Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About spisiakmi
spisiakmi
Communicator
Member since:
06-26-2019
yesterday
Community Statistics
| Posts | 56 |
| Solutions | 6 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-26-2019 |
Activity Feed
- Posted Error: External search command <file.bat> returned error code 1. on Splunk Enterprise. yesterday
- Got Karma for Re: How to use search from summary index as a condition in another search?. 4 weeks ago
- Got Karma for Re: How to create new field combined from existing fields. 4 weeks ago
- Posted Re: How to search in an index conditioned from the summary index. on Knowledge Management. a month ago
- Posted How to search in an index conditioned from the summary index. on Knowledge Management. a month ago
- Tagged How to search in an index conditioned from the summary index. on Knowledge Management. a month ago
- Posted How to define custom color of the Sankey diagram? on All Apps and Add-ons. 05-18-2020 11:56 PM
- Posted Re: How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 01:42 AM
- Posted Re: How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 12:49 AM
- Posted How to unset token if I choose other values from dropdown on Dashboards & Visualizations. 04-29-2020 12:32 AM
- Posted Re: Wrong indexed fields. on Getting Data In. 04-14-2020 07:23 AM
- Posted Wrong indexed fields. on Getting Data In. 04-03-2020 04:52 AM
- Tagged Wrong indexed fields. on Getting Data In. 04-03-2020 04:52 AM
- Posted Re: How to search in index with a condition from another index on Splunk Search. 11-18-2019 05:34 AM
- Posted How to search in index with a condition from another index on Splunk Search. 11-14-2019 01:03 AM
- Tagged How to search in index with a condition from another index on Splunk Search. 11-14-2019 01:03 AM
- Tagged How to search in index with a condition from another index on Splunk Search. 11-14-2019 01:03 AM
- Posted Re: How to ignore concrete rows from csv file before indexing? on Splunk Search. 10-14-2019 06:33 AM
- Posted Re: Problem with optimization of the regex: limits.conf on Splunk Search. 10-11-2019 05:50 AM
- Posted Re: Problem with optimization of the regex: limits.conf on Splunk Search. 10-06-2019 11:47 PM
yesterday
Hi. I create simple file.bat file, which I placed it into .etc/apps/appname/bin I created commands.conf in ./etc/apps/appname/local and its content is: [sps_export_vitocharge] filename = sps_export_vitocharge.bat chunked = true I restarted teh Splunk instance I try to run this search: my_search | outputcsv sps_export_vitocharge | script sps_export_vitocharge and I receive error message: Error: External search command <file.bat> returned error code 1. The file.bat is only simple move of this generated csv file. It works from the shell window. Can anybody help me, please?
... View more
Labels
a month ago
Hi 493669. Your answer/help is amazing. It works absolutely great. Thank you very much.
... View more
a month ago
Hi. I have summary index_sum, which has 2 events, 2 attributes:
A1sum, A2sum 1590482539, 7722527 1591080961, 7722525
I have also index2, where a lot of time events are stored. The index time time is important. I want to search the max(A1sum) from indexsum and use this value to filter values from the index2. something like this: index2 | where _time>max(A1sum)
can you help me, please, with this problem?
... View more
Labels
05-18-2020
11:56 PM
Hi, it is possible to change the default color of the sankey diagram? E.g. in xml. I have very simple sankey diagram with 1 start point and 10 end points. I want to change the color of the start point. Can you help me, please?
... View more
04-29-2020
01:42 AM
Hi vnravikumar,
unbelievable. Really many thanks for such perfect solution. And it is so simple.
... View more
04-29-2020
12:49 AM
Hi vnravikumar,
this is the set of all values of the dropdown:
1;2;3;4;5;6;7;8;9;10.
The default value of the dropdown ist 3.
Many objects of the dashboard should be visible, if the value 3 has been choosen. Otherwise should be hidden.
So if I choose 1OR 2 OR 4 OR 5 OR 6 OR 7 OR 8 OR 9 OR 10 from the dropdown, the objects should be invisible.
... View more
04-29-2020
12:32 AM
Hi,
I have dropdown, where are 30 values. This count can be dynamically changed depends on the search. I want to show some panels, rows, objects in the dashboard ony by choosing 1 value from the dropdown. Otherwise I want to hide these objects. I can do it. I know, if I write hard in xml set and unset condition for all of the values from the dropdown. But, ist there any possibility to do it dynamicaly? E.G. with some OTHERWISE condition for unset the token?
I also tried this method. Everytime at change in the dropdown, unset at first the token.
<change>
<condition>
<unset token="show_token"></unset>
</condition>
<condition label="show">
<set token="show_token">true</set>
</condition>
</change>
but it didn't work. By default should be the token show_token set to true. Can you help me, please?
... View more
04-14-2020
07:23 AM
Hi richgalloway. Thank you for your reaction. Unfortunately it didn't work. Nothing changed.
... View more
04-03-2020
04:52 AM
Hi,
I want to index this csv file:
run_time;field1;field2;field3;field4;field5;field6;field7;field8;
80s;"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
inputs.conf is
[monitor://\\srv\Log Sicherung\]
disabled = false
index = machinedata_w48
sourcetype = systest
crcSalt=<SOURCE>
ignoreOlderThan = 24h
and props.conf is
[systest]
BREAK_ONLY_BEFORE_DATE =
CHARSET = WINDOWS-1252
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1
In splunk will be indexed only
run_time;field1
and the field1 with the value:
"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
Can you help me, please, how to solve this problem? I want to have indexed all fields* with proper values (separated with ;).
... View more
11-18-2019
05:34 AM
Hi Sukisen1981,
many thanks for your answer. Can you explain me, please, this note? It is not clear for me.
NOTE - When i took the sample from your index 1 _time became time, so please check the field name for _time in your actual splunk instance.
... View more
11-14-2019
01:03 AM
Hi, I have 2 different indexes.
Index1:
_time Fehlermeldungtext
2019-07-01 22:01:30 Streckenüberwachung Auslauf!
2019-09-09 04:28:56 Streckenüberwachung Auslauf!
2019-08-26 05:40:59 Streckenüberwachung Auslauf!
2019-08-25 11:18:30 Streckenüberwachung Auslauf!
2019-08-25 11:16:52 Streckenüberwachung Auslauf!
2019-08-25 11:12:30 Streckenüberwachung Auslauf!
2019-08-24 18:37:55 Streckenüberwachung Auslauf!
2019-08-24 18:37:15 Streckenüberwachung Auslauf!
2019-08-24 18:36:36 Streckenüberwachung Auslauf!
2019-08-24 18:35:57 Streckenüberwachung Auslauf!
2019-08-24 17:03:51 Streckenüberwachung Auslauf!
Index2:
DatumEinlauf DatumAuslauf
2019-07-01 21:59:37 2019-07-01 22:03:09
2019-07-01 21:58:25 2019-07-01 22:02:02
2019-07-01 21:56:22 2019-07-01 21:59:55
2019-07-01 21:54:37 2019-07-01 21:58:14
2019-07-01 21:54:04 2019-07-01 21:57:42
2019-07-01 21:52:36 2019-07-01 21:56:12
2019-07-01 21:52:15 2019-07-01 21:55:50
2019-07-01 21:50:14 2019-07-01 21:53:45
2019-07-01 21:49:53 2019-07-01 21:53:27
2019-07-01 21:45:19 2019-07-01 21:48:52
2019-07-01 21:44:35 2019-07-01 21:48:12
2019-07-01 21:44:01 2019-07-01 21:47:31
2019-07-01 21:41:45 2019-07-01 21:45:22
2019-07-01 21:41:11 2019-07-01 21:44:49
I want to find such events in Index2, where DatumEinlauf<time (from the Index1) AND DatumAuslauf>time (from the Index1).
For example: for the 1. row from Index1 2019-07-01 22:01:30 Streckenüberwachung Auslauf!
should appear 2 events from Index2:
2019-07-01 21:59:37 2019-07-01 22:03:09
2019-07-01 21:58:25 2019-07-01 22:02:02
Can anybody help me, please?
... View more
10-14-2019
06:33 AM
Finally I used the Powershell script, which picks only (indexed from 0) rows 1, 6:
Get-ChildItem *\*.protocol | ForEach { Get-Content $_.Fullname | Select-Object -Index 1,6 | Out-File "$($_.Directory)\$($_.BaseName).csv" -Encoding utf8}
... View more
10-11-2019
05:50 AM
Hi ololdach,
I used the spath and it worked. I had only problem with mvexpand, because of the error message: command.mvexpand: output will be truncated at 300 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / maxmemusage_mb has been reached.
I solved it, with the command: |fields - _*
But thank you anyway.
... View more
10-06-2019
11:47 PM
Hi ololdach,
Thank you for your message.
I used the spath, but I lost the data relation. E.g. In CSV file there is a relation data model guarantied by the first row (header). How would I select here all test name where testResultCode is failed? Using spath of course. And than using the spath the subTest names, which are failed, depending on testname?
... View more
10-05-2019
05:41 AM
Hi Giuseppe,
thank you, but your regex generates more steps, than mine. Mine has 8099, but your 8871. Sorry.
... View more
10-05-2019
04:03 AM
Hi I have a problem with the error message of the Splunk: Error in 'rex' command: regex="(?ms)]+^\s\" has exceeded configured match_limit, consider raising the value in limits.conf
The problem is, that the regex regex="(?ms)\<test[^\>]+[^\s](?P<tmp>.*?)\</test\>" for + xml file generates 8099 steps.
I tested it on this xml file:
<?xml version="1.0" encoding="UTF-8" ?>
<unitData endtime="2019-09-30T05:39:08+02:00" equipment="eq1" equipmentClass="eqc1" locale="german" operator="ADMINISTRATOR" senderID="sender1" starttime="2019-09-30T05:38:09+02:00" state="nok" unit="74375513159930675" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="unitData-1.1.xsd">
<subUnitData position="1" positionType="Panel Nr." state="ok" subUnit="74375513159930675">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="2" positionType="Panel Nr." state="ok" subUnit="74375513159930676">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="3" positionType="Panel Nr." state="ok" subUnit="74375513159930678">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="passed">
<subTest name="Verbindung zum Pr³fling aufbauen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Initialisierung" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Fehlerflag lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ID lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Sachnummer lesen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="Trigger setzen" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
<subTest name="ADC Abschalten" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
<subUnitData position="4" positionType="Panel Nr." state="nok" subUnit="74375513159930677">
<test description="A10-007 7437551" name="CU102_BAY2_QR" testResultCode="failed">
<subTest name="FLOAT" testPosition="unknown">
<subPositions>
<subPosition name="{27}"/>
</subPositions>
<subTestResult testResultClass="fail" testResultCode="failed"/>
</subTest>
<subTest name="Components not tested" testPosition="unknown">
<subTestResult testResultClass="pass" testResultCode="passed"/>
</subTest>
</test>
</subUnitData>
</unitData>
Can you help me, please, to optimize the regex? I want to extract the test tag.
... View more
09-25-2019
08:20 AM
And if I want to skip indexing the third column, I can use this syntax
FIELD_NAMES = Fehler, Zeit, , Fehlernummer
... View more
09-25-2019
07:52 AM
I found a solution, which works. Because I have no possibility to restart the Indexer, I created props.conf on UniFW site like this:
props.conf
[tsv_seho_err]
CHARSET = WINDOWS-1252
DATETIME_CONFIG =
FIELD_DELIMITER = tab
FIELD_NAMES = Fehler, Zeit, Fehlermeldungtext, Fehlernummer
INDEXED_EXTRACTIONS = tsv
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Benutzerdefiniert
description = Tab getrennte Werte ohne Header
pulldown_type = 1
and it works.
... View more
09-25-2019
07:50 AM
Thank you. But I have no possibility to restart the Indexer.
... View more
09-25-2019
05:34 AM
Hi Adonio,
i made all the steps, you mentioned, also with the restart of the fw. And unfortunatelly only the first row from the file has been indexed and without the field a and the last value from the first row 97. b=1, c=05:45:12, d=first, e=message.
See the screenshots
https://ibb.co/F4MRJKn
https://ibb.co/5RZjZsH
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
