Thank you!!! saved my time 🙂 ... View more

I have the same issue. This link is broken or the app doesn't exist anymore. https://splunkbase.splunk.com/app/1908/ Did you find a suitable work around? ... View more

thanks for both ...I realized that the param is for Advanced XML and option is for simple xml as @niketnilay mentioned. Accordingly i have changed and works fine,,@niketnilay...not sure how to accept your answer.kindly let me know ... View more

Hi nagaraju_chittathuru, You should define if it's better for you to have the full error message or a part of it: I have an App where customer asked to me to display the full message, instead in another App the same customer asked to me to display only a part of it. Watching your log, I see that it's easier to extract the full log because it's difficoult to find a rule to identify the part of log to take: e.g. it's easy to extract the first string without spaces after "Caused by" (your first bold string) but it's difficoult to identify the second bold string (there aren't clear identifiers). Eventually in your dashboard you could put a text box to perform a full text search in error messages that could help your users to use this log. bye. Giuseppe ... View more

@Ifedak: its my pleasure to accept for such a kind of help from the community.Infact was discussing the answer further that's where I was waiting to accept.now accepted and thanks for reminder 🙂 ... View more

@Sukisen1981: my requirement is simple. just need a trend line out of the below data. also posting my statisticstab and visualizationtab images totaltime: 28820.220 8347.678 11947.797 duration: 0.0261704 0.1147433 0.1237187 how will you populate the totaltime on x-axis and duration on y-axis? | stats values(totaltime) as totdur values(Duration) as duration ... View more

unfortunately blocked from my work place ... View more

Take a look at the Splunk Dashboard Examples app. There is an example there of using single value metrics with color. You will see multiple examples as well as the XML behind the scenes that will allow you to see the parameters required for each example. ... View more

@Sukisen1981: The moment I say | rex field=_raw (? .*?)": Error" the search will hung since too many errors will be there in the log and leads to performance hit. Is there way we can extract a portion and then try? Error and related causeby from the logs ... View more

Hi Woodcock, Thanks for the regex above and this is working fine. From the above data extended the regex for below fields. I have tried and the t1,Field0,Field1,Field2,Field3,Field4 are displaying now . Some how I could not be able to extract these fields by using IFX and all the time I am getting error. Below Regex is extracting only "GC (Allocation Failure)" events. Would like to extend for other Full GC and GC events as well. Full GC (System.gc()) as "gt" GC (Allocation Failure) as "gt" GC (System.gc()) as "gt" (?ms)\d+\.\d+\D+^(?<t1>[^:]+):\s+(?<Field0>[^-\r\n\.\b]+)\s+(?<Field1>[^-\r\n\.]+)->(?<Field2>[^\(]+)\((?<Field3>[^\)]+)\),\s+(?<Field4>[^\s]+\ssecs) ... View more

Hi Iguinn, Thanks for the quick response. If not simple xml, it would be great if you can suggest me other ways to accomplish the above requirement. ... View more

i think i will do a full jquery script to create a beautiful home page for my app. i use 3 dahsboard. i just to check some idea ^^ ... View more

Hi Damien, From the above solution I have achieved the required connectivity. But I have an issue. I am unable to connect more than 20 threads. Could not be able to add more than 20. Kindly Advise For example: I have [jms://queue/thread1:INPUTQUEUE] [jms://queue/thread2:INPUTQUEUE] [jms://queue/thread3:INPUTQUEUE] [jms://queue/thread4:INPUTQUEUE] [jms://queue/thread5:INPUTQUEUE] [jms://queue/thread6:OUTPUTQUEUE] [jms://queue/thread7:OUTPUTQUEUE] [jms://queue/thread8:OUTPUTQUEUE] [jms://queue/thread9:OUTPUTQUEUE] [jms://queue/thread10:OUTPUTQUEUE] [jms://queue/thread11:FAILUREQUEUE] [jms://queue/thread12:FAILUREQUEUE] [jms://queue/thread13:FAILUREQUEUE] [jms://queue/thread14:FAILUREQUEUE] [jms://queue/thread15:FAILUREQUEUE] [jms://queue/thread16:FILTERQUEUE] [jms://queue/thread17:FILTERQUEUE] [jms://queue/thread18:FILTERQUEUE] [jms://queue/thread19:FILTERQUEUE] [jms://queue/thread20:FILTERQUEUE] ... View more

I'm guessing you're trying to strip some content of of your events, not all event. So, you should be using SEDCMD of props.conf, as the transforms that you're trying will remove the whole event [test_transform] pulldown_type = 1 SEDCMD-remove_content = s/(?s).*(?=<\/content>)<\/content>// DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom disabled = false ... View more

Brilliant!!! Thanks Damien for the quick turnaround. ... View more

Where did you get these ctypes files? I'm having a similar issue but my ctypes directory in /usr/lib/python2.7/ has a lot less files in it than your list.. ... View more