About dperry

dperry · ‎07-29-2023

thank you for the reply!

dperry · ‎07-28-2023

I have an On-Prem deployment Server and an AIX Server with a UF. I have a log monitor that redirects and overwrites an out file every minute. example: -rw-r--r-- 1 root system 27804 Jul 27 17:32 /usr/local/bin/reports/mysycpost_check.out -rw-r--r-- 1 root system 27804 Jul 27 17:33 /usr/local/bin/reports/mysycpost_check.out -rw-r--r-- 1 root system 27804 Jul 27 17:34 /usr/local/bin/reports/mysycpost_check.out The contents of this file contains 41 lines every time its overwritten but contain different values each time: SYM000 19727072 23724770 0 - 0:28 SYCPOST SYC000 /SYM/SYM000 SYM000 22807268 23724770 0 - 0:17 SYCPOST SYC000 /SYM/SYM000 SYM000 23200462 23724770 0 - 0:08 SYCPOST SYC000 /SYM/SYM000 SYM000 23266014 23724770 0 - 0:14 SYCPOST SYC000 /SYM/SYM000 SYM000 23659042 23724770 0 - 0:11 SYCPOST SYC000 /SYM/SYM000 SYM000 23855850 23724770 0 - 0:35 SYCPOST SYC000 /SYM/SYM000 SYM000 24576546 23724770 0 - 0:43 SYCPOST SYC000 /SYM/SYM000 SYM000 24838656 23724770 0 - 0:06 SYCPOST SYC000 /SYM/SYM000 SYM000 24904198 23724770 0 - 0:09 SYCPOST SYC000 /SYM/SYM000 SYM000 24969758 23724770 0 - 0:22 SYCPOST SYC000 /SYM/SYM000 SYM000 25035266 23724770 0 - 0:56 SYCPOST SYC000 /SYM/SYM000 SYM000 25100802 23724770 0 - 0:06 SYCPOST SYC000 /SYM/SYM000 SYM000 25166340 23724770 0 - 0:05 SYCPOST SYC000 /SYM/SYM000 SYM000 25231878 23724770 0 - 0:04 SYCPOST SYC000 /SYM/SYM000 SYM000 25362954 23724770 0 - 0:04 SYCPOST SYC000 /SYM/SYM000 SYM000 25428492 23724770 0 - 0:03 SYCPOST SYC000 /SYM/SYM000 SYM000 25494030 23724770 0 - 0:03 SYCPOST SYC000 /SYM/SYM000 (41 lines) As of right now the timestamp is coming from the value: "0:28 " at the top of the file which makes it 12:28am. So all my events are using this value for time. This is incorrect. I want the file to be one event and get the timestamp of the actual time of the log when its written: Jul 27 17:32 Jul 27 17:33 Jul 27 17:34 and so on.... Here is the inputs .conf and my props.conf (which is side by side on my Deplyment Server: /opt/splunk/etc/deployment-apps/cu-infrastructure-xxx/local [root@deployment_server local]# ll total 12 -rw-------. 1 splunk splunk 21 Dec 30 2020 app.conf -rw-rw-r--. 1 splunk splunk 1326 Jul 27 14:20 inputs.conf -rw-r--r--. 1 splunk splunk 115 Jul 27 16:16 props.conf Props.conf [sycpost] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 Inputs.conf ### symitar SYCPOST utilization logs [monitor:///usr/local/bin/reports/mysycpost_check.out] disabled = false index = cu-infrastructure-xxx sourcetype = sycpost Question is Do I have my Props.conf in the right location? Deployment Server? Does it need to by on my Cloud indexers? IS the Props correct? IM trying to have the log determine the time of the event.

dperry · ‎09-02-2022

Recently learned of this new Splunk app for Red Hat Insights. Just curious if anyone is currently utilizing in with their Splunk Cloud. We looked into installing the app but says the app does not support search head cluster deployments. I realize Splunk defers all support to Red Hat for this application and exploring if anyone came across this issue.

dperry · ‎11-18-2021

Has anybody used or currently using DB Connect to their Red hat satellite Server?

dperry · ‎06-25-2018

Hi renjith.nair....this works great....I have a question thugh...how would I make only two ranges..... True would output ONHOST (in green) and False output OFFHOST (RED)

dperry · ‎06-20-2018

I want to create a dashboard that simply reports a specific process is UP or DOWN. Preferable one that shows ON (GREEN) or OFF (Red). this is my search: Process is ON index=myindex sourcetype=mysourcetype host=myhost type=process_monitor process=Myprocess status=True Process is DOWN index=myindex sourcetype=mysourcetype host=myhost type=process_monitor process=Myprocess status=False the search is run every 5 minutes I want the dashboard to be in realtime.....

dperry · ‎04-19-2018

works like a charm! Thank you!!!

dperry · ‎04-19-2018

04/19/18 12:32:17.398524 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:32:17 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:32:17.398907 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:32:17 PM)~K1:SymConnect is off host 04/19/18 12:33:26.915422 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Ho stLoanExists).DATETIME(4/19/2018 12:33:26 PM)~A0~BLMS~DCARD~F??????????????~H LOAN~JID=ALL 04/19/18 12:33:26.930871 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER( HostLoanExists).DATETIME(4/19/2018 12:33:26 PM)~K0~JID=01~JID=02~JID=03~JID=0 4~JID=05~JID=06~JID=07~JID=08~JID=09~JID=10~JID=80~JID=81~JID=82 04/19/18 12:33:39.309465 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:33:39 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:33:39.310146 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:33:39 PM)~K0~JID=01~JID=02~JID=80~JID=81 04/19/18 12:34:05.371520 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Hos tLoanExists).DATETIME(4/19/2018 12:34:05 PM)~A0~BLMS~DCARD~F??????????????~HL OAN~JID=ALL 04/19/18 12:34:05.372184 - RSIQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(H ostLoanExists).DATETIME(4/19/2018 12:34:05 PM)~K0~JID=80 04/19/18 12:34:57.811784 - IQ~MSG.ACCTNUM(XXXX).FUNCTION(Inquiry).CALLER(Host LoanExists).DATETIME(4/19/2018 12:34:57 PM)~A0~BLMS~DCARD~F??????????????~HLO AN~JID=ALL A new entry always begin with 00/00/00 What would the line_break be for my props?

dperry · ‎09-25-2017

@sbbadri it worked.....placed this on my four indexers, restarted the instance and the next time the file generated new data the interesting fields (headers) were parsed out. Thank you!

dperry · ‎09-22-2017

thx @sbbadri I will add this to my four indexers and restart. I will let you know the outcome

dperry · ‎09-22-2017

dperry · ‎09-22-2017

I want the headers to be in the interesting fields, like so: date - 1470207600 name - myserver capacity - 62.00TB and so on.....attached example

dperry · ‎09-22-2017

So added the Props to all four indexers, restarted them: [SVC_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline I run the search sourctype=SVC_capacity index=zz_test And the index data is only tailing the newer data without checking the headers: date,name,capacity,free_capacity,virtual_capacity,used_capacity,real_capacity,overallocation,compression_virtual_capacity,compression_compressed_capacity,compression_uncompressed_capacity so my index data looks like this: 1470207600,myserver,62.00TB,16.67TB,163.02TB,41.80TB,45.24TB,262,86.72TB,34.97TB,69.88TB 1470207600,MigrationPool_8192,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB 1470207600,MigrationPool_512,0,0,0.00MB,0.00MB,0.00MB,0,0.00MB,0.00MB,0.00MB

dperry · ‎09-22-2017

So I dont need a transforms.conf, right? All I need is the these two, right? On the UF : inputs.conf on the Indexer: props.conf inputs [monitor:///usr/local/bin/reports/storage/emc_capacity.out] disabled = false index = zz_test sourcetype = VMAX_capacity props [VMAX_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline

dperry · ‎09-22-2017

thank you again....I see the props is this: [VMAX_capacity] FIELD_DELIMITER = "," CHECK_FOR_HEADER = true HEADER_MODE = firstline So the tranforms is this: [VMAX_storage_csv] DELIMS = "," FIELDS = "Date","Array","Useable","Used","UsedPercent","UsedGrowth","Free","Subscribed","SubscribedMax","SubscribedPercent","SubscribedGrowth","Snapshot","compression","ExpansionNeeded" and then place both files on my indexers......

Posts	76
Solutions	4
Karma Given	3
Karma Received	16
Member Since	‎09-29-2013

Online Status	Offline
Date Last Visited	Tuesday

Why is there incorrect Timestamp from log?

Red Hat Insights App for Splunk- Has anyone had ex...

DB Connect and Red Hat Satellite

Dashboard to show process is "UP" or "DOWN"

Help with Line Break for log

How can I import this CSV file into Splunk?

How to edit my props.conf to correctly line break ...

Trying to parse my Json into a table

Tokens based on Tags

Importing a file, how do I configure Splunk to par...

Re: Incorrect Timestamp from log

Why is there incorrect Timestamp from log?

Red Hat Insights App for Splunk- Has anyone had ex...

DB Connect and Red Hat Satellite

Re: Dashboard to show process is "UP" or "DOWN"

Dashboard to show process is "UP" or "DOWN"

Re: Help with Line Break for log

Help with Line Break for log

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?

Re: How can I import this CSV file into Splunk?