Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nkchaitanya
nkchaitanya
Explorer
Member since:
02-07-2013
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 02-07-2013 |
Activity Feed
- Got Karma for How to Schedule a search for every 30 seconds.. 06-05-2020 12:47 AM
- Karma Re: How to configure email alert using gmail smtp? for itinney. 06-05-2020 12:46 AM
- Posted How do I extract the latest occurrence of a field from multiple lines? on Splunk Search. 10-02-2018 11:54 PM
- Tagged How do I extract the latest occurrence of a field from multiple lines? on Splunk Search. 10-02-2018 11:54 PM
- Tagged How do I extract the latest occurrence of a field from multiple lines? on Splunk Search. 10-02-2018 11:54 PM
- Tagged How do I extract the latest occurrence of a field from multiple lines? on Splunk Search. 10-02-2018 11:54 PM
- Posted Re: We have tried to extract index time field extarction on Splunk Search. 02-18-2018 10:12 AM
- Posted Re: Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-19-2016 09:43 AM
- Posted Re: Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-19-2016 09:13 AM
- Posted Re: Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-19-2016 03:35 AM
- Posted Re: Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-18-2016 03:56 AM
- Posted Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Tagged Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Tagged Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Tagged Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Tagged Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Tagged Why is there a 2 hour difference between _time and the actual events' timestamp for data on my receiver? on Getting Data In. 08-17-2016 09:44 AM
- Posted Re: How to Parse the XML data as row format in splunk on Dashboards & Visualizations. 12-06-2015 06:52 AM
- Posted How to Parse the XML data as row format in splunk on Dashboards & Visualizations. 12-05-2015 10:39 AM
- Tagged How to Parse the XML data as row format in splunk on Dashboards & Visualizations. 12-05-2015 10:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-02-2018
11:54 PM
Want to capture the latest occurrence of "working_condition_check - status -" which is "Stopped".
Please help me in getting the regex.
Below is the log message.
10/01/2018 15:01:04 Server_Name
working_condition_check - status - Started
working_condition_check - status - Running
working_condition_check - status - Stopped
... View more
02-18-2018
10:12 AM
try as
Transforms.conf
[fieldname]
REGEX =regex
FORMAT = fieldname::"$1"
SOURCE_KEY = fieldname
WRITE_META = true
in Props.conf
[sourcetype]
REPORT-fieldname = fieldname
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
... View more
08-19-2016
09:43 AM
This is happening for normal indexes where the data is getting from the forwarder server.
For the indexes which are summary indexed the events are shown as:
Time - 8/19/16 12:30:03.000 PM
Event - 08/19/2016 12:30:00 -0400
If this is the case, then,
1. is there any thing we need to check from forwarder side ?
2. is Time Zone set for the user will effect?
... View more
08-19-2016
09:13 AM
In the events data, when I selected as List, the data_zone is shown as
date_zone = -360 ,
Time is shown as 8/19/16 12:01:32.000 PM
and
Event is shown as "2016-08-19 10:01:32"
-When selected as raw in dropdown, "2016-08-19 10:01:32" is shown
above shown for normal indexes
and
for indexes which was summary indexed is showing as
Time - 8/19/16 12:30:03.000 PM
Event - 08/19/2016 12:30:00 -0400,
... View more
08-19-2016
03:35 AM
we tried that change US/Eastern, but not effected.
And no other parameter it is overriding.
... View more
08-18-2016
03:56 AM
Earlier the App was installed in other timezone so TZ parameter was set.
But, now the App(Receiver) and server(Forwarder) are at same location, why there is a difference of 2hrs?
... View more
08-17-2016
09:44 AM
I configured a 6.2 forwarder to send data to one of my receivers also running 6.2.
Data is getting into the receivers, but the problem is, the data which is being pulled into the receiver has a 2 hour delay.
Forwarder is in the Eastern Timezone and
Receiver is in Eastern Timezone.
I changed the parameter in ./system/local/
props.conf
[host::myhostname]
TZ = US/Eastern
and also configured in my app ./apps/appname/local/props.conf as
[host::recieverhostname]
TZ = America/Chicago
DATETIME_CONFIG = CURRENT
User Time zone is also set to Eastern Time (US & Canada).
However, I still see the data with a 2 hr delay in events, but _time is showing as Eastern Time.
For example:
_time is 8/17/16 11:57:20.000 AM
Event is "2016-08-17-09:57:20"
Now I want both _time and Event to be in sync. please suggest.
... View more
12-06-2015
06:52 AM
yes, I have to put the following fields in props.conf
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = ()
MUST_BREAK_AFTER = \
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
... View more
12-05-2015
10:39 AM
In the process of Parsing the xml data in splunk .
I have an xml data
<outer>
<Global>
<id>idone</id>
<name>nameone</name>
<designation>designationOne</designation>
<company>companyOne</company>
</Global>
<Global>
<id>idtwo</id>
<name>nametwo</name>
<designation>designationtwo</designation>
<company>companytwo</company>
</Global>
</outer>
The output should be in row format:
idone nameone designationOne companyOne
idtwo nametwo designationtwo companytwo
I have applied:
LINE_BREAKER = (<Global>)
MUST_BREAK_AFTER = \</Global\>
in props.conf, but it didn't work.
Please suggest me the correct configuration to be entered in props.conf to get my required output.
Thanks in advance
... View more
05-25-2015
04:02 AM
1 Karma
I need to schedule a saved search for every 30 seconds, but I find the Basic one minute as the minimum schedule, which is also same in crons, please suggest is any other way to schedule for seconds.
... View more
- Tags:
- scheduled-search
