@kamal18sharma  Was it compatibility issue that you re-installed splunk enterprise? I am facing this issue with "Splunk app for Soar export" which i installed on SOAR app. Can you elaborate the solution. ... View more

@shashank_24  I am also facing the similar issue. Are you able to integrate Opsgenie and Splunk? ... View more

Thanks for the explanation @thambisetty .. and its working!!! I added WRITE_META=true as well. I have one more question: This configuration will work in both HF and Indexer, so which one should i use for this scenario? Read this link and so I am confused: https://aditumpartners.com/5-splunk-myths-busted/ ... View more

Thanks @thambisetty I will try this. And which index i should write in inputs.conf (Splunk UF integration) as Splunk will be monitoring the same file. ... View more

@kishen2017 I am also facing the same prob. Did you got the fix? ... View more

Thanks. It's working! ... View more

@madavis1986 were you able to get a solution on this? ... View more

@jawaharas It's a custom data model. Can you try accelerating that data model and look for milliseconds? ... View more

Hi Suki, @Sukisen1981 if i search for last 15 - 20 mins milliseconds are displaying.. But if i search any older time than this.. then it is not displaying milliseconds. My question is that while saving the data in the indexer (accelerated data model) will it not save the milliseconds? ... View more

yes I am able to see here.. but if i do max or min of the time.. millisecond is not printing ... View more

yes. In epoch format. But that value does not have milliseconds. So, in raw logs time is 5:49:08.715 PM and the tstats epoch converted time has 1565250548. ... View more

Thanks. But I am expecting the data in the below format. measObjLdn measTypes measValues group=lag,lagInstance=0 Specific 25037 Aggregate 25059 GcSpecific 0 OtherSpecific 25037 BizzaroSpecific 0 SkewSpecific 0 group=lag,lagInstance=1 Specific 1 Aggregate 11 GcSpecific 0 OtherSpecific 1 BizzaroSpecific 0 SkewSpecific 0 group=lag,lagInstance=3 Specific 2 Aggregate 2 GcSpecific 0 OtherSpecific 2 BizzaroSpecific 0 SkewSpecific 0 And so on.. ... View more

<measInfo> <granPeriod duration="PT300S" endTime="2019-05-07T15:40:00+09:00"/> <repPeriod duration="PT300S"/> <measTypes>Specific Aggregate GcSpecific OtherSpecific BizzaroSpecific SkewSpecific</measTypes> <measValue measObjLdn="group=lag,lagInstance=0"> <measResults>25037 25059 0 25037 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=1"> <measResults>1 11 0 1 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=2"> <measResults>1 5 0 1 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=3"> <measResults>2 2 0 2 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=4"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=5"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=6"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=7"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=8"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=9"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=10"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=11"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=12"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=13"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=14"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=15"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=16"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=17"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=18"> <measResults>0 0 0 0 0 0</measResults> </measValue> <measValue measObjLdn="group=lag,lagInstance=19"> <measResults>0 0 0 0 0 0</measResults> </measValue> </measInfo> ... View more

Thanks Ravi. For few of the XMLs I have below scenario: Here, multivalue field extraction is required. So, the output should be For each measObjLdn (group=lock,scope=\2A) the values of Count AcceptCount RecurseCount RefuseCount DeferCount DeferTime TimeoutCount TimeoutTime RaceCount Latency TimeoutLatency shold be displayed. Count AcceptCount RecurseCount RefuseCount DeferCount DeferTime TimeoutCount TimeoutTime RaceCount Latency TimeoutLatency 120 10 0 0.69 0 0.0 8 0 0 NULL NULL 120 10 0 0.69 0 0.0 8 0 0 NULL NULL 120 10 0 0.69 0 0.0 8 0 0 NULL NULL 120 10 0 0.69 0 0.0 8 0 0 NULL NULL Thanks, Payal ... View more

Thanks Ravi. For few of the XMLs I have below scenario: Here, multivalue field extraction is required. So, the output should be For each measObjLdn (group=lock,scope=\2A) the values of Count AcceptCount RecurseCount RefuseCount DeferCount DeferTime TimeoutCount TimeoutTime RaceCount Latency TimeoutLatency shold be displayed. ` Count AcceptCount RecurseCount RefuseCount DeferCount DeferTime TimeoutCount TimeoutTime RaceCount Latency TimeoutLatency 120 10 0 0.69 0 0.0 8 0 0 NULL NULL 120 10 0 0.69 0 0.0 8 0 0 NULL NULL <measResults>120 10 0 0.69 0 0.0 8 0 0 NULL NULL</measResults> </measValue> <measResults>120 10 0 0.69 0 0.0 8 0 0 NULL NULL</measResults> </measValue> </measInfo>` Thanks, Payal ... View more

There are more than one ListOfLineItems in a single xml. ... View more

Thanks Frank, I am trying to extract ListOfLineItems block.. but as per my regex it is capturing more than one ListOfLineItems block. ListOfLineItems>(?<Bulk>[\sA-Za-z0-9/<>-]*</ListOfLineItems>) Can you please help me in extracting each blocks seperately ... View more

Thanks David. I tried with max_match but no luck. I wanted to know if there are any more option which i can try before i change limits.conf. ... View more

Yes Frank.. When searching for a longer duration I am getting the error. For a shorter span there are no errors. So.. yes for a sample you might not find any error. So.. is it like no other option other than increasing the limit in limits.conf? ... View more

Thanks Frank. Below is the sample xml. Here, I want to extract OrderFunction which comes immediately after ListOfLineItems.(bcoz in the single xml, many OrderFunctions are present) <SiebelMessage MessageId="#####" MessageType="Integration Object" IntObjectName="Order Interface" IntObjectFormat="Siebel Hierarchical" TransactionName="SubmitOrder"><ListOfOrderInterface><Orders operation=""><Id>#####</Id><RelationalOrderId>######</RelationalOrderId><BillToAccountId>#####</BillToAccountId><IntegrationId/><OrderNumber>#####</OrderNumber><OrderPriority>Medium</OrderPriority><OrderType>Change Proposition</OrderType><RequestedDate/><Status/><ARII>Australia</ARII><ReasonCode/><PaymentMethod>Postpay</PaymentMethod><ServiceProvider>Vodafone AU</ServiceProvider><OrganizationName>Vodafone AU</OrganizationName><BillingEffectDateTime>11/28/2018 11:10:02</BillingEffectDateTime><EffectDateTime>11/28/2018 11:10:02</EffectDateTime><OldBillingAccountId/><NewBillingAccountId/><CustomerAccountId>#####</CustomerAccountId><TargetServiceProvider/><OrderReasonCode>CP1 - Customer Requested</OrderReasonCode><tesaCode/><ConnectionType/><WBIReasonCode/><ToolsOfTrade>N</ToolsOfTrade><CustomerBillCycle>1</CustomerBillCycle><MigratedAccountFlag>N</MigratedAccountFlag><OrderFunction>UPGRADE</OrderFunction><AdditionalOrderFunction/><CustomerMainEmailAddr/><CustomerSegment>Consumer</CustomerSegment><CustType>Person</CustType><SiebelProductType>Voice</SiebelProductType><SpecialSiebelType/><BulkFlag/><ServiceOrderPriority>1</ServiceOrderPriority><ServicePositionIndicator/><CustomerType>Person</CustomerType><BAMarketingPreferencesFlag>Y</BAMarketingPreferencesFlag><SecondarySubs>N</SecondarySubs><SecondarySubsDisconnect>N</SecondarySubsDisconnect><SSReasonCode/><ListOfSDIMEI/><NBNAccessTechnology/><ByPassPassProvisioning>N</ByPassPassProvisioning><ListOfAdditionalInfo><AdditionalInfo><Type>Hard Caps</Type><Unthrottle/><UnthrottleSharing/><EndDate/><Product>IDD</Product><Status>Unbarred</Status><Action/></AdditionalInfo><AdditionalInfo><Type>Hard Caps</Type><Unthrottle/><UnthrottleSharing/><EndDate/><Product>Data</Product><Status>Unbarred</Status><Action/></AdditionalInfo></ListOfAdditionalInfo><ExternalReferenceId/><OrderChannel/><SalesPerson>NAVGIREAS</SalesPerson><ListOfLineItems><LineItems><WBIReasonCode/><EstDeliveryDt/><EstShipmentDt/><StockBand/><SpecialSiebelType/><ListOfSIM><SIM><ListOfSIMDetails><SIMDetails><Name>PUK</Name><Value>39092201</Value></SIMDetails><SIMDetails><Name>PUK2</Name><Value/></SIMDetails><SIMDetails><Name>Profile</Name><Value>GA431A</Value></SIMDetails></ListOfSIMDetails><AssetNumber>89610300003114915201</AssetNumber></SIM></ListOfSIM><ListOfNewSIM/><ListOfNewIMSI/><ListOfIMSI><IMSI><AssetNumber>505038309061393</AssetNumber></IMSI></ListOfIMSI><Id>#####</Id><ActionCode>Deleted</ActionCode><AssetId/><AssetIntegrationId/><OrderReasonCode/><RelatedAssetIntegrationId/><ReasonCode/><OrderFunction>UPGRADE</OrderFunction><RootStatus>Submitted</RootStatus><OrderType>Change Proposition</OrderType><BasePrice/><ShippingGroup/><IntegrationId>######</IntegrationId><OrderHeaderId>2-SI3QRJ1X</OrderHeaderId><ParentOrderItemId/><Product>Vodafone PostPay Sim Only Plans Aug 2017</Product><ProductId>2-CNDUGEN</ProductId><RootOrderItemId>#####</RootOrderItemId><Status>Submitted</Status><AssetInternalIntegrationId>######</AssetInternalIntegrationId><ServiceInstanceFlag>N</ServiceInstanceFlag><ServiceType>SUBSCRIPTION</ServiceType><SiebelProductType>Voice</SiebelProductType><ServicePIN>2207</ServicePIN><Resource>61411857667</Resource><NewResource/><Type>Proposition</Type><SiebelPrice/><OverrideAmount/><OverrideReasonCode/><CreatedBy>NAVGIREAS</CreatedBy><LastUpdBy>NAVGIREAS</LastUpdBy><InstalledAssetName>Ms SANDRA BENNET</InstalledAssetName><SiebelOnly>N</SiebelOnly><ChargeDescription/><VFPeriodEndDate/><VFPeriodStartDate/><VFPcrfFlag/><RelatedServiceOrderId/><WaiveCharges>N</WaiveCharges><ListOfAttributes><Attributes><Id>######</Id><ActionCode>Deleted</ActionCode><Name>Call Barring PIN</Name><ObjectId>2-SI3QRJ8P</ObjectId><Value>1234</Value><IntegrationId/></Attributes><Attributes><Id>2-SI3QRJ8T</Id><ListOfLineItems> I have to use the same regex in datamodel in Splunk. I have to look if i can use spath. Please help if i can try anything other than .*? ... View more