About ChetanArgekar

ChetanArgekar · ‎03-17-2021

I am having Structure data files for which I did field extraction using Splunk field delimiter in development box. when I packaged the app and placed it in production it is not working. I checked the permission and it is global. data looks like this file name windows_patch.log Step_Execution_Time~^~Applications~^~Server~^~Step_Name~^~Step_Status~^~Step_Logs~^~Step_Comment 13-01-2021 12:09:39 PM~^~SAP,SQL,Oracle~^~test2k19.testmbs.com~^~Connect to WSUS~^~Success~^~WinRM service is already running on this machine.\r\nWinRM is already set up for remote management on this computer.\r\n~^~ Connected to WSUS cidsuswuraeuw02.testmbs.com successfully. 13-01-2021 12:09:41 PM~^~SAP,SQL,Oracle~^~test2k19.testmbs.com~^~Loading PowerShell Modules on Target Host~^~Success~^~\nPowershell Output:\n~^~Fetch patches details successfully to apply on Target Hosttest2k19.testmbs.com. Props.conf [Windows_Pre_Patching] REPORT-Patch-Windows_Pre_Patching = REPORT-Patch-Windows_Pre_Patching transforms.conf [REPORT-Patch-Windows_Pre_Patching] DELIMS = "~^~" FIELDS = "Step_Execution_Time","field2","field3","Applications","field5","field6","Server","field8","field9","Step_Name","field11","field12","Step_Status","field14","field15","Step_Logs","field17","field18","Step_Comment","Step_Comment" please guide

ChetanArgekar · ‎02-18-2021

It worked thanks for help

ChetanArgekar · ‎02-16-2021

None of my configurations in props.conf is working and entire file is coming as single event HEADER_FIELD_LINE_NUMBER = 1 is also not working Data is server patching data CHG0030338_Linux_Executive_Summary.log Change_Request_Number$$@@$$Planned_Start_Date$$@@$$Planned_End_Date$$@@$$CR_Type$$@@$$Type$$@@$$Application$$@@$$Total_Servers$$@@$$Servers_Successfully_Patching$$@@$$Servers_Failed_Patching$$@@$$Servers_Skipped_Patching CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Total$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0 CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Rhel$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0 CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$CentOS$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0 CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Suse$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0 inputs.conf [monitor:///opt/splunkforwarder/patch/*Summary*.log] disabled = 0 index = patch_dummy sourcetype = patch_summary crcSalt = <SOURCE> props.conf [patch_summary] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false HEADER_FIELD_LINE_NUMBER = 1 TRANSFORMS-sourcetype = patch_sourcetype TRANSFORMS-route = patch-monitoring-route transforms.conf [patch-monitoring-route] REGEX = . DEST_KEY =_TCP_ROUTING FORMAT = acn-dev1-route-group [patch_sourcetype] REGEX = . DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::patch

ChetanArgekar · ‎01-20-2021

I am having index (server_patching) which contain the details like changeNo, patching date etc of server which are patched on given date and Lookup table with lists all the servers which are present in my environment. lets say I have 10 servers in lookup table (1,2,3,4,5,6.......10) out of which server 12,3 are patched on Nov 1st with patch number p1,p2,p3 server 4,5,6,7,8 are patched on Dec 1st with patch number p4,p5,p6,p7,p8 Server 9,10 are patched in Jan 1st with patch number p9,p10 I want to write query which should give me the server name and patch number which are not patched in given time. example if I select Jan1 I should get result Server 1,2,3,4,5,6,7,8 Patch number p1,p2,p3,p4,p5,p6,p7,p8 thanks In advance

ChetanArgekar · ‎09-19-2020

Solved. index = myindex | lookup mylookup location OUTPUT devices | stats count(devices) by location, devices | table devices

ChetanArgekar · ‎09-19-2020

thanks It is giving only one device of location. I want list of every device of the location in separate row

ChetanArgekar · ‎09-19-2020

I have multiple devices in a given location maintaining it lookup table with location and device. Using location from index I am trying to get device list but output is coming in single row. I want list of devices as separate row. How to achieve it. My query is like this index =myindex | lookup mylookup location OUTPUT devices | table devices

ChetanArgekar · ‎01-01-2020

I am having 2 scheduled python scripts running in HF. First script is scheduled for 2 mins and get SNMP data and forwards to Indexer1 (IP:xx.xx.xx.123) second script is scheduled for 2 mins and collects the JMX data and forwards to Indexer2.( IP:yy.yy.yy.123) My problem is I am able to get data in only one indexer at a time. either indexer1 or Indexer2 not both. Is there any system limitations from splunk that only one script runs at a time and forwards to 1 indexer.

ChetanArgekar · ‎12-04-2019

Thanks for help. In worked

ChetanArgekar · ‎12-04-2019

HI, I am receiving data from Solarwinds Server and it is in following format November 27, 2019 8:34 AM I need to convert it in to DD/MM/YYYY HH:MM format. how to do this

ChetanArgekar · ‎07-24-2018

I am not able to find Splunk mobile app in iOS or Google stores. Any idea when it will be available for users.

Posts	11
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-21-2016

Online Status	Offline
Date Last Visited	‎03-17-2021 09:05 AM

Field extraction using delimiter

COnfiguration in props.conf not working

Looking for exclusion query

lookup multi value

can Splunk HF run multiple Python scripts and forw...

change date format

SPlunk Mobile app for iOS appsStore and Google pla...