About k_harini

jbarger · ‎02-13-2024

Forgive me, I'm new to this. I've updated the config file and restarted the service. Is there anything else I should be doing to be able to search logs on my instance or do i need to do some sort of registration over on the splunk instance? We're using cloud. Many Thanks!

joesrepsolc · ‎09-24-2020

This does rename the column of the output, but then the icons do not load.

cmerriman · ‎03-09-2018

why are you evaluating cdate and cdate_yr in the subsearch? are those the tokens? you could roll them up into one eval statement | eval cdate_yr = strftime(strptime(Opera_completion_date ,"%m/%d/%Y %H:%M") ,"%Y") in your case statement, try adding adding ,1=1,"2018") : | eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018",1=1,"2018") or changing it to an if statement: | eval yr = if("FY18"="FY17","2017","2018")

k_harini · ‎02-02-2018

Yes.. I used depends for the below panel.. but I want to unset this when another token is set like $field4$ from different panel. That I cannot do directly.. so I tried with condition match..

mayurr98 · ‎01-17-2018

Nope but your files should !

k_harini · ‎11-28-2017

Title should be displayed with ig_tok value. There are around 10 unique values. By default we have * .. when All is selected,(' *') would appear in title. Requirement is - Star alone should not be displayed. Anything else should be displayed. I tried with 2 panels to see if i can remove star from title. It dint work.

k_harini · ‎11-08-2017

Thanks for your help

k_harini · ‎10-30-2017

Thanks for your time. I will try this..

zanb · ‎02-03-2019

What were your modifications? Please post details of solutions, as "this worked with some slight modifications" helps no one else with the same issue! Thank you!

Sukisen1981 · ‎10-22-2017

Hi - You can use the value of another field as the name of the destination field by using curly brackets, { }. For example, if you have an event with the following fields, aName=counter and aValue=1234. Use | eval {aName}=aValue to return counter=1234. http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eval Add a dynamic eval |eval {xxxx}=value, then | sort -eval {xxxx}

k_harini · ‎08-18-2017

This worked perfectly for my usecase.. just that i had to reverse the time. Thank you so much for your timely help.. 🙂

gcusello · ‎08-10-2017

Hi k_harini, your TIME_FORMAT seems to be correct, anyway the easiest way to test it is to dowload an example of your logs and then use the web interface Add data function (Settings -- Add data -- Add local data] to immediately test your TIME_FORMAT. Only an additional information: where do you put your props.con containing TIME_FORMAT? It must be on the Indexer (with the only exceprion of csv files) not on the forwarder. Bye. Giuseppe

k_harini · ‎07-03-2017

This is what worked. Thanks somesoni2 :).. you are very helpful

woodcock · ‎06-15-2017

You need to create a Scripted Input (now mostly packaged as a Modular Input ) to make the call and forward to your Indexer tier: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/AdvancedDev/ScriptSetup

k_harini · ‎06-13-2017

This is resolved. I could rename and give in different format tags. Thanks..

k_harini · ‎06-11-2017

Thank you 🙂

woodcock · ‎06-03-2017

k_harini · ‎06-06-2017

I could see my input folder path here

woodcock · ‎05-26-2017

Yes, she is a smart one. Be sure to upvote her answer in that other question to show your appreciation! It wouldn't hurt to post a link to that one as a comment under this answer, either (for others in your same boat later).

adonio · ‎05-07-2017

Hello k_harini, monitor the folder is a good option when using the Universal Forwarder. have all logs (if they are the same sourcetype) as same sourcetype, Splunk will extract the host field automatically by forwarder so you can always know where the particular event came from. something like this on the forwarders on 50 servers: [monitor://full/path/to/log/*.log] sourcetype = uniqueSourcetype index = dataIndex hope it helps

scannon4 · ‎08-14-2017

Did you ever get this fixed? I am having a similar issue.

niketn · ‎04-08-2017

@k_harini, please try out and confirm whether you were able to proceed or not.

k_harini · ‎04-04-2017

Thanks everyone for prompt response. This forum helps a lot.

woodcock · ‎03-30-2017

Assuming this is *NIX and you are monitoring file file.txt and the file is updated once a day: Change inputs.conf to look for file.new instead of file.txt . Add this cron job to hit after the daily update (which I exemplified happening @ 2AM, so I picked 3AM): 00 3 * * * /bin/diff file.prev file.txt | /bin/grep "^+" | /bin/awk 'NR>1' | /bin/sed "s/^+//" > file.new && /bin/mv file.txt file.prev The first time that you set this up, do this: mv file.txt file.prev

k_harini · ‎03-15-2017

Thanks a lot.. It worked!!

Online Status	Offline
Date Last Visited	‎09-24-2021 05:20 AM

Subsearch in eval not working

How to set a token based on another token

latest events which are indexed are not pulled cor...

how to display token value based on condition in t...

Rex command to extract multiple values from base q...

Passing dynamic value from stats to the remaining ...

Issue with indexing multiple files from same folde...

Sort based on first count generated by xyseries dy...

how to take previous week value to compute next we...

_time format in props config file

Re: How to add custom log file to splunk universal...

Re: Renaming the 'range' field from rangemap

Re: Subsearch in eval not working

Re: How to set a token based on another token

Re: latest events which are indexed are not pulled...

Re: how to display token value based on condition ...

Re: Rex command to extract multiple values from ba...

Re: Passing dynamic value from stats to the remain...

Re: Issue with indexing multiple files from same f...

Re: Sort based on first count generated by xyserie...

Re: how to take previous week value to compute nex...

Re: _time format in props config file

Re: how to set earliest and latest for custom time

Re: rest call to xmlwebservice and return success ...

Re: format sparkine as bar for multiple sparkine

Re: perfmon counter as column for hosts issue

Re: Cron job condition when running DBX query

Re: forwarder configuration with Deployment app is...

Re: setting stopacceptorafterqblock attribute in ...

Re: How to index log file from 50 servers

Re: Why are my headers are getting indexed as even...

Re: pass case statement result to search string

Re: set earliest and latest time stamp

Re: Removing duplicate entries considering multipl...

Re: issue with dropdown containing month and year ...

Join the Conversation