About bardill

bardill · ‎07-22-2021

Sorry that not help We not read the splunkd.log as json!! We read a log file over an APP

bardill · ‎07-21-2021

After we upgraded from 7.3 to 8.1.4, the UF can no longer read the json data. 07-21-2021 16:03:02.643 +0200 ERROR JsonLineBreaker - JSON StreamId:427620843244980635 had parsing error:Unexpected character while expecting ':': 'S' - data_source="/opt/uc4/srvavq/prod/share/ae/temp/toSplunk/OPT_REP/normal/ARIZON_CS_UC4_ActiveSchedJobs/P_AVQ_Aktive_Automic_Jobs_AVQPROD_0000000000000022.txt", data_host="xh515", data_sourcetype="P_AVQ_Aktive_Automic_Jobs_AVQPROD-too_small" props.conf [source::/opt/uc4/srvavq/*/share/ae/temp/toSplunk/ARIZON_CS/*/*/*.txt] INDEXED_EXTRACTIONS = json TIMESTAMP_FIELDS = Timestamp Data File like this: {"Timestamp" : 1626874253, "Anzahl" : "7", "userstamp" : "RM", "status" : "Processed", "taskname" : "task_secevt2_apply_sinstr.rm","env":"AVQPROD"} {"Timestamp" : 1626874221, "Anzahl" : "1", "userstamp" : "IMED_65454_54222", "status" : "Processed", "taskname" : "rm.set_resp","env":"AVQPROD"}

bardill · ‎05-07-2021

hi he break all lines? this is the props.conf on the indexer [automic_itil] SHOULD_LINEMERGE = false KV_MODE = NONE INDEXED_EXTRACTIONS = JSON LINE_BREAKER = \{\"LOGTIME TIME_PREFIX = LOGTIME\"\s\:\s\" TIME_FORMAT = %Y-%m-%d %H:%M:%S

bardill · ‎05-06-2021

Hi, I'm new to Splunk. How do I have to set the props.conf in the indexer so that my JSON reads correctly? I would like to have the fields: LOGTIME, CMDBID, RunID and Msg per event. [{"LOGTIME" : "06-05-2021 11:27:12","CMDBID" : "TEST","RunID" : "356166995","Msg" : "************************************************************************ ** ucxja64m version 12.2.0+build.2108 changelist 1530016094 ** ** JOB 356166995 (ProcID:0012059010) START AT 04.05.2021 / 15:48:42 ** ** UTC TIME 04.05.2021 / 13:48:42 ** ** TEXT= Job started ** ************************************************************************ total 72 drwxr-xr-x 11 utpuc4 utpuc4 8192 May 04 12:15 . drwxr-xr-x 3 utxuc4 utxuc4 256 Aug 04 2020 .. -rw------- 1 utpuc4 utpuc4 8546 Apr 27 13:02 .bash_history drwxr-x--- 2 utpuc4 utpuc4 4096 Apr 27 10:38 .histfiles -rw-r--r-- 1 utpuc4 utpuc4 0 Nov 06 2019 .lesshsQ -rw------- 1 utpuc4 utpuc4 47 Mar 14 2019 .lesshst -rw-r----- 1 utpuc4 utpuc4 1727 Aug 19 2019 .profile drwx------ 2 utpuc4 utpuc4 256 Dec 23 2019 .ssh drwxr-x--- 3 utpuc4 utpuc4 256 Aug 31 2018 CAPKI drwxr-xr-x 6 utpuc4 utpuc4 256 Aug 20 2020 V12.3.3_2020-08-18 drwxr-x--- 6 utpuc4 utpuc4 256 Aug 30 2018 V122_HF1 drwxr-xr-x 2 utpuc4 utpuc4 256 Sep 04 2018 archive lrwxrwxrwx 1 utpuc4 utpuc4 23 Jan 31 2019 global -> /var/uc4/uc4global/prod lrwxrwxrwx 1 utpuc4 utpuc4 28 Sep 13 2018 java8_64 -> /opt/java/java8_64_8.0.0.521 lrwxrwxrwx 1 utpuc4 utpuc4 11 Sep 04 2018 latest -> ./V122_HF1/ drwxr-xr-x 2 utpuc4 utpuc4 256 Jul 13 2018 lost+found drwxr-xr-x 3 utpuc4 utpuc4 256 Sep 03 2018 network -rw------- 1 utpuc4 utpuc4 0 Aug 03 2020 nohup.out drwxr-xr-x 7 utpuc4 utpuc4 256 Feb 17 2020 share ************************************************************************ ** ucxja64m version 12.2.0+build.2108 changelist 1530016094 ** ** JOB 356166995 (ProcID:0012059010) ENDED AT 04.05.2021 / 15:48:42 ** ** UTC TIME 04.05.2021 / 13:48:42 ** ** TEXT= Job ended RETCODE=00 ** ************************************************************************ "}, {"LOGTIME" : "06-05-2021 11:27:12","CMDBID" : "TEST","RunID" : "356178213","Msg" : "************************************************************************ ** ucxja64m version 12.2.0+build.2108 changelist 1530016094 ** ** JOB 356178213 (ProcID:0023593346) START AT 04.05.2021 / 15:49:53 ** ** UTC TIME 04.05.2021 / 13:49:53 ** ** TEXT= Job started ** ************************************************************************ total 72 drwxr-xr-x 11 utpuc4 utpuc4 8192 May 04 12:15 . drwxr-xr-x 3 utxuc4 utxuc4 256 Aug 04 2020 .. -rw------- 1 utpuc4 utpuc4 8546 Apr 27 13:02 .bash_history drwxr-x--- 2 utpuc4 utpuc4 4096 Apr 27 10:38 .histfiles -rw-r--r-- 1 utpuc4 utpuc4 0 Nov 06 2019 .lesshsQ -rw------- 1 utpuc4 utpuc4 47 Mar 14 2019 .lesshst -rw-r----- 1 utpuc4 utpuc4 1727 Aug 19 2019 .profile drwx------ 2 utpuc4 utpuc4 256 Dec 23 2019 .ssh drwxr-x--- 3 utpuc4 utpuc4 256 Aug 31 2018 CAPKI drwxr-xr-x 6 utpuc4 utpuc4 256 Aug 20 2020 V12.3.3_2020-08-18 drwxr-x--- 6 utpuc4 utpuc4 256 Aug 30 2018 V122_HF1 drwxr-xr-x 2 utpuc4 utpuc4 256 Sep 04 2018 archive lrwxrwxrwx 1 utpuc4 utpuc4 23 Jan 31 2019 global -> /var/uc4/uc4global/prod lrwxrwxrwx 1 utpuc4 utpuc4 28 Sep 13 2018 java8_64 -> /opt/java/java8_64_8.0.0.521 lrwxrwxrwx 1 utpuc4 utpuc4 11 Sep 04 2018 latest -> ./V122_HF1/ drwxr-xr-x 2 utpuc4 utpuc4 256 Jul 13 2018 lost+found drwxr-xr-x 3 utpuc4 utpuc4 256 Sep 03 2018 network -rw------- 1 utpuc4 utpuc4 0 Aug 03 2020 nohup.out drwxr-xr-x 7 utpuc4 utpuc4 256 Feb 17 2020 share ************************************************************************ ** ucxja64m version 12.2.0+build.2108 changelist 1530016094 ** ** JOB 356178213 (ProcID:0023593346) ENDED AT 04.05.2021 / 15:49:53 ** ** UTC TIME 04.05.2021 / 13:49:53 ** ** TEXT= Job ended RETCODE=00 ** ************************************************************************ "}]

bardill · ‎03-26-2019

in The Moment i do this so https://server:0000/services/data/lookup-table-files but i have no size.

bardill · ‎03-26-2019

Is there a default possibility for a user get a list of all CSV files for an app to determine the size of the individual CSV files

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎03-26-2019

Online Status	Offline
Date Last Visited	‎07-26-2021 02:31 AM

UFW parsing JSON ERROR

Read JSON

Infos over REST API from CSV Files

Re: UFW parsing JSON ERROR

UFW parsing JSON ERROR

Re: Read JSON

Read JSON

Re: Infos over REST API from CSV Files

Infos over REST API from CSV Files