About shariefc

shariefc · ‎09-25-2018

How do I change the timezone offset for events that appear to be from the same host (but the real host and timezone is contained in the event)? RAW EVENTS: Event 1: host=HOSTA real_event_host=HOSTX real_event_time=2018-09-25T06:39:03:142-06:00 Event 2: host=HOSTA real_event_host=HOSTY real_event_time=2018-09-25T08:40:03:142-04:00 Here is how the above events get loaded: Event 1: _time=25/09/2018 06:39:03.000 (What I want is for this to now switch to the timezone of the indexer -400 i.e. 25/09/2018 08:39:03.142) host=HOSTA real_event_host=HOSTX real_event_time=2018-09-25T06:39:03:142-06:00 Event 2: _time=25/09/2018 08:40:03.321 (For this one the timezone is the same so the times should be the same) host=HOSTA real_event_host=HOSTY real_event_time=2018-09-25T08:40:03:321-04:00 **How do I either use the real_event_time as the _time and convert it to the indexer's timezone OR at the very least make the _time reflect the timezone of the event? HOSTX is in -600 timezone offset HOSTY is in -400 timezone offset Both events appear to come from HOSTA which is in -400 timezone offset because HOSTA is a log aggregator**

shariefc · ‎12-15-2016

Ping Federate has an OAUTH 2.0 add-on protocol. Does Splunk App for PingFederate support it?

shariefc · ‎09-01-2016

This worked perfctly. Thanks ryoji_solsys. transaction fields=TID WOW!!!! I think you know what I wanted better than I did. This is perfect!!!!! Thanks for all the help everyone.

shariefc · ‎09-01-2016

This worked perfctly. Thanks ryoji_solsys.

shariefc · ‎09-01-2016

Thanks sundareshr I tried this but it was not exactly what I wanted. Maybe I didn't explain myself properly.

shariefc · ‎08-31-2016

index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client" returns TID=0101010101 client_id=my_client action=response status=ERROR TID=0101010102 client_id=my_client action=response status=ERROR TID=0101010103 client_id=my_client action=response status=ERROR Now I want to take the list of Errored TIDs the first search returns and do another search that returns everything related to each TID including the parts that were successful. TID=0101010101 client_id=my_client action=request status=SUCCESS TID=0101010101 client_id=my_client action=begin status=SUCCESS TID=0101010101 client_id=my_client action=middle status=SUCCESS TID=0101010101 client_id=my_client action=end status=SUCCESS TID=0101010101 lient_id=my_client action=response status=ERROR ... TID=0101010102 client_id=my_client action=request status=SUCCESS TID=0101010102 client_id=my_client action=begin status=SUCCESS TID=0101010102 client_id=my_client action=middle status=SUCCESS TID=0101010102 client_id=my_client action=end status=SUCCESS TID=0101010102 lient_id=my_client action=response status=ERROR ... TID=0101010103 client_id=my_client action=request status=SUCCESS TID=0101010103 client_id=my_client action=begin status=SUCCESS TID=0101010103 client_id=my_client action=middle status=SUCCESS TID=0101010103 client_id=my_client action=end status=SUCCESS TID=0101010103 client_id=my_client action=response status=ERROR

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎08-31-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Can you help me change the timezone offset for eve...

Does Splunk App for PingFederate support the OAUTH...

How do I search for the Errored Transaction_IDs ON...

Can you help me change the timezone offset for eve...

Does Splunk App for PingFederate support the OAUTH...

Re: How do I search for the Errored Transaction_ID...

Re: How do I search for the Errored Transaction_ID...

Re: How do I search for the Errored Transaction_ID...

How do I search for the Errored Transaction_IDs ON...