Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sunnyb147
sunnyb147
Path Finder
Member since:
02-05-2019
03-25-2021
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-05-2019 |
Activity Feed
- Posted Re: Issues with multiline events props.conf on Getting Data In. 03-22-2021 04:19 AM
- Posted Re: Issues with multiline events props.conf on Getting Data In. 03-20-2021 03:40 AM
- Posted Issues with multiline events props.conf on Getting Data In. 03-19-2021 11:20 AM
- Tagged Issues with multiline events props.conf on Getting Data In. 03-19-2021 11:20 AM
- Tagged Issues with multiline events props.conf on Getting Data In. 03-19-2021 11:20 AM
- Tagged Issues with multiline events props.conf on Getting Data In. 03-19-2021 11:20 AM
- Tagged Issues with multiline events props.conf on Getting Data In. 03-19-2021 11:20 AM
- Karma Re: Transaction shows incomplete statistics for DavidHourani. 06-05-2020 12:50 AM
- Posted Re: Unable to start Splunk forwarder on Getting Data In. 07-12-2019 06:15 AM
- Posted Re: Is there any option in Splunk to run a search in a loop? on Splunk Search. 07-12-2019 05:51 AM
- Posted Re: Is there any option in Splunk to run a search in a loop? on Splunk Search. 07-01-2019 12:51 AM
- Posted Re: Is there any option in Splunk to run a search in a loop? on Splunk Search. 07-01-2019 12:27 AM
- Posted Is there any option in Splunk to run a search in a loop? on Splunk Search. 06-27-2019 02:40 AM
- Tagged Is there any option in Splunk to run a search in a loop? on Splunk Search. 06-27-2019 02:40 AM
- Tagged Is there any option in Splunk to run a search in a loop? on Splunk Search. 06-27-2019 02:40 AM
- Tagged Is there any option in Splunk to run a search in a loop? on Splunk Search. 06-27-2019 02:40 AM
- Tagged Is there any option in Splunk to run a search in a loop? on Splunk Search. 06-27-2019 02:40 AM
- Posted Re: Transaction shows incomplete statistics on Splunk Search. 06-27-2019 02:33 AM
- Posted Re: Transaction shows incomplete statistics on Splunk Search. 06-27-2019 02:30 AM
- Posted Re: Transaction shows incomplete statistics on Splunk Search. 06-27-2019 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-22-2021
04:19 AM
@scelikok Thanks for the suggestion but still the event which is being ingested is broken. {
"transaction-id" : "novotel-123",
"usecase-id" : "123",
"timestamp" : "2021-03-22T06:51:27,188+0100",
"timestamp-out" : "2021-03-22T06:51:27,188+0100",
"component" : "A",
"payload" : "{\"error\":\"Internal server error\",\"message\":\"Internal server error\",\"description\":\"The server encountered an unexpected condition that prevented it from fulfilling the request\"}",
"country-code" : "IN",
"status" : "error",
"error-code" : "500",
"error" : "Internal Server Error",
"caller-id" : "",
"message-size" : 176,
"logpoint" : "response-out"
} I appended above event in the log file but over index I received broken one: {
"transaction-id" : "novotel-123",
"usecase-id" : "123",
"timestamp" : "2021-03-22T06:51:27,188+0100",
"timestamp-out" : "2021-03-22T06:51:27,188+0100",
"component" : "A",
Collapse
... View more
03-20-2021
03:40 AM
@to4kawa Thanks for your response, but unfortunately its still the same, the event which is being ingested is broken. I tried changing the limit of MAX_EVENTS but then too it is not helping 😕
... View more
03-19-2021
11:20 AM
Hi Everyone, Requesting small help with configuring props.conf which can help me to break the multiline events correctly. These are two types of events which I am trying to ingest for the first one either a part is being ingested or the event is broken for the second one(in a single line) that is ingesting without any issues. I tried below props.conf but no luck, I am just a newbie therefore requesting your help. For BREAK_ONLY_BEFORE I added the rex so that it can capture and break both types of events. [testing]
BREAK_ONLY_BEFORE={(\s+|)"transaction-id"(\s+|):(\s+|)"
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=1
TRUNCATE=0
MAX_EVENTS=1024 {
"transaction-id" : "steve-123",
"usecase-id" : "123",
"timestamp" : "2021-03-07T06:51:27,188+0100",
"timestamp-out" : "2021-03-07T06:51:27,188+0100",
"component" : "A",
"payload" : "{\"error\":\"Internal server error\",\"message\":\"Internal server error\",\"description\":\"The server encountered an unexpected condition that prevented it from fulfilling the request\"}",
"country-code" : "IN",
"status" : "error",
"error-code" : "500",
"error" : "Internal Server Error",
"message-size" : 176,
"logpoint" : "response"
}
{"transaction-id":"steve-456","usecase-id":"456","timestamp":"2021-03-07T06:51:27,188+0100","timestamp-out":"2021-03-07T06:51:27,188+0100","component":"B","payload":"{\"error\":\"Internalservererror\",\"message\":\"Internalservererror\",\"description\":\"The server encountered an unexpected condition that prevented it from fulfilling the request\"}","country-code":"IN","status":"error","error-code":"500","error":"Internal Server Error","message-size":176,"logpoint":"response"} Thanks, Sunny
... View more
Labels
- Labels:
-
props.conf
07-12-2019
06:15 AM
Could you please share some more information from splunkd.log
Could be a possibility something is wrong with log.cfg file < PATH: $SPLUNK_HOME/etc/log.cfg >
... View more
07-12-2019
05:51 AM
Found the solution without using loop, and its working fine.
Instead of doing, dedup then counting the unique transactions.. counted distinct count of transactions.
... View more
07-01-2019
12:51 AM
Hi @skalliger,
Thanks for your feedback, The main issue here is if I use 7 days in time-picker or by earliest/latest and dedup the transaction-id it doesn't give me correct count reason being some transaction-ids are being duplicated over multiple dates.
Example: If I search for a unique count on 30th of June 2019 the count is 515 but if I select the tenure of 7 days it gives me a count of 483 for 30th of June 2019.
What I am looking for: Is to have a while loop or for loop in which if I pass this query then it should take the date via date_mday field and extract the results and further append that in the csv file.
Thanks,
Sunny
... View more
07-01-2019
12:27 AM
Hi @amitm05 ,
Thanks for your feedback, let me try explaining the scenario, basically what I am up-to:
If I run above query , it will give me a unique count of all transaction-ids for a specific day which I select in time-picker.
And if I add this thing in the cron schedule, it will append the file on daily basis.
What I want is, to have a while loop or for loop in which if I pass this query then it should take the date via date_mday field and extract the results and further append that in the csv file.
The main issue here is if I use 7 days in time-picker and dedup the transaction-id it doesn't give me correct count reason being some transaction-ids are being duplicated over multiple dates.
Example: If I search for a unique count on 30th of June 2019 the count is 515 but if I select the tenure of 7 days it gives me a count of 483 for 30th of June 2019.
I tried using MAP and FOREACH but didn't got what I was looking for.
Thanks,
Sunny
... View more
06-27-2019
02:40 AM
Hi All, Good morning,
Is there any option in Splunk to run a search in a loop?
Basically what I want to say is I have a search which is producing some result in a tabular format and further I am piping that in a CSV file, a single iteration is working fine.
But I want to run that search lets say for 7 days based on date_mday, so I was wondering if there is a way like for loop kind of a thing so that every time when the search is executed it appends the output to a csv file.
Sample search:
index=test1 country=india
| dedup txn-id| stats count(txn-id) as unique_txns by date_mday, date_month
| table date_mday, date_month, unique_txns
| outputlookup append=true sunny_test.csv
Any help/guidance would be really appreciated.
Thanks,
Sunny
... View more
06-27-2019
02:30 AM
Thanks David for the feedback 🙂 Today morning I realized the same thing and it worked like a charm.
... View more
06-27-2019
12:49 AM
I think I found the solution, instead of eventstats I used stats and it worked 🙂
Another small question: I cannot mark this question as closed.. could you please guide me on this.
... View more
06-25-2019
05:21 AM
Hi All,
I am trying to group the events using transaction command but looks like some of the data is not visible in the statistics.
Are there any limit kind of a thing which we can set?
If I run below search for lets say a day or two it works fine, but if I run this search for 7 days it shows the result just for 5 days.
Sample search:
(index=test1 logpoint="request-in") OR (index=test1 logpoint="response-in")
| transaction transaction-id startswith="request-in" endswith="response-in" maxevents=2 keeporphans=true
| eval epoch_time=strptime('timestamp-in',"%Y-%m-%dT%H:%M:%S.%N")
| eventstats range(epoch_time) as response_time by transaction-id
| timechart span=1d avg(response_time) as average_duration
Any help would be highly appreciated.
Thanks,
Sunny
... View more
02-05-2019
05:07 AM
How to maintain data integrity in Splunk Index? I mean to say is there any white-listing of servers that only specific servers are allowed to forward the data to specific index?
For example: I have two indexes index_test1 and index_test2 and have 4 servers (A,B,C,D) configured to forward the data. I want only servers A and B should send the data to index_test1 and B & C should send the data to index_test2.
Sample stanza:
[monitor:////var/log/test/app/test.log]
index=index_test1
sourcetype = test_Log
source = test_log_f1
disabled = 0
Reason why I am looking for it is, lets say if someone made a typo then the intended data will be pushed to incorrect/wrong index.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-25-2021
07:45 AM
|
