Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cyvi01
cyvi01
Path Finder
Member since:
08-08-2019
11-15-2022
Community Statistics
| Posts | 14 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-08-2019 |
Activity Feed
- Posted Re: What is the splunk search query to find oldest (first) event generated on an index? on Splunk Search. 11-15-2022 03:14 AM
- Posted Re: How do you find the earliest event in an index by sourcetype and source? on Splunk Search. 11-15-2022 02:50 AM
- Posted Re: EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main sear on Dashboards & Visualizations. 11-10-2022 04:00 PM
- Tagged Re: EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main sear on Dashboards & Visualizations. 11-10-2022 04:00 PM
- Posted EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Tagged EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Tagged EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Tagged EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Tagged EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Tagged EVAL tag in simple XML with replace regular expressions OR variable with multiple values to be used in the main search? on Dashboards & Visualizations. 11-10-2022 06:41 AM
- Posted Re: In Splunk DB Connect app, under splunk dbx_job_metrics.log, what are read_count and write_count fields mean on All Apps and Add-ons. 08-27-2021 05:15 AM
- Posted Re: Decode indexer name hashes (GUID) from license_usage.log on All Apps and Add-ons. 08-27-2021 04:30 AM
- Posted Re: AWS Add-on for AWS keeps loading on All Apps and Add-ons. 08-31-2020 02:20 PM
- Posted Re: AWS Add-on for AWS keeps loading on All Apps and Add-ons. 08-05-2020 06:17 AM
- Posted Re: In Splunk DB Connect app, under splunk dbx_job_metrics.log, what are read_count and write_count fields mean on All Apps and Add-ons. 08-05-2020 06:07 AM
- Posted Re: AWS Add-on for AWS keeps loading on All Apps and Add-ons. 07-14-2020 03:51 AM
- Posted Re: AWS Add-on for AWS keeps loading on All Apps and Add-ons. 07-09-2020 01:23 PM
- Posted Re: AWS Add-on for AWS keeps loading on All Apps and Add-ons. 07-09-2020 10:54 AM
- Posted AWS Add-on for AWS keeps loading on All Apps and Add-ons. 07-09-2020 09:52 AM
- Posted How to automatically create services in ITSI with correct entity filtering ? on Splunk IT Service Intelligence. 08-08-2019 08:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
11-15-2022
03:14 AM
| tstats earliest(_time) AS _time WHERE index=bla is enough
... View more
11-15-2022
02:50 AM
| stats earliest(_time) AS Earliest_Time
| eval Earliest_Time=strftime(Earliest_Time,"%Y-%m-%d %H:%M:%S") can be replaced by a simple | stats earliest(_time) AS _time Splunk formats _time by default which allows you to avoid having to reformat the display of another field dedicated to time display.
... View more
11-10-2022
04:00 PM
Thank you as your point is not the solution but helped me a lot to know what to do : <eval token="exclude_uri">"cs_uri_sterm!=\"".replace($exclude$,"\\s+","\" cs_uri_sterm!=\"")."\""</eval> It looks like that empty (which is perfect). or like that if filled :
... View more
- Tags:
- Actually
11-10-2022
06:41 AM
Hi, I´m facing a problem. I´m trying to solve my current issue via 2 different approaches but i´m unfortunately unable to complete any of these solutions. I´m trying to provide a dashboard with a form whose some of the fields to fill should allow users to sort data using multiple inclusions or exclusions to fit what each and every team works with. Solution 1 : By using an EVAL tag in the XML code and use the variable in the main basesearch like "index=test $exclude_uri$ | stats count BY cs_uri_sterm" I tried something like and use a panel to display the result :
<form>
<fieldset submitButton="true">
<input type="text" token="exclude" searchWhenChanged="true">
<default></default>
<change>
<eval token="exclude_uri">replace(replace(trim(exclude), "\\s+", " "), "(\\S+)", "cs_uri_sterm!=\"\1\"")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<p>Token:<b>$exclude_uri$</b></p>
</html>
</panel>
</row>
</form>
However i´m facing several issues : - for some reasons multiple whitespaces are removed by default even though i decide to remove the replace and trim functions dedicated to that. Why ? - \1 does not seem to be recognized. For some reasons a lot of people do not need \\ but it seems like i need them but this does not work for \\1 anyway, only for \s+ and \S+. Any reason ? How can i make this work ? On the other side, it does work if i implement the same in a makeresults test search as follows :
| makeresults
| eval exclude="/assets/* /api/* "
| eval exclude_uri=replace(replace(trim(exclude), "(\S+)", "cs_uri_sterm!=\"\1\""), "\s+", " ")
providing :
_time exclude exclude_uri
2022-11-10 15:21:17 /assets/* /api/* cs_uri_sterm!="/assets/*" cs_uri_sterm!="/api/*"
Why is it different ? Solution 2 : Use a Makeresults like above and use the output of it as a direct filter in my basesearch I tried that but im not able to find a proper solution :
index=test [ | makeresults | eval | eval exclude_uri=replace(replace(trim($exclude$), "(\S+)", "cs_uri_sterm!=\"\1\""), "\s+", " ") | table exclude_uri ]
I should get something like index=test cs_uri_sterm!="/assets/*" cs_uri_sterm!="/api/*" if the user filled "/assets/* /api/*" in the form text input. I have also tried the same with a MV field.
index=text [ | makeresults | eval exclude_uri=replace(replace(trim($exclude$), "(\S+)", "cs_uri_sterm!=\"\1\""), "\s+", " ") | makemv delim=" " exclude_uri | mvexpand exclude_uri | table exclude_uri ]
Nothing works. Spent few hours trying to look at solutions. Even tried to see if i could use something like search ... IN or where something. Any advice ? I really need this. Javascript may be my solution, i don´t know. Kind of stuck here.
... View more
Labels
- Labels:
-
simple XML
08-27-2021
05:15 AM
I suggest you to upgrade the app first to the latest available version for your Splunk environment.
... View more
08-27-2021
04:30 AM
For Splunk 7 & 8 at least: To get the daily ingestion per indexer with the hostname rather than the GUID following your time range picker selection. index=_telemetry source=*license_usage_summary.log* type="RolloverSummary"
| join type=inner slave [ | rest /servicesNS/-/-/search/distributed/peers splunk_server=local | table guid host | rename guid AS slave ]
| search host=*PATTERN*
| timechart span=1d eval(round(latest(b) / 1024 / 1024 / 1024, 3)) AS sizeGB BY host useother=f Replace PATTERN by your indexers hostname convention.
... View more
08-31-2020
02:20 PM
Yes it did. The AWS Add-on does not seem to be able to display anything even though the configuration fields should have nothing to do with the connectivity itself but apparently the code does only retrieve configuration data after a connection is acknowledged.
... View more
08-05-2020
06:17 AM
The problem was in the firewall. Allow https://sts.amazonaws.com was not enough. *.amazonaws.com does not work in Check Point and we had to use the dedicated Amazon Services object which unfortunately is way too wide in terms of accessible IPs and services ...
... View more
08-05-2020
06:07 AM
What you are saying now is impossible... 2020-08-05 15:59:47.101 +0400 INFO c.s.dbx.server.task.listeners.JobMetricsListener - action=collect_job_metrics connection=XXX jdbc_url=null db_read_time=86 hec_upload_time=124 hec_record_process_time=195 format_hec_success_count=10380 hec_upload_bytes=9885449 status=COMPLETED input_name=XXXinput batch_size=1000 error_threshold=N/A is_jmx_monitoring=false start_time=2020-08-05_03:59:46 end_time=2020-08-05_03:59:47 duration=414 read_count=331755987 write_count=331599055 filtered_count=0 error_count=0 batch_size is 1000... How can i read 331755987 and write 331599055... I´m not able to find the number of rows being read and written to the index apart from counting directly from the index and sourcetype...
... View more
07-09-2020
01:23 PM
Yes we have a valid QA license for Enterprise. Ok I will make sure that this HF is not somehow excluded from our licensed QA env
... View more
07-09-2020
09:52 AM
Hi, I just installed this Add-on (4.6.1) on one of our Heavy Forwarders (7.3.1.1) in QA. I can not browse the application as it keeps loading on Inputs and Configuration tabs. The logs index=_internal source="/opt/splunk/var/log/splunk/splunkd.log" sourcetype=splunkd ERROR aws displays 07-09-2020 18:35:02.158 +0200 ERROR AdminManagerExternal - Unexpected error "<class 'splunk.AuthorizationFailed'>" from python handler: "[HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_aws/configs/conf-server/sslConfig". See splunkd.log for more details.
host = sto-splunk-qa-hf12.bde.localsource = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd
09/07/2020
18:35:02.158
07-09-2020 18:35:02.158 +0200 ERROR AdminManagerExternal - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 88, in init_persistent\n hand = handler(mode, ctxInfo, data)\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/aws_sqs_inputs_rh.py", line 28, in __init__\n **kwargs\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/base_input_rh.py", line 44, in __init__\n self._service = LocalServiceManager(app=tac.splunk_ta_aws, session_key=self.getSessionKey()).get_local_service()\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/local_manager.py", line 14, in __init__\n enable_ssl = self._get_entity('configs/conf-server', 'sslConfig').get('enableSplunkdSSL')\n File "/opt/splunk/etc/apps/Splunk_TA_aws/bin/splunk_ta_aws/common/local_manager.py", line 28, in _get_entity\n return entity.getEntity(path, name, sessionKey=self._session_key, namespace=self._app, owner=self._owner)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 265, in getEntity\n serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 536, in simpleRequest\n raise splunk.AuthorizationFailed(extendedMessages=uri)\nAuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/nobody/Splunk_TA_aws/configs/conf-server/sslConfig\n Is it some kind of SSL issues somehow ? (I just installed the app and did nothing else). I can not figure out why it does not work as expected.
... View more
Labels
- Labels:
-
administration
-
configuration
-
installation
08-08-2019
08:12 AM
Hello,
Let me describe what i´m trying to do.
I have a base search with multiple KPIs to monitor K8S pods and clusters.
I have also 2 CSV import searches :
- One to create the pods entities with additional info field with format cluster_name#metadata.namespace.
index=payment_k8s sourcetype="kube:objects:pods" | rename metadata.name AS pod, metadata.namespace AS namespace | eval entity = cluster_name."#".namespace | fields pod entity
One for the list of services to be created.
index=payment_k8s sourcetype="kube:objects:namespaces" status.phase="Active" | rename metadata.name as namespace | eval entity=cluster_name."#".namespace, ServiceTemplate="PAY:K8S", env=if(cluster_name="payment_bma","bg","ge"), ServiceTitle="PAY.".upper(env).".K8S.".namespace | stats latest(metadata.requestResourceVersion) by ServiceTemplate,ServiceTitle,entity,env
I have manually created a service and based on this service i created a service template named PAY:K8S. Each service should represent a K8S namespace. The entities in these services will be the pods belonging to the respective namespace.
In each service, i should have an Entity Rule like |Info| entity matches cluster_name#namespace (which is the "entity" field in the base search and in the first CSV Import search above).
I do not want to edit the match manually because i want to create the services automatically without having to go into every single service to update this Entity Rule.
How can i do that ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-15-2022
06:35 AM
|
