Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- About Sujithkumarkb
Sujithkumarkb
Observer
Member since:
07-04-2019
04-02-2021
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-04-2019 |
Activity Feed
- Posted Event breaking does not work for SMS debug and SMPP debug logs on Getting Data In. 04-01-2021 07:07 AM
- Posted Re: Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-18-2020 02:59 AM
- Posted Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Tagged Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Tagged Indexed data vanishes after few hours and cause 0 events for 2 3 hours time frame in a day on Splunk Enterprise. 02-14-2020 04:22 AM
- Posted Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Tagged Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Tagged Splunk shows no logs (0 events) on it for some amount of time in a day .) 0 event count on splunk though the monitored logs have data on Monitoring Splunk. 02-14-2020 02:32 AM
- Posted How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Tagged How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Tagged How can I break events within events? on Splunk Search. 01-20-2020 03:40 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-10-2020 04:42 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-10-2020 01:26 AM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 10:22 PM
- Posted Re: How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 10:21 PM
- Posted How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Tagged How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Tagged How can i extract keywords from my log as field values for field name API's on Splunk Search. 01-09-2020 03:52 AM
- Posted Re: Extract fields out of plain text log file and assign it to a field name on Splunk Search. 12-19-2019 03:33 AM
- Posted Re: Extract fields out of plain text log file and assign it to a field name on Splunk Search. 12-19-2019 02:06 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-26-2022
04:06 AM
Wow, thanks for this thread. I didn't even think about splitting events within events. I'm still trying to figure out the Splunk search language, and I don't always get what I want the first time. I hope I won't bother anyone with my comment if I use it to "bookmark" the topic 🙂 I prefer to appear in all thematic forums and ask thousands of stupid questions to everyone. This is how I prevent possible errors, and it's better than carrying the hard drive to the file recovery procedure later due to a series of wrong actions.
... View more
04-01-2021
07:07 AM
Hi , I am trying to break events which are merging for SMS and SMPP logs. only the events with binary codes are breaking and rest are still merging.Can anyone advice how I can break events here. Props I am using is as below KV_MODE = none BREAK_ONLY_BEFORE = \d{2}:\d{2}:\d{2}:\d{3}\s+(\d+\w+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = true and KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT=%H:%M:%S:%3N 09:55:26:008 (000005A0) --IP-- --: WaitForResponseSMPP: SMPP Debug: ioctlsocket failed, no data 09:55:26:935 (000007B8) --IP-- --: WaitForResponseSMPP: SMPP Debug: ioctlsocket failed, no data 09:55:27:347 (000007D0) --IP-- --: WaitForResponseSMPP: SMPP Debug: received a submit message 09:55:27:347 (000007D0) --IP-- <-: 103 byte packet 09:55:27:347 (000007D0) --IP-- <-: 00 00 00 67 00 00 00 04 00 00 00 00 00 05 5E C1 g ^ 09:55:27:347 (000007D0) --IP-- <-: 00 00 00 36 30 30 30 30 30 30 34 00 00 00 35 32 60000004 52 09:55:27:347 (000007D0) --IP-- <-: 69 6D 57 52 36 4A 73 2F 69 31 69 41 47 4F 45 4D imWR6Js/i1iAGOEM 09:55:27:347 (000007D0) --IP-- <-: 71 75 6E 52 6E 61 71 qunRnaq SMSDebug log 10:00:11:467 [21] CHECKLF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:467 [23] CHECKLF0004LF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:640 [22] VWPRODEGOLF0004###0010\5F7ACFDA.REQ: WAIT 10:00:11:815 [5] ThreadListenForSMPPConnections: Before accept 10:00:11:815 [5] ThreadListenForSMPPConnections: After accept 10:00:11:815 [29] ThreadProcessSMPPConnection: Processing SMPP connection from IP... 10:00:11:908 [28] ThreadProcessSMPPConnection: Releasing SMPP connection from IP 10:00:11:909 [28] WaitForSocketClose: WinSock reported ioctlsocket complete
... View more
Labels
- Labels:
-
props.conf
08-19-2020
07:13 AM
@ThomasJRae have you found an answer to this? I have the same error whenever I am trying export raw data or any other format for that matter . Let me know if you have found a solution
... View more
02-14-2020
04:22 AM
I have a Clustered environment and monitoring setup for application logs,universal forwarders push data to indexers .
Lately , I have been facing issue where the application logs are getting indexed and available .
But after few hours when I search for the present day logs on splunk there are 0 events for 2 3 hours time frame and indexed data vanishes.
Not sure if this is a known issue , any help would be of much help.
Thanks
... View more
02-18-2020
02:59 AM
@to4kawa below is the output
firstTime lastTime recentTime sourcetype totalCount type
822873600 2145916799 1582023453 ABC 200882336 sourcetypes
1576767386 1582088399 1582023523 XYZ 106684712 sourcetypes
... View more
01-10-2020
04:42 AM
There is ?xml in the data , but that being extracted as the field value is not expected .
The expected extraction is OrderUpdateWithAccountInfoRequest ,VinValidationRequest,GetEntitledRequest etc shown on the raw data .
The data is api requests that are made , where i am trying to capture the API names and once filtered for it on dashboard , i will be populating its respective responses .
for example OrderUpdateWithAccountInfoRequest is a API request which i would want to add as a value in multselect and once it is selected i would populate the OrderUpdateWithAccountInfoResponse xml from raw data as output.
... View more
12-19-2019
04:08 AM
I'm sorry , I don't know props.conf
If you provide new Question of props.conf with this sample data, another professional will solve it.
... View more
08-21-2019
05:32 AM
The data in event 1 is incomplete and the rest of it is getting populated into event2 and so on .
If i am not wrong , i should break the line with the pattern example 2019-08-21T01:41:49.115-0500 INFO , 2019-08-21T01:12:53.584-0500 INFO
.Please correct me if i am wrong
event1
2019-08-21T01:41:49.115-0500 INFO 4227528 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=20190821014149112000ded8-add8d3a | DOMAIN=prd| HOST=1.5.43 | TRANS_ID=0000b8dc4ded8-add8d34 | ClIENT_IP=174.24.7.5 | HTTP_METHOD=POST|
THUMBPRINT= incomplete
event 2
"transactionId" : "1566367971_176699920"
} | RESPONSE_PAYLOAD={"response":{"responseCode":2000,"responseDescription":"Success","responseStatus":"SUCCESS"}}
2019-08-21T01:12:53.584-0500 INFO 5999 com.l7tech.log.custom.splunk.audits.log: -4: UNIQ_ID=201908210112535800000016b8daeab36-ae0accf |METHOD=GET | API_KEY= | USERNAME=C=US, ST=Georgia, L=Atlanta, O=hum, OU=33bfb1c1b2adc3b2, CN=1-1QSEZ50 | THUMBPRINT=FgjXxqpgtzeLzjMxtoQ5yco= incomplete
Can anyone help me on this ?
... View more
08-21-2019
11:41 PM
Thanks rich,
Worked fine for me .
... View more
08-27-2019
04:21 AM
hahah... yeah its annoying when this happens, you end up spending so much time troubleshooting something small like a backslash 🙂
Glad I could help, would really appreciate it if you can up-vote the answer and the comments, thank you !
... View more
07-31-2019
12:07 AM
Hi Sujithkumarkb,
I usually prefer to use always sourcetype instead source, in this way I am sure to associate the fields to a sourcetype and always have results, using source, sometimes there are errors.
About the regex, it should be different, something like this:
REGEX = AccountNum\s+(?<AccountNum>[^ ]*)\s+\/AccountNum
other parameters are OK.
Bye.
Giuseppe
... View more
07-19-2019
05:07 AM
You can do it like this:
you have to use transform to change the sourcetype like below:
props:
[source::/opt/app/logs/openam/authentication.audit.json]
TRANSFORMS-changesourcetype = newsourcetype
transforms:
[newsourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::Forgerock
... View more
07-23-2019
05:59 AM
@ashutoshab ,seems like your throttle alert is on , which will accumulate all the events every 15mins and react at once.
You can try scheduling the alert in real time with throttle disabled.
Else you can try something like below
The other way round can be to add a counter or a variable condition in your alert query like below.
example : | stats phone by state " into the search and create a custom alert trigger such as " eval count = if(search state =received,1,0) |search count =1 (in your case to trigger every event)".
Hope this helps.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-02-2021
07:14 AM
|
