Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About OMohi
OMohi
Path Finder
Member since:
02-20-2013
06-05-2020
Community Statistics
| Posts | 51 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 9 |
| Member Since | 02-20-2013 |
Activity Feed
- Got Karma for How to filter out an IP address that is sending syslogs to Splunk using TCP port 514 as input?. 03-02-2021 12:49 PM
- Got Karma for Re: Why are we unable to send collection logs on Universal forwarder to both old and new indexers?. 06-05-2020 12:47 AM
- Got Karma for How to hide or grey out Clone option under Edit on Splunk dashboard?. 06-05-2020 12:47 AM
- Got Karma for How to hide or grey out Clone option under Edit on Splunk dashboard?. 06-05-2020 12:47 AM
- Got Karma for How to create field extractions for dynamic csv files from headers that change with each file. 06-05-2020 12:47 AM
- Got Karma for How to remove real-time searches from Search and Home Page UI?. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I unable to apply proper parsing on an XML field tag with my current props.conf?. 06-05-2020 12:47 AM
- Got Karma for Re: XML tag extraction. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk DB Connect: Why does the app keep on refreshing repeatedly and java bridge server says loading?. 06-05-2020 12:47 AM
- Posted Re: How to troubleshoot why a Splunk search head is stuck on "Waiting for data" trying to run a search? on Splunk Search. 06-20-2016 10:25 AM
- Posted How to troubleshoot why a Splunk search head is stuck on "Waiting for data" trying to run a search? on Splunk Search. 06-20-2016 09:14 AM
- Tagged How to troubleshoot why a Splunk search head is stuck on "Waiting for data" trying to run a search? on Splunk Search. 06-20-2016 09:14 AM
- Posted Re: Apps not deploying correctly on Deployment Architecture. 12-04-2015 12:52 PM
- Posted Splunk not collecting logs after hostname rename on configuration file on Getting Data In. 12-03-2015 07:46 PM
- Tagged Splunk not collecting logs after hostname rename on configuration file on Getting Data In. 12-03-2015 07:46 PM
- Posted Recommendation : Capturing events on data lake gateway Vs nodes Hadoop Connect App Splunk on All Apps and Add-ons. 12-01-2015 08:59 AM
- Posted How do I write the regex to extract a DNS domain field from my sample data? on Splunk Search. 11-08-2015 03:41 PM
- Tagged How do I write the regex to extract a DNS domain field from my sample data? on Splunk Search. 11-08-2015 03:41 PM
- Tagged How do I write the regex to extract a DNS domain field from my sample data? on Splunk Search. 11-08-2015 03:41 PM
- Posted Re: Unable to parse dns windows logs in splunk on Getting Data In. 11-03-2015 11:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
06-20-2016
10:25 AM
I am unable to query for any searches on the search head, l am getting error exiting code=255.
... View more
06-20-2016
09:14 AM
Hi
I have an issue with a Splunk search head unable to return any search results. It is stuck on "waiting for data" page. I have deleted the dispatch folder and restarted Splunk, but to no relief. Also, l checked on the distributed search and this search head is able to establish connections with all its peers.
Please let me know any troubleshooting guidelines that'll assist me.
Thanks
Mohammed
... View more
12-04-2015
12:52 PM
I am facing similar issue, how did you get the metadata/local.meta file in place in the app directory?
Please let us know.
Thanks
Obaid
... View more
12-03-2015
07:46 PM
Hi:
I had to rename a hostname on splunk client configuration on inputs.conf and server.conf and removed the guid on /etc/instance.cfg to match the hostname of the server with the splunk client configuration in inputs.conf and server.conf files on a linux box. However, I am unable to capture events from the client server. Is there something else I am required to do or re-install Splunk?
Please let me know.
Thanks,
Obaid
... View more
12-01-2015
08:59 AM
Hi:
Please let me know which is the best practice of implementation.
Capturing events on data lake gateway Vs nodes for Hadoop Connect App on Splunk.
Thanks,
Mohammed Mohiuddin
... View more
11-08-2015
03:41 PM
Hi :
I need help extracting the domain IP address for the DNS logs. The automatic field extractor does not work in my case.
Here is the sample raw file:
11/8/2015 5:17:24 PM 1A5C PACKET 000000B9E66AE560 UDP Rcv 10.230.138.230 9bf2 Q [1001 D NOERROR] AAAA access-qa.truvenhealth.com
I need splunk to extract access-qa.truvenhealth.com as a field. I am unable to do so because the regex pattern doesn't fit it well.
... View more
11-03-2015
11:24 AM
Yes I have made the props entry on the UF's as well and restarted, but still no luck.
Thanks
... View more
11-01-2015
08:57 AM
Yes I am not using heavy forwarder. The logs are collected on universal forwarder and send to the indexer for parsing.
I am able to use the following query in search time, and hence tried to make this permanent by copying it in props.conf
THe following is the query I am trying to execute:
index=dns | rex mode=sed "s/(\d+)/./g"
and I am getting the domain name without the () brackets.
But unable to copy the same in props.conf and get similar results:
[DNS]
MAX_TIMESTAMP_LOOKAHEAD=128
TRUNCATE=20000
DATETIME_CONFIG=CURRENT
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
SEDCMD-win_dns = s/(\d+)/./g
... View more
10-31-2015
10:19 AM
I am unable to parse windows logs in splunk. My raw event contains 2)35(2)48(3)199(3)157(7)in-addr(4)arpa(0) . I want to remove the () for the domain name.
I tried to configure the following in props.conf on the indexers and restarted them but no luck:
[DNS]
MAX_TIMESTAMP_LOOKAHEAD=128
TRUNCATE=20000
DATETIME_CONFIG=CURRENT
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
SEDCMD-win_dns = s/\(\d+\)/./g
Any assistance in troubleshooting this issue is greatly appreciated.
Thanks,
Mohammed Mohiuddin
... View more
10-19-2015
10:43 AM
What does normalized search in the job inspector do. How is it different from an actual search? Please let me know.
Thanks
... View more
- Tags:
- job-inspector
- search
10-15-2015
06:33 AM
1 Karma
Hi Everyone
I need to know whether it is possible to filter out an IP address that is sending syslogs into Splunk using TCP port 514 as input.
Is there any configuration that needs to be done on the Splunk side to filter out that IP, or does it require blocking from the network device end sending logs to Splunk.
Please let me know.
Thanks
... View more
09-07-2015
07:39 AM
Hi All:
I want to ingest a zip file that has multiple sourcetypes. Is there a mechanism on how to achieve it? Please let me know.
Thanks
... View more
08-14-2015
12:54 PM
1 Karma
The problem is that I tried using KV_MODE = xml but the data contains some non xml fields hence the extraction doesn't work. I found a solution, that is defining in props.conf:
[sourcetype]
Report-xmlkv = xmlkv -alternative
In transforms.conf
[xmlkv-alternative]
REGEX = <([^\s>])[^>]>([^<]*)<\/\1>
FORMAT = $1::$2
This works and I was able to successfully extract all the XML tags as a field.
We can also | xmlkv for search time extraction but the client wanted the business users to understand the data in simplistic fashion.
... View more
08-14-2015
10:47 AM
Hi Guys:
I have renamed a sourcetype, but after renaming the sourcetype and recycling the indexers, I only see new data being allocated to the new sourcetype. Historical data still seems to be allocated to the old sourcetype.
How do I address this problem? Do I need to clean all the eventdata from index on the indexer, stop Universal Forwarder, delete the fishbucket folder, start the indexer, and restart the forwarder? Please let me know.
Thanks
... View more
- Tags:
- rename
- sourcetype
08-13-2015
01:32 PM
I have a datasource that reads in events in XML format. Could someone please help me build a props.conf that will extract all fields and show the events in treeview. Sample event below:
Fri Aug 07 13:42:37 EDT 2015 name="QUEUE_msg_received" event_id="ID:414d51204d514942513032202020202055bdd7d620016441" msg_dest="QA.EA.ELOG.BUSINESSEVENT1" msg_body="<?xml version="1.0" encoding="UTF-8"?><v1:BusinessEventRequest xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:v1="http://schemas.humana.com/Infrastructure/Utility/Logging/BusinessEventRequest/V1.1"><v1:BusinessEvent><v1:BusinessEventMetaData><v1:BusinessEventTypeCode>BUSINESS_EVENT</v1:BusinessEventTypeCode><v1:BusinessEventDateTime>2015-08-07T01:43:47Z</v1:BusinessEventDateTime></v1:BusinessEventMetaData><v1:SourceApplicationInformation><v1:EAPMId>66666</v1:EAPMId><v1:HostMachineName>MQIBQ01</v1:HostMachineName><v1:HostEnvironmentName>QA</v1:HostEnvironmentName><v1:AppEventCorrelationId/><v1:Component><v1:ComponentId/><v1:ComponentName/></v1:Component></v1:SourceApplicationInformation><v1:BusinessProcessInformation><v1:ProcessName/><v1:EventModelXSDPath/><EventInformation><mstns:BAMEvent xmlns:mstns="http://enrollmentservices.humana.com/Schema/BAMSchema/v1.0"><mstns:EventSource>FileIntake</mstns:EventSource><mstns:Activity>FileIntakeActivity</mstns:Activity><mstns:EventTransactionId>40efe7da-4ef2-46b6-bea6-911a74db898e</mstns:EventTransactionId><mstns:EventCorrelationID>354805729</mstns:EventCorrelationID><mstns:Milestone><mstns:MilestoneEvent>File upload requested</mstns:MilestoneEvent><mstns:MilestoneState>Begin</mstns:MilestoneState><mstns:DataElements><mstns:FileName/><mstns:FileSize>9008</mstns:FileSize><mstns:AdditionalInfo>File upload requested</mstns:AdditionalInfo></mstns:DataElements></mstns:Milestone></mstns:BAMEvent></EventInformation></v1:BusinessProcessInformation></v1:BusinessEvent></v1:BusinessEventRequest>"
... View more
08-13-2015
10:29 AM
Thanks Woodcock,
Your suggestion worked.
... View more
08-13-2015
10:12 AM
Is there a way to tell Splunk what time zone the data is in so it a query run for ET automatically grabs the records with the correct adjustment for GMT? For example, if we ask for data from midnight to midnight, Splunk would automatically know to add 4 hours to adjust the time from GMT to ET.
I have recognized a way on how to address the time zone disparity by editing the props as follows. But not sure whether this will work or not. The servers are sending data in GMT time zone whereas Splunk instances are on EST time zone.
[sourcetype]
TZ = GMT
Please let me know.
... View more
- Tags:
- props.conf
- timezone
08-13-2015
10:06 AM
1 Karma
I am able to strip out the non xml data from the events by using the following props. It worked fine. Thank You guys for your inputs:
[sourcetype]
TIME_PREFIX =
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD = 150
TRUNCATE = 1000000
disabled = false
pulldown_type = true
NO_BINARY_CHECK = 1
SEDCMD-stripnonxml-1=s/^.*msg_body="//
... View more
08-07-2015
08:55 AM
Hi Everyone:
I am facing an issue where I am unable to apply proper parsing for an XML tag. I want my event started at tag <v1:BusinessEventRequest> and line breaking at </v1:BusinessEventRequest>
Provided is the sample log file :
Thu Aug 06 11:47:02 EDT 2015 name="QUEUE_msg_received" event_id="ID:414d51204d514942513031202020202055bdd46020387541" msg_dest="QA.EA.ELOG.BUSINESSEVENT1" msg_body="<?xml version="1.0" encoding="UTF-8"?><v1:BusinessEventRequest xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:v1="http://schemas.humana.com/Infrastructure/Utility/Logging/BusinessEventRequest/V1.1">;
<v1:BusinessEvent><v1:BusinessEventMetaData>
<v1:BusinessEventTypeCode>BUSINESS_EVENT</v1:BusinessEventTypeCode>
<v1:BusinessEventDateTime>2015-08-06T12:00:47Z</v1:BusinessEventDateTime>
</v1:BusinessEventMetaData><v1:SourceApplicationInformation>
<v1:EAPMId>11111</v1:EAPMId><v1:HostMachineName>MQIBQ01</v1:HostMachineName>
<v1:HostEnvironmentName>QA</v1:HostEnvironmentName><v1:AppEventCorrelationId/>
<v1:Component><v1:ComponentId/><v1:ComponentName/></v1:Component>
</v1:SourceApplicationInformation><v1:BusinessProcessInformation><v1:ProcessName/>
<v1:EventModelXSDPath/><EventInformation><mstns:BAMEvent
xmlns:mstns="http://enrollmentservices.humana.com/Schema/BAMSchema/v1.0">
<mstns:EventSource>FileIntake</mstns:EventSource>
<mstns:Activity>FileIntakeActivity</mstns:Activity><mstns:EventTransactionId>40efe7da-4ef2-46b6-bea6-911a74db898e</mstns:EventTransactionId>
<mstns:EventCorrelationID>354805729</mstns:EventCorrelationID><mstns:Milestone>
<mstns:MilestoneEvent>File upload requested</mstns:MilestoneEvent>
<mstns:MilestoneState>Begin</mstns:MilestoneState><mstns:DataElements><mstns:FileName/>
<mstns:FileSize>9008</mstns:FileSize><mstns:AdditionalInfo>File upload requested</mstns:AdditionalInfo></mstns:DataElements></mstns:Milestone></mstns:BAMEvent>
</EventInformation></v1:BusinessProcessInformation></v1:BusinessEvent>
</v1:BusinessEventRequest>"
Here is my props.conf file :
[mq_business_nonprod]
DATETIME_CONFIG = CURRENT
BREAK_ONLY_BEFORE = "<v1:BusinessEventRequest
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = </v1:BusinessEventRequest>"
TRUNCATE = 1000000
disabled = false
pulldown_type = true
NO_BINARY_CHECK = 1
KV_MODE = xml
Am I missing something? Please advise.
... View more
07-20-2015
01:37 PM
1 Karma
Hi:
How do I create a field based on header on a csv file. The header is different for each file that I am trying to index.
So far I have done the following on props.conf but with no success:
[sourcetype]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = true
KV_MODE = none
category = Structured
Is there something that I am missing.
Please let me know.
Thanks,
Mohammed Mohiuddin
... View more
07-13-2015
10:58 AM
I am getting the following error message from inputs directing from splunk forwarder instance to indexer:
13:01:22.582 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/xfer/XXXlogs/retail_sales_dm_ci_comm.rows'.
07-13-2015 13:01:22.636 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/xfer/XXX/logs/retail_sales_dm_ci_comm_sql.out.Mon'.
07-13-2015 13:01:25.613 -0400 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/xfer/XXX/logs/IFM_FACT_wf_edw_mbr_alloc_sum_skey_coid_xref.out'
This is my inputs.conf configuration:
[monitor:///xfer/XXX/logs/*]
index = <index_name>
sourcetype = <sourcetype>
crcSalt = <SOURCE>
I am unable to see latest events as a result.
Please provide feedback on how to overcome this issue.
Thanks,
Mohammed Mohiuddin
... View more
- Tags:
- inputs.conf
- SplunkIt
07-13-2015
09:54 AM
I used event-stats and am getting proper results. Thanks for your suggestions
... View more
07-13-2015
09:45 AM
I need help in creating props for the data input. The line should break after Block Output Operation 0.
Below is my props configured on the indexer:
[sourcetype]
[sas_input]
TIME_FORMAT = %Y-%m-%dT%H:%M:%S,%3N
TIME_PREFIX = Timestamp
MAX_TIMESTAMP_LOOKAHEAD = 128
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = Block Output Operations\s+\d+
#BREAK_ONLY_BEFORE_DATE = false
MAX_EVENTS = 10000
KV_MODE = multi
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true
Below is my event indexed in Splunk:
Timestamp 07/13/2015 12:26:51 PM
Page Faults 0
Page Reclaims 62
Page Swaps 0
Voluntary Context Switches 2
Involuntary Context Switches 2
Block Input Operations 0
Block Output Operations 0
NOTE: The data set has 1 observations and 1 variables.
NOTE: DATA statement used (Total process time):
real time 0.39 seconds
user cpu time 0.00 seconds
system cpu time 0.01 seconds
memory 325.81k
OS Memory 9508.00k
How do I eliminate the lines NOTE: to OS Memory from my event.
Please let me know.
Thanks,
Mohammed Mohiuddin
... View more
07-10-2015
09:23 AM
I have deleted historical events from a source using the command | delete . Before doing this, I had added the stanza disabled=true from the deployment server on the target source input file, pushed the configuration to the forwarder server, and issued the | delete command to delete all the data from the targeted source input file. Finally, from the DS, I reconfigured the targeted forwarder input, by replacing disabled=true to disabled=false, and pushed the changes through Deployment Server, but I do not see anything coming from the forwarder's inputs file. There is no error on the splunk forwarder instance and the indexer instance on splunkd.log that would suggest any issues with the source input.
What am I doing wrong here? Is there a way to enable indexing on that inputs file . I created a separate monitoring stanza for that source input, before I was monitoring the folder where that file was situated. Now I am defining the exact file location, but to no avail.
... View more
07-09-2015
11:46 AM
Hi:
I am unable to get proper result for the Average Field.
Here is my search:
index=entloggingnonprod_catchall_bam sourcetype=mq_business_nonprod source="F:\\temp\\..." | xmlkv | search "mstns:ActivityTransCorrelationId"=* | eval Date=strftime(_time, "%m-%d-%Y") | stats min("mstns:MilestoneDate") as BeginMilestoneTime max("mstns:MilestoneDate") as EndMilestoneTime by "mstns:ActivityTransCorrelationId" | eval it = strptime(BeginMilestoneTime, "%Y-%m-%dT%H:%M:%S.%3N") | eval ot = strptime(EndMilestoneTime, "%Y-%m-%dT%H:%M:%S.%3N") | eval ResponseTime = round((ot - it)/60) | appendcols [search index=entloggingnonprod_catchall_bam sourcetype=mq_business_nonprod source="F:\\temp\\..." | xmlkv | search "mstns:ActivityTransCorrelationId"=* | stats min("mstns:MilestoneDate") as BeginMilestoneTime max("mstns:MilestoneDate") as EndMilestoneTime by "mstns:ActivityTransCorrelationId" | eval it = strptime(BeginMilestoneTime, "%Y-%m-%dT%H:%M:%S.%3N") | eval ot = strptime(EndMilestoneTime , "%Y-%m-%dT%H:%M:%S.%3N") | eval ResponseTime = round((ot - it)/60) | stats avg(ResponseTime) as Average by ResponseTime ] | rename "mstns:ActivityTransCorrelationId" as ActivityTransCorrelationID | rex field=BeginMilestoneTime mode=sed "s/T.*//" | rex field=EndMilestoneTime mode=sed "s/T.*//" | rex field=EndMilestoneTime mode=sed "s/T/ /g" | rex field=EndMilestoneTime mode=sed "s/Z//g" | sort date_mday ascending
Is there something that I may be missing?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
