My Sample data is below: 2017-07-17 23:59:43,156 ERROR------------webserver logs from servers------------ Attributes Key: 'Date' Value: 'Mon Jul 17 23:56:36 EDT 2017' Key: 'Size' Value: '597' Key: 'Attribute' Value: 'unmatched' Key: 'Content' Value: 'http' Key: 'timestamp' Value: '1500350196677' Key: 'origin' Value: 'TEST' Key: 'event_timestamp' Value: '2017-52-78 14:17:39.364' Key: 'file' Value: '1083753866763157' Key: 'tokenid' Value: '0e85b547' Key: 'offset' Value: '112' Key: 'partition' Value: '2' Key: 'topic' Value: 'DEV12345' Key: 'path' Value: './' Key: 'idms' Value: '8339e9de-a743-4534-b346-d5a06ea39b21' ------------ Here I want Date= Mon Jul 17 23:56:36 EDT 2017 size = 597 Attribute = unmatched Content = http .. etc | rex ".*Key:\s\'(?P[^']+)\'\sValue:\s\'(?P[^']+)\'\s+" tried the extraction but here myKey1 , myValue nothing is extracted. Also tried some extract command for pairdelim and kvdelim attributes.. no luck. Any help here will be most helpful. Thanks in advance 🙂 ... View more

Hi, We have 100 's of in our splunk system, what i need is, what are configured Forwarder Inputs in splunk system for all the apps using Splunk query. i.e we have configured all the logs under inputs.conf for each app with monitor stanza around 100's of logs. So I need to get all the logs files using Splunk Query. Please help me. Thanks in advance. ... View more

Hi, we have created some DB inputs(No. 20), it runs on every day with 24hrs frequency. Recently we observed that few of the DBInputs are getting disabling automatically. we also observed that at the time of disabling DBInputs our client accessing Splunk dashboards pages, the CPU utilization is more than "85%" and concurrent searches are more than "25". Our system configuration: Splunk version : 6.2.3 DBConnect Version : Splunk DBConnect v2 2.0.4 RAM memory :16 GB No. of cores : 2 Physical Memory: 301 GB No of concurrent users : 3 we have seen below error message in the dbx2 log: 02/08/2016 10:48:06 [CRITICAL] [mi_base.py] Caught exception Splunkd daemon is not responding: (u'Error connecting to https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB: The read operation timed out',) in modular input mi_input://dbinput_mydbinputsample1. Disabling modular input. for that we have increased "splundtimeout" to 3600 and max memory size to 4096 i.e. 4GB. The memory usage is not going beyond 3GB. please suggest us, what should be the configuration recommended for our system in order to DBInputs running with out fail. ... View more

Hi , We have created DBInputs for our tables with a 15 secs interval, but we are getting the issue below and our DBInputs are getting disabled: 02/08/2016 10:47:41 [ERROR] [__init__.py] Splunkd daemon is not responding: ('Error connecting to /servicesNS/splunk-system-user/-/db_connect/connections/MSSQLDB: The read operation timed out',) Traceback (most recent call last): File "/opt/splunk/splunk_sas/lib/python2.7/site-packages/splunk/rest/__init__.py", line 184, in dispatch methodOutput = method() File "/opt/splunk/splunk_sas/etc/apps/splunk_app_db_connect/bin/dbquery.py", line 66, in handle_GET self.db, self.db_health = self.get_connection(db) File "/opt/splunk/splunk_sas/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 79, in get_connection dbm, conn = self.get_conn_params(db) File "/opt/splunk/splunk_sas/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 92, in get_conn_params conn = en.getEntity(["db_connect", "connections"], db, namespace="-", owner=self.userName, sessionKey=self.sessionKey) File "/opt/splunk/splunk_sas/lib/python2.7/site-packages/splunk/entity.py", line 249, in getEntity serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/opt/splunk/splunk_sas/lib/python2.7/site-packages/splunk/rest/__init__.py", line 478, in simpleRequest raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e)) SplunkdConnectionException: Splunkd daemon is not responding: ('Error connecting to /servicesNS/splunk-system-user/-/db_connect/connections/MSSQLDB: The read operation timed out',) 02/08/2016 10:48:06 [CRITICAL] [mi_base.py] Caught exception Splunkd daemon is not responding: (u'Error connecting to https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB: The read operation timed out',) in modular input mi_input://dbinput_Analyst1. Disabling modular input. 02/08/2016 10:48:09 [ERROR] [__init__.py] Socket error communicating with splunkd (error=The read operation timed out), path = https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB 02/08/2016 10:48:12 [CRITICAL] [mi_base.py] Caught exception Splunkd daemon is not responding: (u'Error connecting to https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB: The read operation timed out',) in modular input mi_input://dbinput_Analyst2. Disabling modular input. 02/08/2016 10:48:25 [CRITICAL] [mi_base.py] Caught exception Splunkd daemon is not responding: (u'Error connecting to https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB: The read operation timed out',) in modular input mi_input://dbinput_ Analyst3. Disabling modular input. 02/08/2016 10:49:05 [CRITICAL] [mi_base.py] Caught exception Splunkd daemon is not responding: (u'Error connecting to https://127.0.0.1:8089/servicesNS/admin/splunk_app_db_connect/db_connect/connections/MSSQLDB: The read operation timed out',) in modular input mi_input://dbinput_ Analyst4. Disabling modular input. Please help us. ... View more

Hi, We have an index, and for every half an hour, it's indexing with 350,000 of events. After every ONE Hour, the previous ONE hour of data is no longer required. So, how can I delete that 1 hour old data from the index, or how can we handle this situation to free up my index memory/ index events after every one hour. What would be the minimum retention period for the Index in Hot/Warm/Cold buckets? What would be the minimum Frozen-period for the index? Thanks in advance. ... View more

Hi , Splunk is pulling data from URLs , which is having below format: <DocumentElement> <CMN_DEPARTMENT><id>DEP00001044</id><sys_id>0036651c6fffb000c60337c64f3ee4ac</sys_id></CMN_DEPARTMENT> <CMN_DEPARTMENT><id>DEP00001045</id><sys_id>0036651c6fffb000c60337c64f3ee4ab</sys_id></CMN_DEPARTMENT> <CMN_DEPARTMENT><id>DEP00001046</id><sys_id>0036651c6fffb000c60337c64f3ee4ad</sys_id></CMN_DEPARTMENT> <CMN_DEPARTMENT><id>DEP00001047</id><sys_id>0036651c6fffb000c60337c64f3ee4ae</sys_id></CMN_DEPARTMENT> <CMN_DEPARTMENT><id>DEP00001048</id><sys_id>0036651c6fffb000c60337c64f3ee4af</sys_id></CMN_DEPARTMENT> <CMN_DEPARTMENT><id>DEP00001049</id><sys_id>0036651c6fffb000c60337c64f3ee4ag</sys_id></CMN_DEPARTMENT> <DocumentElement> Here DocumentElement is the root element, CMN_DEPARTMENT is child element and having "sys_id" are leaf nodes. When I extract index, I'm getting only one sys_id out of 5-6 ids under one event. Like this, we will have 24 events per day (i.e. pulling data from URL every one hour). How to extract each sys_id into index and perform search operations on it? Thanks in advance. ... View more

Hi, Our Splunk DB Connect App 1 suddenly stopped running and it's continuously showing Java Bridge status as "Loading". Using MS SQL server Database & with library jtds1.3.jar Java is Upgraded from 1.7 to 1.8 (i.e. JRE 1.8 jre8u66), still we weren't able to solve this issue. We have uninstalled and installed the DB App 1, but still it's not working. We have deleted state.xml file also. Can anyone please help me, how to resolve this issue. ... View more

Hi , Below is my search: < base-search > | outputlookup Results.csv | search inputlookup Results.csv | xyseries col1, col2, col3 I'm writing my result into a lookup file results.csv. Results contains 3,60,00 records. It's taking time to write data into the lookup file, so when I use inputlookup file immediately after outputlookup, it's giving error as "The lookup table 'Results.csv' is invalid". When I check in the lookup definitions tab, I can see the Results.csv file. How do I avoid a delay in writing data into a CSV file so that my .csv file will available for the rest of the search? Or do we have any options other than using input/outputlookup files?. Thanks in advance.. ... View more