Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sujithkumarkb
Sujithkumarkb
Observer
Member since:
07-04-2019
04-02-2021
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-04-2019 |
Activity Feed
- Posted Event breaking does not work for SMS debug and SMPP debug logs on Getting Data In. 04-01-2021 07:07 AM
- Posted Re: App for REST Lookup: Connection Timeout on All Apps and Add-ons. 08-19-2020 07:13 AM
- Posted Re: Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-18-2020 02:59 AM
- Posted Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Tagged Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Tagged Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Posted Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Tagged Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Tagged Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Posted How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Tagged How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Tagged How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-10-2020 04:42 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-10-2020 01:26 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 10:22 PM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 10:21 PM
- Posted How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Tagged How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Tagged How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Posted Re: Extract fields out of plain text log file and assign it to a field name on Splunk Search. 12-19-2019 03:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-01-2021
07:07 AM
Hi , I am trying to break events which are merging for SMS and SMPP logs. only the events with binary codes are breaking and rest are still merging.Can anyone advice how I can break events here. Props I am using is as below KV_MODE = none BREAK_ONLY_BEFORE = \d{2}:\d{2}:\d{2}:\d{3}\s+(\d+\w+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = true and KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT=%H:%M:%S:%3N 09:55:26:008 (000005A0) --IP-- --: WaitForResponseSMPP: SMPP Debug: ioctlsocket failed, no data 09:55:26:935 (000007B8) --IP-- --: WaitForResponseSMPP: SMPP Debug: ioctlsocket failed, no data 09:55:27:347 (000007D0) --IP-- --: WaitForResponseSMPP: SMPP Debug: received a submit message 09:55:27:347 (000007D0) --IP-- <-: 103 byte packet 09:55:27:347 (000007D0) --IP-- <-: 00 00 00 67 00 00 00 04 00 00 00 00 00 05 5E C1 g ^ 09:55:27:347 (000007D0) --IP-- <-: 00 00 00 36 30 30 30 30 30 30 34 00 00 00 35 32 60000004 52 09:55:27:347 (000007D0) --IP-- <-: 69 6D 57 52 36 4A 73 2F 69 31 69 41 47 4F 45 4D imWR6Js/i1iAGOEM 09:55:27:347 (000007D0) --IP-- <-: 71 75 6E 52 6E 61 71 qunRnaq SMSDebug log 10:00:11:467 [21] CHECKLF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:467 [23] CHECKLF0004LF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:640 [22] VWPRODEGOLF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:815 [5] ThreadListenForSMPPConnections: Before accept 10:00:11:815 [5] ThreadListenForSMPPConnections: After accept 10:00:11:815 [29] ThreadProcessSMPPConnection: Processing SMPP connection from IP... 10:00:11:908 [28] ThreadProcessSMPPConnection: Releasing SMPP connection from IP 10:00:11:909 [28] WaitForSocketClose: WinSock reported ioctlsocket complete
... View more
Labels
- Labels:
-
props.conf
08-19-2020
07:13 AM
@ThomasJRae have you found an answer to this? I have the same error whenever I am trying export raw data or any other format for that matter . Let me know if you have found a solution
... View more
02-18-2020
02:59 AM
@to4kawa below is the output
firstTime lastTime recentTime sourcetype totalCount type
822873600 2145916799 1582023453 ABC 200882336 sourcetypes
1576767386 1582088399 1582023523 XYZ 106684712 sourcetypes
... View more
02-14-2020
04:22 AM
I have a Clustered environment and monitoring setup for application logs,universal forwarders push data to indexers .
Lately , I have been facing issue where the application logs are getting indexed and available .
But after few hours when I search for the present day logs on splunk there are 0 events for 2 3 hours time frame and indexed data vanishes.
Not sure if this is a known issue , any help would be of much help.
Thanks
... View more
02-14-2020
02:32 AM
I have a clustered splunk environment and monitoring in place for quite a few application logs.
Lately , I have been encountering an issue with data collection in Splunk .
For some frame of time everyday(2 to 5 hours) , I do not see any data even though the application server has logs generated.
But for the rest of the day it works just fine .
Universal Forwarders and indexers are working just fine.
This is affecting the dashboards and alerts , as the data is been missed out .
Example log:
2020-02-13T05:01:45.249-0500 INFO 801 | UNIQ_ID=2AB2130 | TRANS_ID=00000170151fda6c-171dce8 | VERSION=18.09 | TYPE=AUDIT| UTC_ENTRY=2020-02-13T10:01:45.178Z | UTC_EXIT=2020-02-13T10:01:45.230Z,"Timestamp":"2020-02-13T10:01:45.062Z","Data":{"rsCommand":"","rsStatus":"executed","pqr":"2020-02-13T09:57:13.000Z","rsStatusReason":"executed","XYZ":"2020-02-13T09:57:29.000Z","rsMinutesRemaining":"6","remoDuration":"10","internTemperature":"12","ABC":"2020-02-13T10:00:20.000Z","Sucction"}}
Can anyone give some insight ,If you have faced or come across this kind of issue.
I suspect Splunk is getting confused with the time format of the actual event and the time and year value format inside the event likeabc,pqr,xyz timestamp in the example log above.. But doesn't help me how to go about and solve this issue.
... View more
01-20-2020
03:40 AM
I have middleware .out file to be monitored with Splunk. The events are breaking with respect to the time stamps as below
1/16/20 12:27:17.553 PM Jan 16, 2020 1:57:17,553 AM EST Warning Socket BEA-000449bClosing the socket, as no data read from it on ,322 during the configured idle timeout of 5 seconds.
1/16/20 12:24:17.274 PM Jan 16, 2020 1:54:17,274 AM EST Error oracle.soa.management.internal.ejb.impl.FacadeFinderBeanImp BEA-000000 No Facade Fault Recovery Service found for Engine type : service
But i have an event in this log file which is breaking based on time stamp but single event isgoing beyond 800 1000lines . sample event below
Jan 16, 2020 1:54:05,062 AM EST Error oracle.soa.bpel.engine.dispatch BEA-00000 Transaction rolledback, Transaction key = Name=[EJB ** Cikey: 100174 ** ComponentDN: default/CommsProcessFulfillmentOrderBillingAccountListEBF!1.0*soa_50970aa3-f91e-430a-83db-70b3c1beafd9/CommsProcessFulfillmentOrderBillingAccountListEBF ** FlowId: 100048
** Set of Audit Events in currently rolledback transaction:
** Scope Id: 0 ** Audit Event Date: Thu, 16 Jan 2020 01:54:04.300 EST ** Audit Message: New instance of BPEL process "1.0" initiated (# "CommsProcessFulfillmentOrderBillingAccountListEBF").
** Audit Detail: null
** Scope Id: BpSeq13.3 ** Audit Event Date: Thu, 16 Jan 2020 01:54:04.301 EST ** Audit Message: Received "initiate" call from partner "client" ** Audit Detail: CommsProcessFulfillmentOrderBillingAccountListReqMsg part name="ProcessFulfillmentOrderBillingAccountListEBM" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"bProcessFulfillmentOrderBillingAccountListEBM ** Audit Event Attributes: ** wikey: 100174-BpRcv0-BpSeq13.3-1 ** label: receiveInput
** state: 5
** Scope Id: BpSeq13.3 ** Audit Event Date: Thu, 16 Jan 2020 01:54:04.302 EST ** Audit Message: bpelx:exec executed ** Audit Detail: null ** Audit Event Attributes: ** wikey: 100174-BxExe0-BpSeq13.3-2 ** label: Set_Title ** state: 5
This event is more than 1000lines with lot of scope ID paragraph and I get a Show all 800lines message , and when I expand the Splunk goes into hung state. Though i can use Truncate and max_events value in props , how can i handle or break one big event with more than 800 lines based on the ScopeID and also keep other events breaking based on timestamp as well .
... View more
Labels
- Labels:
-
other
01-10-2020
04:42 AM
There is ?xml in the data , but that being extracted as the field value is not expected .
The expected extraction is OrderUpdateWithAccountInfoRequest ,VinValidationRequest,GetEntitledRequest etc shown on the raw data .
The data is api requests that are made , where i am trying to capture the API names and once filtered for it on dashboard , i will be populating its respective responses .
for example OrderUpdateWithAccountInfoRequest is a API request which i would want to add as a value in multselect and once it is selected i would populate the OrderUpdateWithAccountInfoResponse xml from raw data as output.
... View more
01-10-2020
01:26 AM
@TISKAR , that works . This way i can extract one API at a time , But there are more than 400 APIs like OrderUpdateWithAccountInfoRequest ..
How can I generically run Rex and extract all APIs under the field API and save them as extracted field values
... View more
01-09-2020
10:22 PM
@TISKAR , thanks for your response but this rex is extracting only the value "Smile" and not OrderUpdateWithAccountInfoRequest ,VinValidationRequest,GetEntitledRequest ...
... View more
01-09-2020
10:21 PM
@richgalloway Thanks for the response , but this rex is extracting only the value "?xml" and not OrderUpdateWithAccountInfoRequest ,VinValidationRequest,GetEntitledRequest ...
... View more
01-09-2020
03:52 AM
How can i extract the below block letter keywords (OrderUpdateWithAccountInfoRequest ,VinValidationRequest,GetEntitledRequest ..)from my log as field values for field name API's?
2020-01-09 03:58:08,280 INFO com.hti.gw.interceptor.ServiceInterceptor (Hughes_Tre13342)
<OrderUpdateWithAccountInfoRequest ** xmlns:ns5=".......
2020-01-08 06:25:25,836 INFO com.vzt.pg.AbstractMiddlewareDelegate (AMP_RptDqckdAsT5ldcFG8eh_tdzbmtxux44z850) <VinValidationRequest** xmlns:ns2="http://www.hughestelematics.com.....
2020-01-08 06:25:25,546 INFO com.vzt.pg.AbstractMiddlewareDelegate (AMP_RptDqckdAsT5ldcFG8eh_tdzbmtxux44z850) <GetEntitledRequest xmlns:ns2="ht......
2020-01-08 06:20:13,637 INFO com.vzt.pg.AbstractMiddlewareDelegate
(AMP_RptDqckdAsT5ldcFG8eh_9wiiwnvakzcdc66) <VinValidationRequest xmlns:ns2="http:/......
... View more
12-19-2019
03:33 AM
@to4kawa , sorry may be i was not clear.
I meant using Props , how can i extract these fields using regex , because i do not see a pattern for the fields i want to extract.
... View more
12-19-2019
02:06 AM
@to4kawa , thanks .
But , What if i want to extract fields during index time ?
... View more
12-18-2019
02:48 AM
I want to extract the below values during index time
1. extract WDDZF4KB3JA469368 ,ABCDE4KB3JA469368 and so on and assign it to a field name called VINnumber.
2. extract ConfigureServiceStatusMBIISProvABCSImpl, QuerySubscriptionListSiebelProvABCSImpl ,VINValidationProcess and so on and assign it to field name called services.
ist item2019-12-17T19:35:20.571-05:00|ConfigureServiceStatusMBIISProvABCSImpl|MBIIS|2837822832|0396771d-0879-4246-b9e9-e31328260eb3-04d362c7|SUCCESS|VIN-WDDZF4KB3JA469368|
2019-12-17T19:35:20.571-05:00|ConfigureServiceStatusMBIISProvABCSImpl|MBIIS|2837822832|0396771d-0879-4246-b9e9-e31328260eb3-04d362c7|SUCCESS|VIN-ABCDE4KB3JA469368|
2019-12-17T19:35:18.076-05:00|QuerySubscriptionListSiebelProvABCSImpl|SIEBEL|2837822838|0396771d-0879-4246-b9e9-e31328260eb3-04d362c7|FAILED|VIN-WDDZF4KB3JA469368|AccId-NoValueFound|Business Fault:Agree# Missing
2019-12-17T19:35:18.587-05:00|VINValidationProcess|SIEBEL|2837822846|0396771d-0879-4246-b9e9-e31328260eb3-04d362c7|SUCCESS|VIN-WDDZF4KB3JA469368|
2019-12-17T19:35:18.076-05:00|QuerySubscriptionListSiebelProvABCSImpl|SIEBEL|2837822838|0396771d-0879-4246-b9e9-e31328260eb3-04d362c7|FAILED|VIN-WDDZF4KB3JA469368*|AccId-NoValueFound|Business Fault:Agree# Missing*
I understand search time extraction is better for performance .
I tried to extract during search time like below with a bit of luck , but data is
index=ABC sourcetype=XYZ WDDZF4KB3JA469368
| rex field=_raw "(?WDDZF4KB3JA469368.+)\""
but the value i am getting in the field is quite extra VIN= WDDZF4KB3JA469368,,,Cathy,"Wright",,"6278 Harbour Heights Pkwy
... View more
08-27-2019
04:07 AM
Thanks soo much David, both the solutions works perfect for me .
A Backslash played me pretty well.
Cheers 🙂
... View more
08-27-2019
03:30 AM
i checked both the regex and few of mine as well , extraction isnt happening
Below xml for refernce
D Tue Jul 30 11:39:01 2019 /opt/app/BRM/workspace
<?xml version="1.0" encoding="UTF-8"?>
<Response>
<NewOrderResp>
<MerchantID>111</MerchantID>
<TerminalID>001</TerminalID>
<AccountNum>XXXXXXXXXXXX7133</AccountNum>
<OrderID>T1,1822d,4</OrderID>
<OrbitalConnectionUsername>ABC123</OrbitalConnectionUsername>
<OrbitalConnectionPassword>ZXY567</OrbitalConnectionPassword>
</NewOrderResp></Response>
... View more
08-27-2019
03:14 AM
@DavidHourani doesnt work ... 😞
The field extraction isnt happening nor the masking with the suggested regex
... View more
08-26-2019
11:42 PM
Hi @DavidHourani
Any suggestions on this ?
Presently i am getting data populated as below , which is not in between tags.
$AccountNum=########
OrderIDT1 18609,875D5F7D7D07939FDBBF37179FD7AC20474166545B20100B /OrderID
TxRefNum 5D5F7D7D07939FDBBF37179FD7AC20474166545B /TxRefNum
... View more
08-22-2019
06:07 AM
raw data : tagopenOrbitalConnectionUsername >ABCD tagcloseOrbitalConnectionUsername>
Desired result is as below xml format as tags,(unable to paste >< here as tags)
expected :tag open **OrbitalConnectionUsername>########## **tag closeOrbitalConnectionUsername>
presently after the above mentioned props and transforms , i am getting data as OrbitalConnectionUsername=####### with no tags at all .
the entire raw data is an xml and to keep the format of the masked field i need OrbitalConnectionUsername also as tag as shown above.
Is there any other way i can send the raw data to you , if this is not clear ?
... View more
08-22-2019
04:58 AM
Hi @DavidHourani
I am able to extract the field and mask it , but the xml tags not showing up anymore on the events.
I am getting OrbitalConnectionUsername =###### as of now ,
expected is OrbitalConnectionUsername ######### OrbitalConnectionUsername as xml tags
Below props and transforms for reference.
inputs.conf
[monitor://path]
disabled = false
sourcetype = BRM
transforms.conf
[username-anonymizer2]
REGEX = OrbitalConnectionUsername(?OrbitalConnectionUsername.+)\/OrbitalConnectionUsername(.*)
FORMAT = $1OrbitalConnectionUsername=########$2
DEST_KEY = _raw
props.conf
[BRM]
TRANSFORMS-anonymize = username-anonymizer2,
... View more
08-21-2019
11:41 PM
Thanks rich,
Worked fine for me .
... View more
08-21-2019
05:32 AM
The data in event 1 is incomplete and the rest of it is getting populated into event2 and so on .
If i am not wrong , i should break the line with the pattern example 2019-08-21T01:41:49.115-0500 INFO , 2019-08-21T01:12:53.584-0500 INFO
.Please correct me if i am wrong
event1
2019-08-21T01:41:49.115-0500 INFO 4227528 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=20190821014149112000ded8-add8d3a | DOMAIN=prd| HOST=1.5.43 | TRANS_ID=0000b8dc4ded8-add8d34 | ClIENT_IP=174.24.7.5 | HTTP_METHOD=POST|
THUMBPRINT= incomplete
event 2
"transactionId" : "1566367971_176699920"
} | RESPONSE_PAYLOAD={"response":{"responseCode":2000,"responseDescription":"Success","responseStatus":"SUCCESS"}}
2019-08-21T01:12:53.584-0500 INFO 5999 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=201908210112535800000016b8daeab36-ae0accf |METHOD=GET | API_KEY= | USERNAME=C=US, ST=Georgia, L=Atlanta, O=hum, OU=33bfb1c1b2adc3b2, CN=1-1QSEZ50 | THUMBPRINT=FgjXxqpgtzeLzjMxtoQ5yco= incomplete
Can anyone help me on this ?
... View more
08-21-2019
01:22 AM
The data in event 1 is incomplete and the rest of it is getting populated into event2 and so on .
If i am not wrong , i should break the line with the pattern example 2019-08-21T01:41:49.115-0500 INFO , 2019-08-21T01:12:53.584-0500 INFO
.Please correct me if i am wrong.
Or if there is any suggestion I am open for it.
event1
*2019-08-21T01:41:49.115-0500 INFO * 4227528 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=20190821014149112000ded8-add8d3a | DOMAIN=prd| HOST=1.5.43 | TRANS_ID=0000b8dc4ded8-add8d34 | ClIENT_IP=174.24.7.5 | HTTP_METHOD=POST | API_KEY= | USERNAME= | THUMBPRINT= | VERSION= | TOKEN_IN=eyJ0eXAiOiJKV1QiLCJDLUhTMjU2In0..UjpmXVx78UWFhn2bPKC-6A.GYpHe9T_r0qkN7AYFdl36vJ7FgT7wWCdyo0WdefoO_uylQn50f5rQ6Z7fSFH1bO2uCt.KSJgQKyu4vrAjadR_gmQYA | TOKEN_OUT= | CLIENT_CERT= | UTC_ENTRY=2019-08-21T06:41:49.009Z | UTC_EXIT=2019-08-21T06:41:49.109Z | OVERALL_LATENCY=100 | HTTP_EPAT_CODE= | HTTP_GUA_CODE= | HTTP_TCU_CODE= | HTTP_BACKEND_CODE=200 | RESPONSE_ERROR_CODE=0 | }} | RESPONSE_PAYLOAD={
"response" :
"responseCode" : 2000,
"responseDescription" : "Success",
"responseStatus" : "SUCCESS"
"header" :
"sourceName" : "android",
"transactionId" : "11876293482790932490877227828", incomplete*
event 2
"transactionId" : "1566367971_176699920"
} | RESPONSE_PAYLOAD={"response":{"responseCode":2000,"responseDescription":"Success","responseStatus":"SUCCESS"}}
*2019-08-21T01:12:53.584-0500 INFO * 5999 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=201908210112535800000016b8daeab36-ae0accf |METHOD=GET | API_KEY= | USERNAME=C=US, ST=Georgia, L=Atlanta, O=hum, OU=33bfb1c1b2adc3b2, CN=1-1QSEZ50 | THUMBPRINT=FgjXxqpgtzeLzjMxtoQ5yco= | VERSION= | 9vtQVQQXQo08MQUHtJvKuqiT82hKHbV6CZ-| UTC_EXIT=2019-08-21T06:12:53.569Z | OVERALL_LATENCY=86 | HTTP_EPAT_CODE= | HTTP_GUA_CODE= | HTTP_TCU_CODE= | HTTP_BACKEND_CODE= | RESPONSE_ERROR_CODE=0 | RESPONSE_HTTP_CODE= | STATUS_MESSAGE=Message processed successfully | USERID=1-1QSEZ50 | OAM_CODES= | BACKEND= | BACKEND_LATENCY=73 | TYPE=AUDIT | UPGRADE_STATUS=| REQUEST_PAYLOAD=28adca:1812189:HTTP/1.1TEXT24.211.102.17400
"httpHeaders":
"APIKey": "2683853a11455c990",
"AppSystem": "android",
"AppVersion": "6.072.1933.26",
"Authorization" : "**",
"OSVersion": "9"
/data/websocket/request | RESPONSE_PAYLOAD= *incomplete**
Can anyone help me on this ?
Props:
[sourcetype]
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
disabled = false
pulldown_type = true
... View more
08-04-2019
11:59 PM
Thanks David for the reference .
It worked just fine for me .
cheers
Sujith
... View more
08-02-2019
03:43 AM
Hi gaurav,
Below data for reference .Regex which i have used is same for all field extractions in the below xml.
Can we mask AccountNum and OrderID with "XXXs"
?xml version="1.0" encoding="UTF-8"?
Response>NewOrderResp
AccountNum 129865THGT982000/AccountNum
OrderIDT1,1828a,62/OrderID
/NewOrderResp/Response
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-02-2021
07:14 AM
|
