Posted Re: What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-21-2018 10:26 PM
- Posted What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-21-2018 01:03 PM
- Tagged What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-21-2018 01:03 PM
- Tagged What are the differences between monitoring a folder on a UF and monitor a folder local on the indexer? on Getting Data In. 12-21-2018 01:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-14-2023
02:44 AM
Hi, I have logs separated by a tab. I have defined FIELD_DELIMITER=tab, INDEXED_EXTRACTIONS=tsv FIELD_NAMES etc in props.conf accordingly. I now need to extract more fields in one of the fields using regex. What is the most sensible and efficient way to do this? Is it possible to do this in props.conf at the same time when tsv splitting happening? Or is there only the possibility to use "rex field=" @ searchtime BR Max
... View more
Labels
- Labels:
-
search job inspector
02-03-2023
07:07 AM
The problem is that the PRTG APP makes RESTAPI calls to get the data for indexing. I don't understand how this is supposed to work on the indexer itself. There must be some way for a HF to make these calls and send the information to the indexers. In the app, I can't select the indexes that are defined on the standalone indexers.
... View more
02-02-2023
05:32 AM
Hi,
I have a question if there is a possibility to use the APP Paessler PRTG Modular Input in a distributed indexer scenario. I can install the app on the SH, but how do I create the reference to the indexer cluster. I can only select the local index on the SH. Does that work with a heavy forwarder maybe?
Thanks,
max
... View more
Labels
- Labels:
-
heavy forwarder
-
index
12-23-2018
09:35 AM
Hello
I have a script that writes a log file of the current month. The information is exported from a database. It always writes the whole month. It does not matter if there are new entries or not. If there are new entries, they will be appended to the end of the file.
This log file is monitored by Splunk. I think the re reading takes place at the moment the script fills the line of the log file and is not finished, and at the same time Splunk checks the file and recognizes there is a difference.
My workaround is to copy the file to a different location when the script finishes exporting. And Splunk only checks the file at the new copy location. Now I do not have such reading errors anymore.
My question is whether my approach is right or if there is a better way. The problem I have is that I can not access the database directly.
thank you in advance
... View more
- Tags:
- splunk-enterprise
12-23-2018
12:19 AM
Very cool -> you can see that the indexer is actually the last place to place the props.conf.
... View more
12-22-2018
11:33 AM
Hi Valiquet!
It works - BUT i do not understand this. I always thought the UF only makes the input and has nothing to do with parsing, this is the job of the indexer or heavy forwarder.
Do you know which of the props parameters are the ones which make this work? - Is the full parsing made on the UF? -no?
Maybe you can explain it to me so that I will know it better - I start splunking one month ago. I like Splunk, but this problem takes me now 4 day - and was very frustrating.
Thanks a lot for helping!!!
Max
... View more
12-22-2018
06:35 AM
IDX-props.conf
C:\Program Files\Splunk\bin>splunk btool props list --debug tv:star2
C:\Program Files\Splunk\etc\apps\search\local\props.conf [tv:star2]
C:\Program Files\Splunk\etc\system\default\props.conf ADD_EXTRA_TIME_FIELDS = True
C:\Program Files\Splunk\etc\system\default\props.conf ANNOTATE_PUNCT = True
C:\Program Files\Splunk\etc\system\default\props.conf AUTO_KV_JSON = true
C:\Program Files\Splunk\etc\system\default\props.conf BREAK_ONLY_BEFORE =
C:\Program Files\Splunk\etc\system\default\props.conf BREAK_ONLY_BEFORE_DATE = True
C:\Program Files\Splunk\etc\system\default\props.conf CHARSET = AUTO
C:\Program Files\Splunk\etc\apps\search\local\props.conf DATETIME_CONFIG =
C:\Program Files\Splunk\etc\system\default\props.conf DEPTH_LIMIT = 1000
C:\Program Files\Splunk\etc\apps\search\local\props.conf FIELD_DELIMITER = ,
C:\Program Files\Splunk\etc\apps\search\local\props.conf FIELD_NAMES = id,detection_time,log,parameter_list,text_english,error,sequence,roc_name,file_name,error_position,error_host,ack_required,acknowledged,ack_time,based_on_id,ack_by_user,job_id,recipient,destination,sender,subject,computed_size,spool
C:\Program Files\Splunk\etc\apps\search\local\props.conf FIELD_QUOTE = '
C:\Program Files\Splunk\etc\system\default\props.conf HEADER_MODE =
C:\Program Files\Splunk\etc\apps\search\local\props.conf INDEXED_EXTRACTIONS = csv
C:\Program Files\Splunk\etc\apps\search\local\props.conf KV_MODE = none
C:\Program Files\Splunk\etc\system\default\props.conf LEARN_MODEL = true
C:\Program Files\Splunk\etc\system\default\props.conf LEARN_SOURCETYPE = true
C:\Program Files\Splunk\etc\system\default\props.conf LINE_BREAKER_LOOKBEHIND = 100
C:\Program Files\Splunk\etc\system\default\props.conf MATCH_LIMIT = 100000
C:\Program Files\Splunk\etc\system\default\props.conf MAX_DAYS_AGO = 2000
C:\Program Files\Splunk\etc\system\default\props.conf MAX_DAYS_HENCE = 2
C:\Program Files\Splunk\etc\system\default\props.conf MAX_DIFF_SECS_AGO = 3600
C:\Program Files\Splunk\etc\system\default\props.conf MAX_DIFF_SECS_HENCE = 604800
C:\Program Files\Splunk\etc\system\default\props.conf MAX_EVENTS = 256
C:\Program Files\Splunk\etc\system\default\props.conf MAX_TIMESTAMP_LOOKAHEAD = 128
C:\Program Files\Splunk\etc\system\default\props.conf MUST_BREAK_AFTER =
C:\Program Files\Splunk\etc\system\default\props.conf MUST_NOT_BREAK_AFTER =
C:\Program Files\Splunk\etc\system\default\props.conf MUST_NOT_BREAK_BEFORE =
C:\Program Files\Splunk\etc\apps\search\local\props.conf NO_BINARY_CHECK = true
C:\Program Files\Splunk\etc\apps\search\local\props.conf REPORT-star2_2 = REPORT-star2_2
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION = indexing
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION-all = full
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION-inner = inner
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION-outer = outer
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION-raw = none
C:\Program Files\Splunk\etc\system\default\props.conf SEGMENTATION-standard = standard
C:\Program Files\Splunk\etc\apps\search\local\props.conf SHOULD_LINEMERGE = False
C:\Program Files\Splunk\etc\apps\search\local\props.conf TIMESTAMP_FIELDS = detection_time
C:\Program Files\Splunk\etc\apps\search\local\props.conf TIME_FORMAT = %Y-%m-%d%H:%M:%S.%3Q
C:\Program Files\Splunk\etc\system\default\props.conf TRANSFORMS =
C:\Program Files\Splunk\etc\system\default\props.conf TRUNCATE = 10000
C:\Program Files\Splunk\etc\apps\search\local\props.conf category = Custom
C:\Program Files\Splunk\etc\apps\search\local\props.conf description = Comma-separated value format. star2 Eventlog
C:\Program Files\Splunk\etc\system\default\props.conf detect_trailing_nulls = auto
C:\Program Files\Splunk\etc\apps\search\local\props.conf disabled = false
C:\Program Files\Splunk\etc\system\default\props.conf maxDist = 100
C:\Program Files\Splunk\etc\system\default\props.conf priority =
C:\Program Files\Splunk\etc\apps\search\local\props.conf pulldown_type = true
C:\Program Files\Splunk\etc\system\default\props.conf sourcetype =
SH - inputs.conf
C:\Program Files\SplunkUniversalForwarder\etc\apps\uf_star2_srv\local\inputs.conf [monitor://C:\TV\star2_LOG\*_TV.csv]
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf _rcvbuf = 1572864
C:\Program Files\SplunkUniversalForwarder\etc\apps\uf_star2_srv\local\inputs.conf disabled = false
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dc_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_dns_name =
C:\Program Files\SplunkUniversalForwarder\etc\system\default\inputs.conf evt_resolve_ad_obj = 0
C:\Program Files\SplunkUniversalForwarder\etc\apps\uf_star2_srv\local\inputs.conf host = TV_TEST
C:\Program Files\SplunkUniversalForwarder\etc\apps\uf_star2_srv\local\inputs.conf index = tv
C:\Program Files\SplunkUniversalForwarder\etc\apps\uf_star2_srv\local\inputs.conf sourcetype = tv:star2
... View more
12-21-2018
10:26 PM
btool output props.conf on IDX
[tv:star2]
ADD_EXTRA_TIME_FIELDS = True
ANNOTATE_PUNCT = True
AUTO_KV_JSON = true
BREAK_ONLY_BEFORE =
BREAK_ONLY_BEFORE_DATE = True
CHARSET = AUTO
DATETIME_CONFIG =
DEPTH_LIMIT = 1000
FIELD_DELIMITER = ,
FIELD_NAMES = id,detection_time,log,parameter_list,text_english,error,sequence,roc_name,file_name,error_position,error_host,ack_required,acknowledged,ack_time,based_on_id,ack_by_user,job_id,recipient,destination,sender,subject,computed_size,spool
FIELD_QUOTE = '
HEADER_MODE =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LEARN_MODEL = true
LEARN_SOURCETYPE = true
LINE_BREAKER_LOOKBEHIND = 100
MATCH_LIMIT = 100000
MAX_DAYS_AGO = 2000
MAX_DAYS_HENCE = 2
MAX_DIFF_SECS_AGO = 3600
MAX_DIFF_SECS_HENCE = 604800
MAX_EVENTS = 256
MAX_TIMESTAMP_LOOKAHEAD = 128
MUST_BREAK_AFTER =
MUST_NOT_BREAK_AFTER =
MUST_NOT_BREAK_BEFORE =
NO_BINARY_CHECK = true
REPORT-star2_2 = REPORT-star2_2
SEGMENTATION = indexing
SEGMENTATION-all = full
SEGMENTATION-inner = inner
SEGMENTATION-outer = outer
SEGMENTATION-raw = none
SEGMENTATION-standard = standard
SHOULD_LINEMERGE = False
TIMESTAMP_FIELDS = detection_time
TIME_FORMAT = %Y-%m-%d%H:%M:%S.%3Q
TRANSFORMS =
TRUNCATE = 10000
category = Custom
description = Comma-separated value format. star2 log
detect_trailing_nulls = auto
disabled = false
maxDist = 100
priority =
pulldown_type = true
sourcetype =
btool output inputs.conf on UF
[monitor://C:\TV\star2_LOG\*_TV.csv]
_rcvbuf = 1572864
disabled = false
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = TV_TEST
index = tv
sourcetype = tv:star2
... View more
12-21-2018
01:03 PM
Hi
I have the problem that I have different parsing results when I monitor a file (csv) on a universal forwarder or local on the SH+Indexer.
Local on the SH+Indexer the parsing with the field name assignment/extraction works.
When the same file was read by the UF and sent to the SAME Sourcetype the result is different - no fieldnames are applied. I think there is no parsing happening?
I think the config problem is on the UF. I only put there a inputs.conf with (monitor --> sourcetype + host and index)
Maybe someone can help me out?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2023
07:02 AM
|
