cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
mmsbswe
Engager
Member since: ‎06-25-2019
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎06-25-2019
Activity Feed
View All

Re: Handle different search results as one by anal...

by in Splunk Search
‎08-14-2019 01:37 AM
‎08-14-2019 01:37 AM
Hi, i will try it. Thanks! ... View more

Handle different search results as one by analysin...

by in Splunk Search
‎08-13-2019 01:47 AM
‎08-13-2019 01:47 AM
Hi Community, i have a search which shows me all PHP-Errors in the configured timespan. Now i want so sort this results by matching diffs other results in percent and show results over X% matching results as one. For instance: Search Query: index=php source="/var/log/docker/php-fpm/error.log" "PHP Fatal error" Example result 1: [13-Aug-2019 03:01:29 Europe/Berlin] PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22 Stack trace: #0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfiguration.php(10): require_once() Example result 2: [12-Aug-2019 17:01:01 Europe/Berlin] PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:12 Stack trace: #0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/EnvironmentPilot.php(41): include() Field extractions are very useful but the most php-fpm-errors are very different in their appearance. Now i want a output like this instead of two results : PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22 .... Thanks in advance for checking my question! ... View more

Re: How to exclude string from being indexed?

by in Getting Data In
‎06-27-2019 07:04 AM
‎06-27-2019 07:04 AM
Thanks for your reply. Correct, i do this on the universial forwarder. It seems that i have to try it on our indexer. Edit: Now it works :-). ... View more

How to exclude string from being indexed?

by in Getting Data In
‎06-25-2019 06:45 AM
‎06-25-2019 06:45 AM
Hello community, i want to configure the splunk forwarder to exclude one specific string from being indexed to the splunk index. In my case i want to exclude all lines like this from being transferred to the indexer: *[25-Jun-2019 15:31:29 Europe/Berlin] PHP Deprecated: The "checkDataSubmission" hook will be removed...* These are my config files: File: **/opt/splunkforwarder/etc/system/local/inputs.conf** ... [monitor:///var/log/docker/php-fpm/error.log] sourcetype=php:fpm:error crcSalt= index=php File: **/opt/splunkforwarder/etc/system/local/props.conf** [source::/var/log/docker/php-fpm/error.log] TRANSFORMS-null= setnull File: **/opt/splunkforwarder/etc/system/local/transforms.conf ** [setnull] REGEX = .*PHP Deprecated.* DEST_KEY = queue FORMAT = nullQueue I've done the following steps to debug this by myself: executed: - *./splunk cmd btool props list --debug* - *./splunk cmd btool transforms list --debug* To check if my configuration files was loaded when restarting the splunk service. All my configured lines are displayed by this. Also i've restarted the splunk forwarder after editing the config. Every help will be appreciated. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All