About vsommer

vsommer

Hello, you should be able to view your certificates in Splunk STEP (https://education.splunk.com/). Navigate to My Stuff -> My Current Learning Please upvote if this helped you 🙂

vsommer · ‎03-28-2023

Hello Vishal, is the folder structure always the same? If yes, this should work: | rex field=source "Daily Reporting\\(?<business_unit>[^\\]+)" If not you could use this regex: \\\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\[^\\]+\\(?<business_unit>[^\\]+) If you want to include this to props.conf and transforms.conf try something like this: props.conf [sourcetype] REPORT-my_fields = business_unit transforms.conf [business_unit] SOURCE_KEY = source REGEX = one of the above mentioned regex If this helps please upvote my answer. Best regards, Vincent

vsommer · ‎09-15-2021

That's strange. Are the fields you removed from the search part of the datamodel? Yes.. Thanks for your help! I will look at the documentation.

vsommer · ‎09-13-2021

I only removed the fields from my search, not from the datamodel. The acceleration status is 100% completed. The size on disk is only about a few MB...

vsommer · ‎09-13-2021

Hello, what is the best way to get data from dynamoDB to Splunk?

vsommer · ‎09-13-2021

Thanks for your answer but unfortunately this doesn't solve my problem. When I remove some fields from my tstats search the search is successful. My datamodel contains 178 fields. Is it possible that there are restrictions regarding the limit of a datamodel?

vsommer · ‎08-26-2021

Hello, I have a problem regarding a datamodel search. My datamodel consists of different boolean values with a span of 5s. The summary range of the data model is defined for two weeks. I want to walk through the data and count events which contain the value "true" (GROUPBY _time span=5s ....). When I'm running the search with earliest=-2d@d I get an error "Job terminated unexpectedly". In the search.log I found "ERROR ProcessRunner - helper process seems to have died (child killed by signal 9: Killed)!" When I'm running the same search for earliest=-1d@d I don't get an error. In the OS logs of my server I've noticed that the cpu nearly reaches 100% of the capacity. THP is disabled. Thank you 🙂

Posts	9
Solutions	1
Karma Given	4
Karma Received	3
Member Since	‎08-05-2019

Online Status	Offline
Date Last Visited	Thursday

Getting data from dynamodb to Splunk

Datamodel Search "Job terminated unexpectedly"

Re: How do i view my splunk certificate in splunk ...

Re: Create a field from values with the source fie...

Re: Datamodel Search "Job terminated unexpectedly"

Re: Datamodel Search "Job terminated unexpectedly"

Getting data from dynamodb to Splunk

Re: Datamodel Search "Job terminated unexpectedly"

Datamodel Search "Job terminated unexpectedly"