cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
dperry
Communicator
Member since: ‎09-29-2013
‎11-28-2023
Community Statistics
Posts 76
Solutions 4
Karma Given 3
Karma Received 16
Member Since ‎09-29-2013
Activity Feed
Topics I've Started
View All

Re: Incorrect Timestamp from log

by in Splunk Cloud Platform
‎07-29-2023 12:17 PM
‎07-29-2023 12:17 PM
thank you for the reply! ... View more

Why is there incorrect Timestamp from log?

by in Splunk Cloud Platform
‎07-28-2023 02:19 PM
‎07-28-2023 02:19 PM
I have an On-Prem deployment Server and an AIX Server with a UF. I have a log monitor that redirects and overwrites an out file every minute. example: -rw-r--r-- 1 root system 27804 Jul 27 17:32 /usr/local/bin/reports/mysycpost_check.out -rw-r--r-- 1 root system 27804 Jul 27 17:33 /usr/local/bin/reports/mysycpost_check.out -rw-r--r-- 1 root system 27804 Jul 27 17:34 /usr/local/bin/reports/mysycpost_check.out   The contents of this file contains 41 lines every time its overwritten but contain different values each time: SYM000 19727072 23724770 0 - 0:28 SYCPOST SYC000 /SYM/SYM000 SYM000 22807268 23724770 0 - 0:17 SYCPOST SYC000 /SYM/SYM000 SYM000 23200462 23724770 0 - 0:08 SYCPOST SYC000 /SYM/SYM000 SYM000 23266014 23724770 0 - 0:14 SYCPOST SYC000 /SYM/SYM000 SYM000 23659042 23724770 0 - 0:11 SYCPOST SYC000 /SYM/SYM000 SYM000 23855850 23724770 0 - 0:35 SYCPOST SYC000 /SYM/SYM000 SYM000 24576546 23724770 0 - 0:43 SYCPOST SYC000 /SYM/SYM000 SYM000 24838656 23724770 0 - 0:06 SYCPOST SYC000 /SYM/SYM000 SYM000 24904198 23724770 0 - 0:09 SYCPOST SYC000 /SYM/SYM000 SYM000 24969758 23724770 0 - 0:22 SYCPOST SYC000 /SYM/SYM000 SYM000 25035266 23724770 0 - 0:56 SYCPOST SYC000 /SYM/SYM000 SYM000 25100802 23724770 0 - 0:06 SYCPOST SYC000 /SYM/SYM000 SYM000 25166340 23724770 0 - 0:05 SYCPOST SYC000 /SYM/SYM000 SYM000 25231878 23724770 0 - 0:04 SYCPOST SYC000 /SYM/SYM000 SYM000 25362954 23724770 0 - 0:04 SYCPOST SYC000 /SYM/SYM000 SYM000 25428492 23724770 0 - 0:03 SYCPOST SYC000 /SYM/SYM000 SYM000 25494030 23724770 0 - 0:03 SYCPOST SYC000 /SYM/SYM000 (41 lines) As of right now the timestamp is coming from the value: "0:28 " at the top of the file which makes it 12:28am. So all my events are using this value for time. This is incorrect. I want the file to be one event and get the timestamp of the actual time of the log when its written: Jul 27 17:32 Jul 27 17:33 Jul 27 17:34 and so on....   Here is the inputs .conf and my props.conf (which is side by side on my Deplyment Server: /opt/splunk/etc/deployment-apps/cu-infrastructure-xxx/local [root@deployment_server local]# ll total 12 -rw-------. 1 splunk splunk 21 Dec 30 2020 app.conf -rw-rw-r--. 1 splunk splunk 1326 Jul 27 14:20 inputs.conf -rw-r--r--. 1 splunk splunk 115 Jul 27 16:16 props.conf Props.conf [sycpost] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8   Inputs.conf ### symitar SYCPOST utilization logs [monitor:///usr/local/bin/reports/mysycpost_check.out] disabled = false index = cu-infrastructure-xxx sourcetype = sycpost   Question is Do I have my Props.conf in the right location? Deployment Server? Does it need to by on my Cloud indexers? IS the Props correct? IM trying to have the log determine the time of the event.           ... View more
Labels

Red Hat Insights App for Splunk- Has anyone had ex...

by in Splunk Cloud Platform
‎09-02-2022 12:12 PM
‎09-02-2022 12:12 PM
Recently learned of this new Splunk app for Red Hat Insights. Just curious if anyone is currently utilizing in with their Splunk Cloud. We looked into installing the app but says the app does not support search head cluster deployments. I realize Splunk defers all support to Red Hat for this application and exploring if anyone came across this issue.  ... View more
Labels

DB Connect and Red Hat Satellite

by in Getting Data In
‎11-18-2021 11:58 AM
‎11-18-2021 11:58 AM
Has anybody used or currently using DB Connect to their Red hat satellite Server?  ... View more
Labels

Re: Dashboard to show process is "UP" or "DOWN"

by in Dashboards & Visualizations
‎06-25-2018 03:55 PM
‎06-25-2018 03:55 PM
Hi renjith.nair....this works great....I have a question thugh...how would I make only two ranges..... True would output ONHOST (in green) and False output OFFHOST (RED) ... View more

Dashboard to show process is "UP" or "DOWN"

by in Dashboards & Visualizations
‎06-20-2018 10:26 AM
‎06-20-2018 10:26 AM
I want to create a dashboard that simply reports a specific process is UP or DOWN. Preferable one that shows ON (GREEN) or OFF (Red). this is my search: Process is ON index=myindex sourcetype=mysourcetype host=myhost type=process_monitor process=Myprocess status=True Process is DOWN index=myindex sourcetype=mysourcetype host=myhost type=process_monitor process=Myprocess status=False the search is run every 5 minutes I want the dashboard to be in realtime..... ... View more
Labels

Re: Help with Line Break for log

by in Getting Data In
‎04-19-2018 03:57 PM
‎04-19-2018 03:57 PM
works like a charm! Thank you!!! ... View more

Help with Line Break for log

by in Getting Data In
‎04-19-2018 02:00 PM
‎04-19-2018 02:00 PM
04/19/18 12:32:17.398524 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:32:17 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:32:17.398907 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:32:17 PM)~K1:SymConnect is off host 04/19/18 12:33:26.915422 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Ho stLoanExists).DATETIME(4/19/2018 12:33:26 PM)~A0~BLMS~DCARD~F??????????????~H LOAN~JID=ALL 04/19/18 12:33:26.930871 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER( HostLoanExists).DATETIME(4/19/2018 12:33:26 PM)~K0~JID=01~JID=02~JID=03~JID=0 4~JID=05~JID=06~JID=07~JID=08~JID=09~JID=10~JID=80~JID=81~JID=82 04/19/18 12:33:39.309465 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:33:39 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:33:39.310146 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:33:39 PM)~K0~JID=01~JID=02~JID=80~JID=81 04/19/18 12:34:05.371520 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:34:05 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:34:05.372184 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:34:05 PM)~K0~JID=80 04/19/18 12:34:57.811784 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Host LoanExists).DATETIME(4/19/2018 12:34:57 PM)~A0~BLMS~DCARD~F??????????????~HLO AN~JID=ALL A new entry always begin with 00/00/00 What would the line_break be for my props? ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-25-2017 10:45 AM
‎09-25-2017 10:45 AM
@sbbadri it worked.....placed this on my four indexers, restarted the instance and the next time the file generated new data the interesting fields (headers) were parsed out. Thank you! ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 02:21 PM
‎09-22-2017 02:21 PM
thx @sbbadri I will add this to my four indexers and restart. I will let you know the outcome ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 01:08 PM
‎09-22-2017 01:08 PM
I want the headers to be in the interesting fields, like so: date - 1470207600 name - myserver capacity - 62.00TB and so on.....attached example ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 12:53 PM
‎09-22-2017 12:53 PM
So added the Props to all four indexers, restarted them: [SVC_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline I run the search sourctype=SVC_capacity index=zz_test And the index data is only tailing the newer data without checking the headers: date,name,capacity,free_capacity,virtual_capacity,used_capacity,real_capacity,overallocation,compression_virtual_capacity,compression_compressed_capacity,compression_uncompressed_capacity so my index data looks like this: 1470207600,myserver,62.00TB,16.67TB,163.02TB,41.80TB,45.24TB,262,86.72TB,34.97TB,69.88TB 1470207600,MigrationPool_8192,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB 1470207600,MigrationPool_512,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 12:14 PM
‎09-22-2017 12:14 PM
So I dont need a transforms.conf, right? All I need is the these two, right? On the UF : inputs.conf on the Indexer: props.conf inputs [monitor:///usr/local/bin/reports/storage/emc_capacity.out] disabled = false index = zz_test sourcetype = VMAX_capacity props [VMAX_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 11:33 AM
‎09-22-2017 11:33 AM
thank you again....I see the props is this: [VMAX_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline So the tranforms is this: [VMAX_storage_csv] DELIMS = "," FIELDS = "Date","Array","Useable","Used","UsedPercent","UsedGrowth","Free","Subscribed","SubscribedMax","SubscribedPercent","SubscribedGrowth","Snapshot","compression","ExpansionNeeded" and then place both files on my indexers...... ... View more

Re: How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 10:53 AM
‎09-22-2017 10:53 AM
thank you @sbbadri So the VMAX_Storage_csv & SVC_storage_csv lookup files goes on the indexers.......Im trying to find an example of what the file would look like in my case with the headers..... Also are my props and tranforms stanza correrct? ... View more

How can I import this CSV file into Splunk?

by in Getting Data In
‎09-22-2017 10:23 AM
‎09-22-2017 10:23 AM
I have: 1 Searchhead 1 Deployment Server 4 Indexers (Non clustered) This is the raw CSV file: date,name,capacity,free_capacity,virtual_capacity,used_capacity,real_capacity,overallocation,compression_virtual_capacity,compression_compressed_capacity,compression_uncompressed_capacity 1470207600,myserver,62.00TB,16.67TB,163.02TB,41.80TB,45.24TB,262,86.72TB,34.97TB,69.88TB 1470207600,MigrationPool_8192,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB 1470207600,MigrationPool_512,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB 1470294000,myserver,62.00TB,16.67TB,163.02TB,41.81TB,45.25TB,262,86.72TB,34.99TB,69.88TB 1470294000,MigrationPool_8192,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB the top line is the header........ I have the Props and Transform conf on my UF along side my inputs.conf /opt/splunkforwarder/etc/apps/myapp/local/inputs.conf: [monitor:///usr/local/bin/reports/storage/emc_capacity.out] disabled = false index = zz_test sourcetype = VMAX_capacity [monitor:///usr/local/bin/reports/storage/tustin_svc_capacity_rpts.out] disabled = false index = zz_test sourcetype = SVC_capacity [monitor:///usr/local/bin/reports/storage/idc_svc_capacity_rpts.out] disabled = false index = zz_test sourcetype = SVC_capacity /opt/splunkforwarder/etc/apps/myapp/local/props.conf: [VMAX_capacity] REPORT -VMAX_capacity = VMAX_storage_csv [SVC_capacity] REPORT -SVC_capacity = SVC_storage_csv /opt/splunkforwarder/etc/apps/myapp/local/transforms.conf [SVC_storage_csv] DELIMS = "," FIELDS = "date","name","capacity","free_capacity","virtual_capacity","used_capacity","real_capacity","overallocation","compression_virtual_capacity","compression_compressed_capacity","compression_uncompressed_capacity" [VMAX_storage_csv] DELIMS = "," FIELDS = "Date","Array","Useable","Used","UsedPercent","UsedGrowth","Free","Subscribed","SubscribedMax","SubscribedPercent","SubscribedGrowth","Snapshot","compression","ExpansionNeeded" When I run the search on my Searchhead: index=zz_test Sourcetype=SVC_capacity The data is not parsed....my question...does the props and Transform need to ne on my Indexers? on the UF? does my Props and Transform conf look correct? Any assistance much appreciated. ... View more

Re: How to edit my props.conf to correctly line br...

by in Getting Data In
‎04-18-2017 03:01 PM
‎04-18-2017 03:01 PM
Once I placed the props.conf in the indexers....BOOM...works, thanks! ... View more

Re: How to edit my props.conf to correctly line br...

by in Getting Data In
‎04-18-2017 02:16 PM
‎04-18-2017 02:16 PM
Thanks.....I will let you know the outcome! ... View more

Re: How to edit my props.conf to correctly line br...

by in Getting Data In
‎04-18-2017 02:03 PM
‎04-18-2017 02:03 PM
reason I ask this is this work with my local Splunk instance (laptop). My enterprise env is: 1 SH 1 DS 4 indexers ... View more

Re: How to edit my props.conf to correctly line br...

by in Getting Data In
‎04-18-2017 01:58 PM
‎04-18-2017 01:58 PM
I have the prop.conf on the UF should I place it on the indexer? ... View more

Re: How to edit my props.conf to correctly line br...

by in Getting Data In
‎04-18-2017 11:49 AM
‎04-18-2017 11:49 AM
No dice I changed the props.conf to show: [ofx] BREAK_ONLY_BEFORE = Event logged at *}: MAX_EVENTS = 2000 SHOULD_LINEMERGE= false NO_BINARY_CHECK = true disabled = false pulldown_type = true Still not breaking at this line ... View more

How to edit my props.conf to correctly line break ...

by in Getting Data In
‎04-18-2017 11:26 AM
‎04-18-2017 11:26 AM
I want Splunk to break every time I see Event logged at *}: Event logged at {1492205898958;2}: ID: com.innovision.ofx.ofxsgml.ncph.Response Title: Event logged at Fri Apr 14 14:38:18 PDT 2017 Severity: INFO Timestamp: {1492205898958;2} Date-Time: Fri Apr 14 14:38:18 PDT 2017 Source: com.innovision.ofx.ofxsgml.ncph.OfxResponse Transaction-ID: 0A044F3301D3BFED0000015B6E2BF39BD246 Host-Name: XXXXXXX HTTP result code (so far) is 200. OFX output response message: Header version: 100 Content type: OFXSGML DTD version: 102 Security type: NONE Character encoding: USASCII Character set: 1252 Compression type: NONE Old file UID: NONE New file UID: NONE XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Event logged at {1492205898958;4}: ID: 0A044F3301D3BFED0000015B6E2BF39BD28D Title: System.out Severity: INFO Timestamp: {1492205898958;4} Date-Time: Fri Apr 14 14:38:18 PDT 2017 Host-Name: XXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Event logged at {1492205898974;2}: ID: 0A044F3301D3BFED0000015B6E2BF39BD28E Title: System.err Severity: WARNING Timestamp: {1492205898974;2} Date-Time: Fri Apr 14 14:38:18 PDT 2017 Host-Name: XXXXXXXX AccountsServant - returned error 2000 Event logged at {1492205898974;3}: ID: com.innovision.nepal.controller.XactOut Title: Event logged at Fri Apr 14 14:38:18 PDT 2017 Severity: INFO Timestamp: {1492205898974;3} Date-Time: Fri Apr 14 14:38:18 PDT 2017 Source: com.innovision.nepal.controller.TransactionServant Transaction-ID: 0A044F3301D3BFED0000015B6E2BF39BD246 Host-Name: XXXXXXXX Transaction 0A044F3301D3BFED0000015B6E2BF39BD246 is complete. Total processing time: 00:00:01.407 (1.407s). Heap memory used: 135977728 of 518979584 bytes (26%). here is my props.conf: LINE_BREAKER = ([\r\n])Event logged at *}: MAX_EVENTS = 2000 NO_BINARY_CHECK = true disabled = false pulldown_type = true ... View more

Re: Trying to parse my Json into a table

by in Getting Data In
‎01-31-2017 04:28 PM
‎01-31-2017 04:28 PM
Thanks Producer! This is along the lines of what I was visioning. ... View more

Trying to parse my Json into a table

by in Getting Data In
‎01-31-2017 03:20 PM
‎01-31-2017 03:20 PM
this is the format: { "epoch": "1485892851.94944", "id": "3952418", "name": "WMI Performance Adapter", "new_attrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Running\",\"User\":\"localSystem\"}", "new_scan_id": "513186", "node_environment_id": "2", "node_id": "153", "node_name": "servername", "node_primary_node_group_id": "68", "old_attrs": "{\"DisplayName\":\"WMI Performance Adapter\",\"ServiceName\":\"wmiApSrv\",\"enabled\":\"Manual\",\"state\":\"Stopped\",\"User\":\"localSystem\"}", "old_scan_id": "513150", "path": "{services,windows}", "status": "modified", "type": "services", "updated_at": "2017-01-31 20:00:51.949442" } trying to use the spath ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎11-28-2023 06:11 PM
Karma from
Karma given to