Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jincy_18
jincy_18
Path Finder
Member since:
09-12-2016
10-02-2024
Community Statistics
| Posts | 31 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 09-12-2016 |
Activity Feed
- Karma Re: Having source ip from 3 sourcetypes, how do I combine them all in one field and table the results? for gcusello. 06-05-2020 12:49 AM
- Got Karma for Re: Using regex to extract a string where the following string may or may not exist. 06-05-2020 12:49 AM
- Got Karma for How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ.. 06-05-2020 12:49 AM
- Posted Does Solaris OS support splunk db connect 2.4.1? on All Apps and Add-ons. 12-28-2018 01:26 AM
- Tagged Does Solaris OS support splunk db connect 2.4.1? on All Apps and Add-ons. 12-28-2018 01:26 AM
- Posted How to index and use unstructured huge volume of data - Splunk HWF and SH cluster? on Getting Data In. 11-01-2018 04:36 AM
- Tagged How to index and use unstructured huge volume of data - Splunk HWF and SH cluster? on Getting Data In. 11-01-2018 04:36 AM
- Tagged How to index and use unstructured huge volume of data - Splunk HWF and SH cluster? on Getting Data In. 11-01-2018 04:36 AM
- Tagged How to index and use unstructured huge volume of data - Splunk HWF and SH cluster? on Getting Data In. 11-01-2018 04:36 AM
- Posted Re: Vertical headers in dashboards on Splunk Search. 02-27-2018 09:46 PM
- Posted Re: Vertical headers in dashboards on Splunk Search. 02-26-2018 05:14 AM
- Posted Re: How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. on Getting Data In. 02-23-2018 02:02 AM
- Posted How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. on Getting Data In. 02-22-2018 11:38 PM
- Tagged How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. on Getting Data In. 02-22-2018 11:38 PM
- Tagged How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. on Getting Data In. 02-22-2018 11:38 PM
- Tagged How can we override Splunk's eventtime with timestamp value present in the event data coming from JMS MQ. on Getting Data In. 02-22-2018 11:38 PM
- Posted How to know if data inputs are enabled/disabled using splunk query? on All Apps and Add-ons. 11-28-2017 05:19 AM
- Tagged How to know if data inputs are enabled/disabled using splunk query? on All Apps and Add-ons. 11-28-2017 05:19 AM
- Posted Re: How to configure alert for JMS - queue connection status? on All Apps and Add-ons. 11-22-2017 12:40 AM
- Posted How to configure alert for JMS - queue connection status? on All Apps and Add-ons. 11-21-2017 05:13 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-28-2018
01:26 AM
Hi ,
I'm trying to configure splunk db connect 2.4.1. The environment is running on Solaris OS with Splunk Enterprise 6.2.2 set as heavy forwarder.
The issue I'm facing is the JRE status still shows red and the JRE path, JVM options that is configured in settings tab is not getting saved.
Please suggest if there is a work around for this.
Thanks in Advance.
... View more
11-01-2018
04:36 AM
Hi All,
We are working on a clustered environment where splunk is fetching logs from various servers. In the source server we have set up splunk heavy weight forwarder which forwards the data to the load balanced HWF then to indexers.
Now the issue we face is that our logs are in nested json/ unstructured format and is of huge volume. This is making the searches too slow and crash.
We have tried index time extractions but that is also slower due to the volume.
Could you please suggest a work around for this.
TIA
... View more
02-27-2018
09:46 PM
Hi Marios, Could share a screenshot, for understanding this better? cause I was able to fix this issue with width and height parameters in th/td and it worked for me.
... View more
02-26-2018
05:14 AM
Hi,
Have you tried using width and height attributes in the css. It should do the trick for you. Do the same for td elements if required.
th
{
width: 50px !important;
height: 30px !important;
transform: rotate(90deg);
}
... View more
02-23-2018
02:02 AM
Thanks Rajesh,
Just to add on in our case the timestamp value will be an epoch value, will this pose an issue?
... View more
02-22-2018
11:38 PM
1 Karma
I am fetching message queue message from JMS app in Splunk Enterprise 6.4.1. All the fields of the event are being extracted at indextime. I want to override the eventtime(_time) with the value present in the message(header timestamp). Please suggest how can this be achieved?
... View more
11-28-2017
05:19 AM
Hi,
We are using jms app to connect to various MQs. I need to know how I can get the info whether inputs are enabled or disabled via a splunk search query. Not really sure if splund_access.log can be used for this purpose.
Many thanks!
... View more
11-22-2017
12:40 AM
Thanks Damien,
I tried this, but we have multiple apps running on same servers using various queue connections. Could it be possible to get the errors for a specific queue?
... View more
11-21-2017
05:13 AM
Hi,
We are using jms app to connect to various MQs. I need to get a triggered alert if there is any issue in the connectivity. How to we achieve this?
Is there something available similar to dbx_health log we use for DBConnect app?
... View more
11-07-2017
11:11 PM
Got a solution for this.
We used javascript to add our own customized div tags which changes on search result and used css for the appropriate styling. Sample snippet for adding div tags:
var div = document.createElement('div');
div.className = 'statusbar';
div.id = 'statusbar';
div.innerHTML = '<ul><li id="dbstatus1" >DB1 : <div id="dbstatus1-icon"></div></li><li id="filestatus" >FILE: <div id="filestatus-icon"></div></li></ul>';
var p= document.getElementsByClassName('header splunk-header splunk-view')[0]
p.appendChild(div);
... View more
10-13-2017
06:41 AM
Hi Nadal7noval,
You can try below:
(?<ERROR>(ERROR:.+?){2})(?=cause\:\s\[)
OR
(?<ERROR>(ERROR:.+?){2})(?=cause\:)
... View more
10-11-2017
11:44 PM
I have a requirement where I need to show multiple DB connectivity status icons right below the apps navigation bar.
Also, I need this to be visible throughout the app, irrespective of which dashboard I navigate to.
Is it possible for any app to have multiple app-bars? How to achieve this?
Alternatively how can we add a div tag below existing app-bar, to customize it with different color and add custom icons to it?
Any other way to achieve this?
Thanks in advance !
... View more
10-11-2017
10:54 PM
Hi rhys,
Have you checked if the space characters are actually spaces or tabs?
Also, in the sample you provided, " Some Text 1 Some Text 2", is " Some Text 1 " always present, I mean is it the same always, like wise for "Some Text 2" when ever it is present is it the same?
... View more
10-11-2017
05:13 AM
@Nadhiya123
This might help.
https://answers.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value.html
... View more
10-11-2017
03:03 AM
1 Karma
Hi rhyjones,
Are you trying to extract these fields using search query ie, rex command or doing it in transforms for index time?
For search query, you can try below regex with rex command?
|rex field=FieldName "(?:Some Text 1\s+)(?P<myfield1>.+)(?=\s+Some Text 2|\",)"
Ensure you have specified field=FieldName if your event data is not coming in _raw field, where FieldName is the name of the column/field in which the string to be extracted is present.
... View more
10-10-2017
10:46 PM
Hi DalJeanis,
Thanks for the suggestion. We were trying to go with option 3 , but the problem is that daylight start and end date is different for various countries. Due to this the offset too varies. We were looking for something more generic and simple in order to avoid performance issues.
... View more
10-10-2017
07:29 AM
Hi ,
We are working on a clustered environment, having multiple apps all running on default server timezone (Europe/London). Each app has respective user roles defined. And we fetch data from MQs and databases in UTC zone. In one of the apps, we need to show all dashboard panels with time fields as per America/NewYork.
Since there are multiple users who login , also these users who have multiple roles (of various apps ) assigned to them , we are facing issues to achieve this.
I have tried below options but nothing seems to work.
Setting Time-zone Role wise, as per the sample provided in the link below,
https://answers.splunk.com/answers/439363/how-to-set-a-default-timezone-for-an-entire-multis.html
Even though we set time-zone at role level, since for a user, time-zone parameter is set to default ( i.e., server time-zone), this causes role level time zone to be overridden by user level time zone.
Changing time zone at user level is tedious as every-time user switches between the app, he needs to change the timezone setting.
Adding the difference offset to time field during display on dashboard using eval. Not recommended as during daylight saving offset varies.
Please do suggest if there is any alternative to achieve app level timezone?
Thanks in advance !
... View more
10-03-2017
03:21 AM
Thank you meenal, I changed the names and it works perfectly fine.
... View more
10-03-2017
12:09 AM
Thanks hortonew , suggestions were very useful.
... View more
10-02-2017
11:29 PM
I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.I need to filter out certain unwanted events coming from jms queues and send them to the nullQueue.
We have two applications running on same servers, having different criteria for filtering event data.
I added below code in HWF in props.conf for one of the apps:
[my_sourcetype]
TRANSFORMS-set= setnull,setparsing
and this in transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = (?<=mbody=.{51}TQ-123|mbody=.{51}TQ-145)
DEST_KEY = queue
FORMAT = indexQueue
Can I use the same names property name i.e., "setnull" , "setparsing" in transforms.conf of the other app and define a new regex there? Will doing so have any impact on filtering?
... View more
09-29-2017
06:36 AM
I have two clustered environments consisting of 3 SH,3 Indexers and 1 HWF each running on Splunk 6.4.1.
I need to filter out certain unwanted events coming from jms queues and send them to the nullQueue.
I added below code in HWF in props.conf:
[my_sourcetype]
TRANSFORMS-set= setnull,setparsing
and this in transforms.conf
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[setparsing]
REGEX = (?<=mbody=.{51}TQ-123|mbody=.{51}TQ-145)
DEST_KEY = queue
FORMAT = indexQueue
This is working perfectly in one cluster environment but not working in another cluster environment . Since the conf files are the same and so is the version of the splunk forwarders ,indexers and servers, why does filtering fails on the 2nd environment.
Any suggestion as to how to debug this? Or what might be the reason for this?
Thanks !
... View more
04-10-2017
06:46 AM
Thank you Martin for your valuable inputs.
We do have a plan to move to HWF along with DBC3 but that will take some time.
Since we are currently using DBC2 in SHC, could you provide some pointers to debug mentioned issue?
Also , in the SHC we do not need to maintain the state of DB Connections and reads as even if a captain goes down, other search heads have the latest state of it and can continue processing. How do we address failover in a HWF configuration ?
... View more
04-10-2017
05:05 AM
Hi All,
We are using Splunk DB Connect 2.3 in a search head clustered environment.
While setting up a new database input, we set up the input on the DBX2 app on the deployer(not part of the search head cluster) and then do copy the splunk_app_db_connect app from "/apps/splunk/etc/apps/" to " /apps/splunk/etc/shcluster/apps"
and then run ./splunk apply shcluster-bundle -target https://searchheadclustermember:8089, to push it to search heads.
As per our understanding DB inputs run on the search head captain. But as per logs we can find "action=modular_input_not_running_on_captain", i.e. db inputs aren't always running on captain.
Does Splunk 1st queries each of the search head peer to find which one is the captain and then finally runs the input query on captain node? If not, what config changes are need to ensure inputs don't run on non-captain nodes?
Thanks ,
Jincy
... View more
10-13-2016
10:46 PM
All the lookup files are located on below path :
$SPLUNK_HOME/etc/apps/*/lookups
... View more
10-11-2016
10:38 PM
Thanks Adam.
We are not specifiying create_empty=false any where in the query. We are using a simple search query, similar to one mentioned below.
index="my_index" earliest=-0d@d and latest=now|where column1="somevalue"|table column2 column3 column4|outputlookup my_lookup.csv
... View more
