Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yasinmoha
yasinmoha
Path Finder
Member since:
04-11-2016
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 3 |
| Member Since | 04-11-2016 |
Activity Feed
- Got Karma for The Splunk search shows that events exist, but why does the Events tab show "No results found"?. 06-05-2020 12:48 AM
- Got Karma for The Splunk search shows that events exist, but why does the Events tab show "No results found"?. 06-05-2020 12:48 AM
- Got Karma for The Splunk search shows that events exist, but why does the Events tab show "No results found"?. 06-05-2020 12:48 AM
- Karma Re: Concatenate fields into a single string for bbingham. 06-05-2020 12:46 AM
- Karma Re: couldn't send SIGTERM to pid 5632: Operation not permitted for adityapavan18. 06-05-2020 12:46 AM
- Posted Re: Add Picture to Dashboard on Dashboards & Visualizations. 08-31-2016 07:26 AM
- Posted Re: Confuguring events for AS400 logs on Getting Data In. 08-12-2016 01:09 PM
- Posted Re: Confuguring events for AS400 logs on Getting Data In. 08-09-2016 05:42 AM
- Posted Re: Confuguring events for AS400 logs on Getting Data In. 08-09-2016 02:14 AM
- Posted Re: Confuguring events for AS400 logs on Getting Data In. 08-09-2016 01:10 AM
- Posted Confuguring events for AS400 logs on Getting Data In. 08-08-2016 11:11 PM
- Tagged Confuguring events for AS400 logs on Getting Data In. 08-08-2016 11:11 PM
- Tagged Confuguring events for AS400 logs on Getting Data In. 08-08-2016 11:11 PM
- Tagged Confuguring events for AS400 logs on Getting Data In. 08-08-2016 11:11 PM
- Posted Re: How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 05-02-2016 06:36 AM
- Posted Re: How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 04-28-2016 10:50 PM
- Posted How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 04-28-2016 05:34 AM
- Tagged How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 04-28-2016 05:34 AM
- Tagged How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 04-28-2016 05:34 AM
- Tagged How do I configure proper line breaking for my sample multiline event in Splunk 6.4? on Getting Data In. 04-28-2016 05:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 3 | |||
| 0 |
08-31-2016
07:26 AM
Hi...
I am using splunk 6.4.3 I used the code as below but the image is not loading.
<row>
<html>
<img src="/opt/splunk/Pictures/logo.png"/>
</html>
</row>
... View more
08-12-2016
01:09 PM
Made a few changes under the advanced tab while ingesting the data
SHOULD_LINEMERGE=True
BREAK_ONLY_BEFORE=^\S
MAX_EVENTS=2
And then the event breaking got configured properly.
... View more
08-09-2016
05:42 AM
Hi...
I am trying to create a single event for every 2 lines of the log. When I ingest to splunk it some times take 1 or 2 or 3 lines as a single event. like below
Event 1
5761SS1 V6R1M0 080215 History Log Page 0001
MSGID SEV MSG TYPE
Event 2
CPF1124 00 INFO Job 252582/QTMHHTTP/QIWIRELESS started on 07/04/16 at 00:00:21 in subsystem QHTTPSVR in QHTTPSVR. Job ent
QIWIRELESS QTMHHTTP 252582 QWTPIIPP 0000 07/04/16 00:00:22.002029 QTMHHTTP
Event 3
CPF1164 00 COMPLETION Job 252582/QTMHHTTP/QIWIRELESS ended on 07/04/16 at 00:00:22; .034 seconds used; end code 0
QIWIRELESS QTMHHTTP 252582 QWTMCEOJ 0000 07/04/16 00:00:22.701533 QTMHHTTP
Event 4
CPF1124 00 INFO Job 252583/QPM400/Q1PDR started on 07/04/16 at 00:00:23 in subsystem QSYSWRK in QSYS. Job entered system
Q1PDR QPM400 252583 QWTPIIPP 0000 07/04/16 00:00:23.286025 QPM400
... View more
08-09-2016
02:14 AM
I have ingested this log in splunk but at some places it take 1 line as event and at some places it takes 2 or 3 lines as the event.
An event spans over 2 lines so I am trying to create a single event for every two lines. In the UI I gave the regex .\n. but it picks up 257 lines.
Also I tried to edit $SPLUNK_HOME/etc/system/local/props.conf but could not locate this file. thinking of adding the
SHOULD_LINEMERGE= true
MUST_BREAK_AFTER = .\n.
MAX_EVENTS = 2
Event 1
5761SS1 V6R1M0 080215 History Log Page 0001
MSGID SEV MSG TYPE
Event 2
CPF1124 00 INFO Job 252582/QTMHHTTP/QIWIRELESS started on 07/04/16 at 00:00:21 in subsystem QHTTPSVR in QHTTPSVR. Job ent
QIWIRELESS QTMHHTTP 252582 QWTPIIPP 0000 07/04/16 00:00:22.002029 QTMHHTTP
Event 3
CPF1164 00 COMPLETION Job 252582/QTMHHTTP/QIWIRELESS ended on 07/04/16 at 00:00:22; .034 seconds used; end code 0
QIWIRELESS QTMHHTTP 252582 QWTMCEOJ 0000 07/04/16 00:00:22.701533 QTMHHTTP
Event 4
CPF1124 00 INFO Job 252583/QPM400/Q1PDR started on 07/04/16 at 00:00:23 in subsystem QSYSWRK in QSYS. Job entered system
Q1PDR QPM400 252583 QWTPIIPP 0000 07/04/16 00:00:23.286025 QPM400
... View more
08-09-2016
01:10 AM
I thought of adding the regex .\n. in /opt/splunk/etc/system/local/props.conf but could not locate the file.
... View more
08-08-2016
11:11 PM
Hi...
I have a AS400 syslog file. for which I am want to configure splunk to pick up the events at every 2 lines.
Please advise which is the best way to do it
Sample log
5761SS1 V6R1M0 080215 History Log Page 0001
MSGID SEV MSG TYPE
Start of the event
CPF1124 00 INFO Job 252582/QTMHHTTP/QIWIRELESS started on 07/04/16 at 00:00:21 in subsystem QHTTPSVR in QHTTPSVR. Job ent
QIWIRELESS QTMHHTTP 252582 QWTPIIPP 0000 07/04/16 00:00:22.002029 QTMHHTTP
End of the Event
CPF1164 00 COMPLETION Job 252582/QTMHHTTP/QIWIRELESS ended on 07/04/16 at 00:00:22; .034 seconds used; end code 0
QIWIRELESS QTMHHTTP 252582 QWTMCEOJ 0000 07/04/16 00:00:22.701533 QTMHHTTP
CPF1124 00 INFO Job 252583/QPM400/Q1PDR started on 07/04/16 at 00:00:23 in subsystem QSYSWRK in QSYS. Job entered system
Q1PDR QPM400 252583 QWTPIIPP 0000 07/04/16 00:00:23.286025 QPM400
... View more
05-02-2016
06:36 AM
So 1st I will need to stop splunk.
Then update the props.conf file and then start splunk. and the data will come up in different lines.
... View more
04-28-2016
10:50 PM
The events vary some are single line events and some are multi line events. The multi line events are of various types.
In the above event the reason I want to split is because I wan to extract two fields on of the data set name and the other is percentage utilized. Since this is a single event I am not able to successfully extract this data. highlighted is the field I want to extract.
ER 929 00000090 S-SYS1.MAN7 C7SP89 100080 0 ALTERNATE
Example of single line event
N 6000000 DCXA 15217 00:51:34.62 STC15574 00000090 GLO2106I INCREASING SECONDARY ALLOCATION TO 109 CYLS -AOPT
Example of multiline event
M 0020000 DCXA 15217 00:51:36.91 STC02536 00000281 SVTM052I STEP1 COPY ARIBAGL ( 59,953) SNODE=CD.VIPCD01 044
D 044 00000281 SVTM052I FROM GLP0.OUT.DFS.TRECS.DLYTRN.G1086V00
D 044 00000281 SVTM052I TO /opt/cdunix/data/INT...ly_20150805005136.dat
E 044 00000281 SVTM052I #### COMPLETED 00000008/SDE0210I
Example of multiline event
MR0000000 DCXA 15217 00:51:37.28 AUTSYSXA 00000090 IEE112I 00.51.37 PENDING REQUESTS 067
LR 067 00000090 RM=3 IM=0 CEM=0 EM=0 RU=0 IR=0 NOAMRF
LR 067 00000090 ID:R/K T JOB ID MESSAGE TEXT
DR 067 00000090 41 R C653STAT *41 IEF235D C653STAT SMFDUMP WAITING FOR
DR 067 00000090 VOLUMES. TO CANCEL WAIT REPLY 'NO'
DR 067 00000090 67 R CNMS *67 DSI802A H160O REPLY WITH VALID NCCF
DR 067 00000090 SYSTEM OPERATOR COMMAND
DR 067 00000090 24 R NETV160 *24 DSI802A H160N REPLY WITH VALID NCCF
ER 067 00000090 SYSTEM OPERATOR COMMAND
... View more
04-28-2016
05:34 AM
Hi...
I am using a Mainframe log which has different type of events. I am only trying to split the lines of events which look like below and no other events. How can I configure this using Line_breaker.
MR0000000 DCXA 15217 01:00:01.96 INTERNAL 00000090 IEE949I 01.00.01 SMF DATA SETS 929
DR 929 00000090 NAME VOLSER SIZE(BLKS) %FULL STATUS
DR 929 00000090 P-SYS1.MAN1 C7SP09 99630 0 ALTERNATE
DR 929 00000090 S-SYS1.MAN2 C7SP14 99630 33 ACTIVE
DR 929 00000090 S-SYS1.MAN3 C7SP20 99630 0 ALTERNATE
DR 929 00000090 S-SYS1.MAN4 C7SP21 99630 0 ALTERNATE
DR 929 00000090 S-SYS1.MAN5 C7SP78 100080 0 ALTERNATE
DR 929 00000090 S-SYS1.MAN6 C7SP88 100080 0 ALTERNATE
ER 929 00000090 S-SYS1.MAN7 C7SP89 100080 0 ALTERNATE
... View more
04-25-2016
02:51 AM
I deleted the source log file and added it again with a new index instead of the default index and now when I run this command I am able to see the records And I have created separate indexes for each of the log files.
May be I used default index for all the log files which caused this issue.
... View more
04-22-2016
04:32 AM
I am not able to understand the logic. There are something like 300,000+ events for this log file. So it scanned only 287 events and did not find any matches on these 287 events.
... View more
04-20-2016
12:22 AM
Below is the job inspection report I hope its format your looking for.
Execution costs
Duration (seconds) Component Invocations Input count Output count
0.00 command.fields 5 287 287
0.23 command.search 5 - 287
0.13 command.search.index 6 - -
0.00 command.search.filter 1 - -
0.00 command.search.calcfields 1 287 287
0.00 command.search.fieldalias 1 287 287
0.00 command.search.index.usec_1_8 5,325 - -
0.00 command.search.index.usec_512_4096 5 - -
0.00 command.search.index.usec_64_512 114 - -
0.00 command.search.index.usec_8_64 21 - -
0.06 command.search.kv 1 - -
0.03 command.search.rawdata 1 - -
0.01 command.search.typer 1 287 287
0.00 command.search.lookups 1 287 287
0.00 command.search.summary 5 - -
0.00 command.search.tags 1 287 287
0.00 dispatch.check_disk_usage 1 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.08 dispatch.evaluate 1 - -
0.08 dispatch.evaluate.search 1 - -
0.28 dispatch.fetch 6 - -
0.23 dispatch.localSearch 1 - -
0.00 dispatch.readEventsInResults 1 - -
0.23 dispatch.stream.local 5 - -
0.01 dispatch.timeline 6 - -
0.01 dispatch.writeStatus 6 - -
0.03 startup.configuration 1 - -
0.07 startup.handoff 1 - -
Search job properties
canSummarize 0
createTime 2016-04-20T12:48:20.000+05:30
cursorTime 2015-09-28T16:00:00.000+05:30
custom
{
"search": "(source=\"nafx.g1303v00'\" OR source=\"nafx.g1304v00'\") opc* AND acf*"
}
defaultSaveTTL 604800
defaultTTL 600
delegate None
diskUsage 122880
dispatchState DONE
doneProgress 1.0
dropCount 0
eai:acl
{
"app": "search",
"can_write": "1",
"modifiable": "1",
"owner": "admin",
"perms": {
"read": [
"admin"
],
"write": [
"admin"
]
},
"sharing": "global",
"ttl": "600"
}
earliestTime 2012-07-08T01:30:52.000+05:30
eventAvailableCount 0
eventCount 287
eventFieldCount 0
eventIsStreaming True
eventIsTruncated False
eventSearch search (source="nafx.g1303v00'" OR source="nafx.g1304v00'") opc* AND acf*
eventSorting desc
indexEarliestTime 1460630991
indexLatestTime 1460631052
isBatchModeSearch False
isDone True
isFailed False
isFinalized False
isPaused False
isPreviewEnabled True
isRealTimeSearch False
isRemoteTimeline False
isSaved False
isSavedSearch False
isTimeCursored 1
isZombie False
keywords acf* opc* source::nafx.g1303v00' source::nafx.g1304v00'
label None
modifiedTime 2016-04-20T12:48:27.086+05:30
normalizedSearch litsearch ( source="nafx.g1303v00'" OR source="nafx.g1304v00'" ) opc* AND acf* | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"
numPreviews 0
pid 21431
priority 5
remoteSearch litsearch ( source="nafx.g1303v00'" OR source="nafx.g1304v00'" ) opc* AND acf* | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server"
reportSearch None
request
{
"adhoc_search_level": "verbose",
"auto_cancel": "30",
"check_risky_command": "false",
"custom.search": "(source=\"nafx.g1303v00'\" OR source=\"nafx.g1304v00'\") opc* AND acf*",
"earliest_time": null,
"indexedRealtime": null,
"latest_time": null,
"preview": "1",
"rf": "*",
"sample_ratio": "1",
"search": "search (source=\"nafx.g1303v00'\" OR source=\"nafx.g1304v00'\") opc* AND acf*",
"status_buckets": "300",
"ui_dispatch_app": "search"
}
resultCount 0
resultIsStreaming True
resultPreviewCount 0
runDuration 0.388
runtime
{
"auto_cancel": "30",
"auto_pause": "0"
}
sampleRatio 1
sampleSeed 0
scanCount 287
search search (source="nafx.g1303v00'" OR source="nafx.g1304v00'") opc* AND acf*
searchCanBeEventType 1
searchProviders
[
"oc8001872801.ibm.com"
]
searchTotalBucketsCount 13
searchTotalEliminatedBucketsCount 0
sid 1461136700.12
statusBuckets 300
ttl 600
Additional info timeline search.log
... View more
04-19-2016
02:44 AM
Looks like I dont have enough Karma points to add more files.
Scene 1 - This does not work
1st query
source=syslog.txt recall* --- Returns 292 records
2nd query
source=syslog.txt recall fail* -- Returns 36 records in event count but does not display results.
But when I try
source=syslog.txt migrat* fail* --- This query returns me results.
And when I concatenate both the query it does not return any results.
source=syslog.txt (migrat* fail*) AND (recall fail*)
... View more
04-19-2016
02:40 AM
I ran the index command and it returned me 10000 results. The case is sometime when I am adding more filter let me give another example. Where I tried to look up all log entries that had recall in them and it returned me 292 results. When I added recall AND fail*. It showed me 36 entries but no results displayed. When I did an inspect job I found that event count is 36 but available event count is 0.
I guess there might be something wrong with the way I am writing the search query or may be indexing.
... View more
04-19-2016
12:08 AM
Event sampling returns me very few records. and not the actual set of records that match. This is a normal problem that I have even with another search that I was performing.
There was another similair query I tried and when I filter based on date month it returns value for one particular month and not the other.
I have splunk installed on my linux laptop. Could that have any implication in indexing.
... View more
04-18-2016
06:05 AM
3 Karma
I am trying to list specific events, but I am not able to view them. Splunk shows that events exist, but it comes up with no events found. Screenshot attached
... View more
04-13-2016
11:59 PM
I tried using this query to check to see the trend of spool by time but it does not work.
source="syslog.txt" $HASP646 PROCESS=enginedepth | chart values(Spool) by _time TimeEx
Source Report looks like this.
8/6/15
12:00:00.970 AM
NR0000000 DCXA 15218 00:00:00.97 INTERNAL 00080A89 $HASP646 7.4688 PERCENT SPOOL UTILIZATION
Spool = 7.4688
TimeEx = 00:00:00
2 8/5/15
11:00:01.780 PM
NR0000000 DCXA 15217 23:00:01.78 INTERNAL 00000080 $HASP646 7.4050 PERCENT SPOOL UTILIZATION
Spool = 7.4050
TimeEx = 23:00:01
3 8/5/15
10:00:02.110 PM
NR0000000 DCXA 15217 22:00:02.11 INTERNAL 00080A89 $HASP646 9.0884 PERCENT SPOOL UTILIZATION
Spool = 9.0884
TimeEx = 22:00:02
4 8/5/15
9:00:01.910 PM
NR0000000 DCXA 15217 21:00:01.91 INTERNAL 00080A89 $HASP646 9.0335 PERCENT SPOOL UTILIZATION
Spool = 9.0335
TimeEx = 21:00:01
5 8/5/15
8:00:01.210 PM
NR0000000 DCXA 15217 20:00:01.21 INTERNAL 00080A89 $HASP646 8.9815 PERCENT SPOOL UTILIZATION
Spool = 8.9815
TimeEx = 20:00:01
6 8/5/15
7:00:01.620 PM
NR0000000 DCXA 15217 19:00:01.62 INTERNAL 00080A89 $HASP646 8.9438 PERCENT SPOOL UTILIZATION
Spool = 8.9438
TimeEx = 19:00:01
7 8/5/15
6:00:02.010 PM
NR0000000 DCXA 15217 18:00:02.01 INTERNAL 00000080 $HASP646 8.9057 PERCENT SPOOL UTILIZATION
Spool = 8.9057
TimeEx = 18:00:02
... View more
04-11-2016
08:03 AM
Hi
I have noticed that syncsort ironstream apps is only available for splunk 6.2/6.3. Any update available when will they be made available for 6.4?
I have some Mainframe syslogs that I want to test.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
