Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About adlireza
adlireza
Path Finder
Member since:
06-11-2014
11-28-2024
Community Statistics
| Posts | 15 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 06-11-2014 |
Activity Feed
- Karma Re: Extracting fields from SNMP GETBULK data for jkat54. 06-05-2020 12:47 AM
- Karma Re: Extracting fields from SNMP GETBULK data for jkat54. 06-05-2020 12:47 AM
- Karma Re: WinEventLog:* on Windows 2008 and Splunk 4.3.2 forwarders - Splunk could not get the description for this event. for mship. 06-05-2020 12:46 AM
- Posted Re: How do you change the WSDL URL for the Splunk Add-on for BMC Remedy? on All Apps and Add-ons. 10-12-2018 03:15 AM
- Posted How do you change the WSDL URL for the Splunk Add-on for BMC Remedy? on All Apps and Add-ons. 10-11-2018 07:44 PM
- Tagged How do you change the WSDL URL for the Splunk Add-on for BMC Remedy? on All Apps and Add-ons. 10-11-2018 07:44 PM
- Posted Re: Calculating utilization of nodes connected in Tree network topology on Splunk Search. 07-27-2018 02:15 AM
- Posted Calculating utilization of nodes connected in Tree network topology on Splunk Search. 07-19-2018 01:26 AM
- Tagged Calculating utilization of nodes connected in Tree network topology on Splunk Search. 07-19-2018 01:26 AM
- Tagged Calculating utilization of nodes connected in Tree network topology on Splunk Search. 07-19-2018 01:26 AM
- Tagged Calculating utilization of nodes connected in Tree network topology on Splunk Search. 07-19-2018 01:26 AM
- Posted Re: Help with stats table output on Splunk Search. 10-02-2017 03:15 AM
- Posted Help with stats table output on Splunk Search. 09-28-2017 02:34 AM
- Tagged Help with stats table output on Splunk Search. 09-28-2017 02:34 AM
- Tagged Help with stats table output on Splunk Search. 09-28-2017 02:34 AM
- Tagged Help with stats table output on Splunk Search. 09-28-2017 02:34 AM
- Posted Re: Event based conditional alerting on Alerting. 06-08-2017 06:19 AM
- Posted Event based conditional alerting on Alerting. 06-07-2017 06:05 AM
- Tagged Event based conditional alerting on Alerting. 06-07-2017 06:05 AM
- Tagged Event based conditional alerting on Alerting. 06-07-2017 06:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-12-2018
03:15 AM
I have solved this problem by editing bin/remedy_ticket.py to change the hardcoded URL directly. Search for the validate_and_create_url() method definition, change the values as below:
remedy_ws_staza[c.CREATE_WSDL_URL] = remedy_account.get(c.HTTP_SCHEME) + '://' + remedy_account.get(
c.URL).strip(' /') + '/arsys/WSDL/public/' + remedy_account.get(
c.SERVER_NAME).strip() + '/HPD_IncidentInterface_Create_WS'
remedy_ws_staza[c.MODIFY_WSDL_URL] = remedy_account.get(c.HTTP_SCHEME) + '://' + remedy_account.get(
c.URL).strip(' /') + '/arsys/WSDL/public/' + remedy_account.get(
c.SERVER_NAME).strip() + '/HPD_IncidentInterface_WS'
... View more
10-11-2018
07:44 PM
I am currently configuring the BMC Remedy add-on, but am running into an issue where the WSDL URL is different than what the add-on is expecting.
All settings have been done via the Configuration > Account page. Settings generated in local/splunk_ta_remedy_settings.conf are as below:
[additional_parameters]
http_scheme = http
server_name = <arsystemname>
server_url = <midtierserver>:80
user = user
password = ********
When I use the |remedyincidentcreate command, I get an error:
"Can't get the WSDL file at http://midtierserver/arsys/WSDL/protected/arsystemname/HPD_IncidentInterface_Create_WS"
Turns out the Remedy is not serving the WSDL as protected, but public. I want to change the the URL to use public and I have added the stanza below to local/splunk_ta_remedy_settings.conf:
[remedy_ws]
create_wsdl_url = http://midtierserver/arsys/WSDL/public/arsystemname/HPD_IncidentInterface_Create_WS
However, the add-on doesn't seem to respect this configuration and outputs the same error.
Can anyone help me with this issue? Thanks.
... View more
07-27-2018
02:15 AM
Thanks FrankVI for your attention to this question. Somehow I can't attach an image in a comment direct to you, so I'm attaching this example of the bandwidth data in an answer.
The bandwidth data looks like this for a sample of nodes A,B and E from the time period of 27/7/2018 12AM to 2AM. Note that I'm selecting these particular nodes as they are in 1 subtree A-B-E, the full set of data will have bandwidth utilization for all nodes at every hour.
Referring back to the tree structure knowledge, let's have some calculation scenarios:
A) utilization for the link that connects A and B at 2AM
- I will sum up bandwidth utilization (aka Throughput) for the subnodes under it, B and E, which amounts to 460+260=720.
B) utilization for the link that connects B and E at 2AM
- Since there is only 1 subnode under this link (E), the utilization for this link is just the utilization for E, which is 260.
... View more
07-19-2018
01:26 AM
I have been busting my brain on this for a few weeks with no clear solution, turning to the brainiacs in the Splunk community for help now.
I have bandwidth utilization data for a few thousand nodes of telecom stations. They are all connected in a tree network topology. For clearer understanding what is tree topology, image below is an example. A subnetwork begins when node A which is connected to a backhaul branches off links to child nodes. At any point in the branches, other sub-branches may branch off as well.
We are trying to build a dashboard of utilization data of the links between nodes. The challenge is my data is hourly utilization for individual nodes, but utilization data for each links need to accumulate the utilization for all nodes under it. Based on this example, utilization for link A-C is total of utilization of nodes C+F+H+G.
I have a lookup that provides the details for each node in this form:
My objective is to build
1) a scheduled search that is able to iterate over multiple trees to calculate utilization of each link (around 7k+ links total). Utilization of a link is total utilization of all its subnodes.
2) an interactive dashboard where the user can input the name of the link (e.g A-B or F-H) and it will calculate the current utilization of a link
Anyone can help? Your wildest ideas are accepted.
... View more
10-02-2017
03:15 AM
It's missing a few round brackets, but this is the answer that helped me, thanks.
... View more
09-28-2017
02:34 AM
I have a dataset that can be represented as below:
Region=A State=1 City=a Product=Apple
Region=A State=1 City=b Product=Apple
Region=A State=1 City=c Product=Orange
Region=B State=1 City=d Product=Pineapple
Region=B State=2 City=e Product=Apple
Region=C State=1 City=f Product=Orange
Region=C State=2 City=g Product=Orange
How can I summarize by Region and State have a stats output table as below:
Region | State | Apple | Orange | Pineapple
A | 1 | 2 | 0 | 0
B | 1 | 0 | 1 | 1
B | 2 | 1 | 0 | 0
C | 1 | 0 | 1 | 0
C | 2 | 0 | 1 | 0
... View more
06-08-2017
06:19 AM
Hi DalJeanis, I have tried your suggestion earlier. The way you do it here is by dividing the data into discrete 10s time bins, but unfortunately this doesn't work for high volume data like what I am working with.
For example, when I receive DOWN at 10.49, and UP at 10.51. I understand your idea is to put them in a single bin and mark it as a "mixed" state that will be filtered out by the final 'where' command, but actually 'bin' will separate these 2 into 10.40 and 10.50 bins.
... View more
06-07-2017
06:05 AM
I have a system that monitors a set of devices and outputs an alarm message everytime there is a state change on one of the said devices. Possible states are UP and DOWN.
The system sends the messages to Splunk and I need to send email alerts based on certain conditions:
1) If DOWN is received and not followed by any other message in the next 5 minutes: send STATE CHANGED TO DOWN email alert
2) If UP is received and not followed by any other message in the next 5 minutes: send STATE CHANGED TO UP email alert
3) If DOWN or UP is received, followed by any another state change message in the next 5 minutes: do not send any email alerts (considered false alarm)
I have tried implementing a search that "looks back" in the last 5 minutes, scheduled every minute, to find lone state change events. This fulfills condition (1) and (2), but the logic falls apart on condition (3), as the last alarm in an event chain (e.g UP-DOWN-UP-DOWN within seconds of each other) will always be sent as alert.
Anyone have any ideas how I can achieve this in Splunk?
... View more
12-15-2016
08:38 AM
You can refer to this blog post, I believe it's exactly what you need. Just replace the author's custom time field (claim_filling_date) with yours (CreateDateTime).
http://blogs.splunk.com/2016/09/16/i-cant-make-my-time-range-picker-pick/
... View more
03-25-2016
07:58 PM
I've been at this for hours and totally given up on trying to index it as-is (I think it might be something with the way the number of whitespaces delimiting each value is inconsistent). My latest attempts have been trying to turn it into comma-separated values using SEDCMD, but still no success yet. Below are my settings for this:
[ somedata ]
HEADER_FIELD_LINE_NUMBER=1
CHARSET=UTF-8
MAX_DAYS_AGO=10000
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=true
SEDCMD-changeintocsv=s/\s+/,/g
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S
category=Custom
disabled=false
pulldown_type=true
INDEXED_EXTRACTIONS=csv
The strange thing is I can run regular CLI sed utility on the file to turn it into a CSV file, and Splunk will parse just fine using the csv sourcetype.
... View more
03-25-2016
07:57 PM
I've been at this for hours and totally given up on trying to index it as-is (I think it might be something with the way the number of whitespaces delimiting each value is inconsistent). My latest attempts have been trying to turn it into comma-separated values using SEDCMD, but still no success yet. Below are my settings for this:
[ somedata ]
HEADER_FIELD_LINE_NUMBER=1
CHARSET=UTF-8
MAX_DAYS_AGO=10000
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=true
SEDCMD-changeintocsv=s/\s+/,/g
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S
category=Custom
disabled=false
pulldown_type=true
INDEXED_EXTRACTIONS=csv
The strange thing is I can run regular CLI sed utility on the file to turn it into a CSV file, and Splunk will parse just fine using the csv sourcetype.
... View more
03-25-2016
07:57 PM
I have tried to index this file without much success. It's driving me nuts how the fields are never separated correctly no matter what setting I change. I'd be grateful if anyone can try to index this file and let me know what are the props.conf settings you used.
date time field101 field102 field103 field104 field105 field106 field107 field108
2008-10-1 00:15:00.0 35.947 46.170 26.839 26.161 0.079 0.099 0.160 36.833
2008-10-1 00:30:00.0 35.608 46.024 26.791 26.210 0.078 0.098 0.159 36.736
2008-10-1 00:45:00.0 35.608 45.879 26.549 25.871 0.080 0.100 0.162 36.929
2008-10-1 01:00:00.0 35.463 45.976 26.355 25.677 0.081 0.101 0.162 37.057
2008-10-1 01:15:00.0 35.608 45.879 26.452 26.210 0.080 0.100 0.162 36.873
2008-10-1 01:30:00.0 35.754 46.218 26.549 25.967 0.080 0.101 0.163 36.945
2008-10-1 01:45:00.0 35.705 46.170 26.452 26.258 0.081 0.101 0.164 36.949
2008-10-1 02:00:00.0 35.172 45.491 26.549 25.919 0.080 0.101 0.164 37.074
2008-10-1 02:15:00.0 35.415 45.831 26.452 25.919 0.080 0.101 0.163 36.993
2008-10-1 02:30:00.0 35.511 45.637 26.549 25.628 0.082 0.103 0.165 37.170
... View more
01-03-2016
07:36 PM
Thanks. That will be my next course of action. I will be using the built-in option in the SNMP Modular Input app to split the output into individual lines.
... View more
01-01-2016
10:42 PM
This doesn't work for me. It still only extracts one field.
I think the regex part should be OK. I've tested it against a sample of the results using RegExr and it is able to capture multiple groups there. I'm thinking it's something more to do with Splunk, maybe some setting in either transforms, props or fields.conf.
... View more
12-31-2015
01:17 AM
Hi everyone,
I need to extract fields from data continuously polled for via SNMP Modular Input. Each event looks like this:
IF-MIB::ifInOctets."1" = "1587826952" IF-MIB::ifOutOctets."1" = "3472375195" IF-MIB::ifInOctets."2" = "0" IF-MIB::ifOutOctets."2" = "0" IF-MIB::ifInOctets."3" = "0" IF-MIB::ifOutOctets."3" = "0" IF-MIB::ifInOctets."4" = "0" IF-MIB::ifOutOctets."4" = "0" IF-MIB::ifInOctets."5" = "0" IF-MIB::ifOutOctets."5" = "0" IF-MIB::ifInOctets."6" = "50036733" IF-MIB::ifOutOctets."6" = "3575426650" IF-MIB::ifInOctets."7" = "0" IF-MIB::ifOutOctets."7" = "0" IF-MIB::ifInOctets."8" = "657176060" IF-MIB::ifOutOctets."8" = "2715199686"
I've tried using the extractions in snmp_ta but it didn't work for this particular set of SNMP poll data. It managed to create "ifInOctets" and "ifOutOctets" fields but does not separate them by interface ID.
I've then resorted to index-time extraction.
My transforms.conf:
[snmp_ifOctets_extraction]
REGEX=IF-MIB::(.+?)\.\"((?:\d\.?)+)\"\s=\s\"(.*?)\"
FORMAT=$1.$2::$3
WRITE_META = true
REPEAT_MATCH = true
My props.conf:
[snmp_ifoctets]
TRANSFORMS-ifoctets = snmp_ifOctets_extraction
That didn't turn out so well either. It extracted just one field, "ifInOctets.1". The regex didn't seem to repeat itself throughout the event even though REPEAT_MATCH is set. Anyone have any ideas why this is happening?
PS I'm also open to any other ideas on how to parse this set of data. I'm thinking of splitting each poll result into individual events next if index-time extraction isn't workable.
... View more
