About jayakumar89

jayakumar89 · ‎03-21-2018

@tiagofbmm, it really helped. Forgot to update. Thanks For your response!

jayakumar89 · ‎03-12-2018

I would like to find the oldest timestamp of events available for search (with respect to sourcetype) in an index. Metadata shows the oldest timestamp when data was indexed, but the actual data might have rolled off because of retention policies. Appreciate your help!

jayakumar89 · ‎12-04-2017

It helped. Thanks!

jayakumar89 · ‎12-01-2017

I have this: {"date": null, "facility": -1, "host": null, "level": -1, "message": "2017-11-13T03:45:00+0000 monStatsLog, applianceName=xxxxx, tenantName=xxxx, mstatsTimeBlock=1510544700, tenantId=1, vsnId=0, mstatsTotSentOctets=250, mstatsTotRecvdOctets=0, mstatsTotSessDuration=26001, mstatsTotSessCount=1, mstatsType=sdwan-acc-ckt-app-stats, mstatsId=tftp:Controller1:MPLS:1:2, mstatsAttribs=1:3:general-internet:file-server:Unknown", "charset": "UTF-8", "remote_address": "xxxxxxx", "hostname": "xxxxxx"} I'm trying to parse a json file with entries like above, where the message field has multiple values, which are in turn delimited using comma and =. How can I parse that specific field to extract all the information?

jayakumar89 · ‎10-30-2017

I have a single row event that populates the below values and i would like to extract eventid=389643 and STATUS=FINISHED using regex. Could you help me with the regex pattern to extract these values. 2017-10-30 06:48:03,357 [pool-22-thread-1] INFO xxxxxxxxxxxxxxxxxxxxxxx - Email Sent To : xxxxxxxxxxxxxxxxxxxxxxxx From : xxxxxxxxxxxxxxxxxxxxxxxxxxxx Subject : Plan Status - 389643 FINISHED Body : Plan Status - 389643 FINISHED

jayakumar89 · ‎04-05-2017

Thanks for the info. Is it possible to make users does not have All time option at all ?

jayakumar89 · ‎04-05-2017

We have 3 custom roles (user, power user and admin) and i would like to set 24hours as default search interval or block all time option only for all users who are mapped to user role. Any help would be appreciated. TIA Jay

jayakumar89 · ‎02-06-2017

We have several Lookups defined and i would like to backup kvstore for specific Lookups (For instance i need to backup only 5 out of 200 lookup definition defined). Is there a way to do that? Splunk documentation suggests to take backup of entire mongoDB under $SPLUNK_DB/kvstore.

jayakumar89 · ‎02-01-2017

It helped. Thanks.

jayakumar89 · ‎02-01-2017

@somesonie Thanks and it works. I would like to extract the first 5 fields and provide FIELD-NAME to them. how can i do that ?

jayakumar89 · ‎01-31-2017

jayakumar89 · ‎01-24-2017

I'm trying to index CSV format inputs and the timestamp can be indicated by the fields within, rather than the time that the data actually was ingested. The only time field is in a format of “HHMMSS” . I was able to set this up and get it to work when all the numbers are present, however instead of zeros this format just has a blank. For example, 9:30AM would be 93000 and 12:15AM would be 1500. When this happens (blanks instead of leading zeros) the time is not read in correctly. it would be better if it was just ingested in the right time so a lookup does not have to be done to find the timestamp. Is there a way to read the time correctly?

Posts	12
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎08-08-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to find the oldest timestamp of an event avail...

Field-extraction on a JSON message with multiple d...

How to extract event_id and STATUS?

I need to set 24hours default search intervals for...

How to backup KV Store for specific lookups?

Extract fields during source type creation

How to properly index data from a CSV input with t...

Re: How to find the oldest timestamp of an event a...

How to find the oldest timestamp of an event avail...

Re: Field-extraction on a JSON message with multip...