Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About KarunK
KarunK
Contributor
Member since:
09-15-2011
06-05-2020
Community Statistics
| Posts | 105 |
| Solutions | 3 |
| Karma Given | 6 |
| Karma Received | 20 |
| Member Since | 09-15-2011 |
Activity Feed
- Karma Re: How to arrange the text inputs on my dashboard form? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: difference of two values of same field inside a transcation for Ayn. 06-05-2020 12:46 AM
- Karma Re: conditional converion for sideview. 06-05-2020 12:46 AM
- Karma Re: Field categorization for dmr195. 06-05-2020 12:46 AM
- Karma Re: click a table using converttointention for sideview. 06-05-2020 12:46 AM
- Karma Re: Assign an index and sourcetype name different from forwarder in Indexers for kristian_kolb. 06-05-2020 12:46 AM
- Got Karma for timechart in 4.3.3. 06-05-2020 12:46 AM
- Got Karma for Extract key value pair from xml. 06-05-2020 12:46 AM
- Got Karma for Custom FlashTimeLine using Sideview Utils. 06-05-2020 12:46 AM
- Got Karma for Re: How to assign index of an app to another.. 06-05-2020 12:46 AM
- Got Karma for How to assign index of an app to another.. 06-05-2020 12:46 AM
- Got Karma for Cannot search using sourcetype but can search with index. 06-05-2020 12:46 AM
- Got Karma for Cannot search using sourcetype but can search with index. 06-05-2020 12:46 AM
- Got Karma for Realtime search in dashboard slow compared to realtime in flashtimeline. 06-05-2020 12:46 AM
- Got Karma for timechart in 4.3.3. 06-05-2020 12:46 AM
- Got Karma for timechart in 4.3.3. 06-05-2020 12:46 AM
- Got Karma for Re: Backfill not working for a realtime dashboard. 06-05-2020 12:46 AM
- Got Karma for string to time and then timechart. 06-05-2020 12:46 AM
- Got Karma for conditional converion. 06-05-2020 12:46 AM
- Got Karma for Concurrency by ..................... 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 |
10-18-2018
10:31 PM
The reason I explained above is not the cause of the issue. Even in my local fluentd, the logs shows that an extra "\" will get applied. So not the cause of it.
After further ;looking into the config maps of the Kubernet connect I have noticed that all the /var/log/containers/*.log configs are hard coded and does not support the multiline. The multiline option is only for other logs which are not part of the /var/log/containers/ folder.
If anyone else have any ideas of doing it please let me know.
Thanks
kin
... View more
10-11-2018
09:33 PM
Hi,
I am trying to use the Splunk connect fro Kubernetes to eextarct the kube logs. However i cannot get the multiline event parsing working. Config i have used is as below.
multiline:
firstline: "\d+"
flushInterval 5s
When i check the fluentd config i can see the following related config with an extra "\".
format_firstline "/^\\d+/"
Not sure why there is an extra "\". This is causing issues for me as the regex is not getting applied.
Anyone had faced similar issues ?
Thanks
Regards
KKN
... View more
07-10-2018
12:24 AM
Hi jadengoho,
G'day. have you managed to resolve this issue ?
Thanks
kkn
... View more
07-09-2018
11:43 PM
I am also having the same problem ?
Has anyone managed to resolve this issue ?
*Salesforce URL : abc--DEV1.c6.my.salesforce.com
Username : splunkintegrationuser@anc.com.dev1
*
07-10-2018 15:00:25.371 +1000 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" Traceback (most recent call last):
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/modinput_wrapper/base_modinput.py", line 113, in stream_events
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" self.parse_input_args(input_definition)
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/modinput_wrapper/base_modinput.py", line 152, in parse_input_args
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" self._parse_input_args_from_global_config(inputs)
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/modinput_wrapper/base_modinput.py", line 171, in _parse_input_args_from_global_config
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" ucc_inputs = global_config.inputs.load(input_type=self.input_type)
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/global_config/configuration.py", line 279, in load
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" self._references,
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/global_config/configuration.py", line 300, in _reference
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" configs
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/global_config/configuration.py", line 332, in _input_reference
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" config_name=config_name
07-10-2018 15:00:27.501 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_event_log.py" GlobalConfigError: Config Not Found for Input, input_type=sfdc_event_log, input_name=event_log, config_type=account, config_name=splunkintegrationuser@anc.com.dev1
... View more
11-29-2016
08:18 PM
I am also facing the same issue with eventgen when i am trying to generate Windows HostMon data. I think the breaker is the causing the problem. Any suggetions for mutliline event generation ?
... View more
11-08-2016
04:21 PM
To provide some back ground, what i have in my lab is Windows 2008 R2 server
... View more
11-08-2016
04:01 PM
Hi Luke
I am also getting same error pasted by Shrirang_Ambekar
"File "E:\APPS\Splunk\Python-2.7\Lib\hashlib.py", line 97, in _get_builtin_constructor
raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type md4"
Status is shown as "Connection Failed" So it not working yet.
Any advice ?
Thanks
KKN
... View more
06-28-2016
11:11 PM
Hi All,
I am using a map command to pass some value to a search which needs to create 5 lookup files based on the input from map command.
The searches are running perfectly fine, but in the GUI, I am seeing a warning which says the results are getting truncated. But when I look at the CSV file, I am getting more than 10,000 results - to be accurate, 20,000 - 500,000 results. Also I am getting the same results when run all the five searches independently.
My question is, what is getting truncated?
| input lookup lookup.csv | table search_key CSV
| map search=" search index=abc " $search_key$ | stats latest(*) as * by host | outputlookup lookup_$CSV$.csv"
INFO: [map]: Subsearch produced 595143 results, truncating to maxout 10000.
INFO: [map]: Subsearch produced 51000 results, truncating to maxout 10000.
INFO: [map]: Subsearch produced 22345 results, truncating to maxout 10000.
INFO: [map]: Subsearch produced 43687 results, truncating to maxout 10000.
INFO: [map]: Subsearch produced 69143 results, truncating to maxout 10000.
My understanding is If the subsearch results are getting truncated, then I shouldn't be seeing the more than 10,000 result in the outputlookup files.
Thanks in Advance
Regards
KKN
... View more
05-22-2016
09:41 PM
That was my guess too. Thanks for your response. Appreciate that.
Any one else have a different opinion ?
... View more
05-22-2016
05:42 PM
Hi All,
I am trying to improve my run time for a large search and i need some help to identify whether eventstats is a Distributable command. From the documentation i know streamstats is Centralized streaming. link:SearchReference/Commandsbytype
What i am trying to achive is not to use those search commands which requires data to be uploaded to Search Heads.
Thanks for your help.
Regards
... View more
12-21-2015
05:59 PM
Same Problem as well on 6.3.1
... View more
03-01-2015
10:24 PM
Hi Mark,
Here is my search. I got stuck here. Both searches have to run on a window of 1hour each, for a period of a day. Means run 1 hour then corelate both data sources and then run for another hour, then co-relate again for a whole day. That way we can take care of the transient data.
index="radius_logs" [ search index="trasnsaction_logs" | table c_ip | rename c_ip as cus_ip ]
Thanks
Regards
KKN
... View more
02-26-2015
08:28 PM
Hi All,
I have two data sources. One of them is a transient data which keeps changing. I have to use this search as a lookup source (instead of CSV) for another search.
Lookup data:-
_time ip_address username
Search
_time ip_address request_count location
I want to do lookup to match ip_address and _time and corelate the request_count and location info to a username. The ip_address for a particular username keep changing all the time. So at a given point in time if the _time and ip address matches then corelate the two data sets.
transaction comamnd is taking too much time.
Is there any other way to it ?
Thanks in advance.
Regards
KKN
... View more
- Tags:
- lookup
01-26-2015
04:13 PM
Indexers on UTC
Search Head on EDST
... View more
01-21-2015
09:28 PM
Hi All,
I am doing a simple bucketing of events and counting it. But when i bucket the events its always does it in odd numbers, but i want to do it in even numbers.
for eg:
index=abc | bucket _time span=12h | stats count by _time
i get buckets as 23:00,11:00,23:00 - odd numbers
but i want 12:00, 24:00 - even numbers.
How can i achieve this ?
Thanks in Advance
KK
... View more
09-18-2014
08:40 PM
Values wont work as it show only the unique value. I want to show all values.
Thanks for your thoughts !!!
KKN
... View more
09-14-2014
04:34 PM
Hi All,
I have a following table. Total is the sum of the cost of items by country using eventstats.
Country Items cost Total
US pen 3 6
US pencil 2 6
US paper 1 6
UK pen 6 12
UK pencil 3 12
UK paper 3 12
HK pen 4 7.5
HK pencil 2.5 7.5
HK paper 1 7.5
I need to modify the table to look like below.
Country Items cost Total
US pen 3 6
pencil 2
paper 1
UK pen 6 12
pencil 3
paper 3
HK pen 4 7.5
pencil 2.5
paper 1
I have played around with stats values function but of no use. Any ideas ???
Thanks in Advance.
KK
... View more
- Tags:
- table
09-10-2014
12:14 AM
Thank You !!! Appreciate that.
... View more
09-09-2014
06:40 PM
Hi All,
I have a table like below (raw table), which shows count of request per 4 hours from two services over a period of two days. I need to find the count values of ServiceA and ServiceB on each day, when the combined request is at peak per day. That will be the values below.
Peak values:-
1/01/2014 4:00 56 89 145
2/01/2014 8:00 56 78 134
Raw Table:-
_time ServiceA ServiceB Total
1/01/2014 0:00 45 56 101
1/01/2014 4:00 56 89 145
1/01/2014 8:00 78 54 132
1/01/2014 12:00 41 11 52
1/01/2014 16:00 23 23 46
1/01/2014 20:00 56 58 114
2/01/2014 0:00 38 56 94
2/01/2014 4:00 54 41 95
2/01/2014 8:00 56 78 134
2/01/2014 12:00 11 23 34
2/01/2014 16:00 23 45 68
2/01/2014 20:00 58 56 114
3/01/2014 0:00 80 49 129
Any ideas how to do it ???
Regards
KK
... View more
03-18-2014
03:56 PM
Have a look at the permission of the index. Does the user allowed access the index ???
If not add the index to the role in which the user is in.
Access controls » Roles »
... View more
01-28-2014
04:45 PM
Proxy settings shown above are not the correct one. I have masked it for security purposes. I have removed the proxy settings but still i am getting "ServerNotFoundError".
... View more
01-27-2014
10:34 PM
Hi All,
I have installed the website monitoring app in my PC (Splunk 6). But I couldn't make it working.Its says "Connection Failed"
python_modular_input.log logs looks good.
2014-01-28 17:16:39,510 INFO Execute called
2014-01-28 17:16:39,510 INFO Modular input: validate arguments called
2014-01-28 17:16:39,513 INFO Execution completed successfully
2014-01-28 17:16:40,855 INFO Execute called
web_availability_modular_input.log has ServerNotFound error.
2014-01-28 17:49:29,674 ERROR A general exception was thrown when executing a web request
Traceback (most recent call last):
File "D:\Splunk\etc\apps\website_monitoring\bin\web_ping.py", line 255, in ping
response, content = http.request(url.geturl(), 'GET')
File "D:\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1421, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "D:\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1171, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "D:\Splunk\Python-2.7\Lib\site-packages\httplib2\__init__.py", line 1128, in _conn_request
raise ServerNotFoundError("Unable to find the server at %s" % conn.host)
ServerNotFoundError: Unable to find the server at www.bbc.uk
Can anyone please help to fix it? The config are as follows
website_monitoring.conf
[default]
proxy_password = PASSWORD
proxy_port = 8080
proxy_server = proxy.com
proxy_user = user1
inputs.conf
[web_ping://bbc]
index = main
interval = 1m
title = presto
url = http://www.bbc.co.uk/
The indexed events looks like below.
timed_out=False title=bbc response_code= request_time= url=www.bbc.co.uk total_time=
Thanks for your help.
Regards
KK
... View more
- Tags:
- monitoring
- website
11-07-2013
03:20 AM
Hi,
I have tried that too..Didn't work. It may be because, the data source is xml. Just guessing...
thx mate ..
kkn
... View more
11-06-2013
09:33 PM
Hi Shane,
Thanks for the quick response. I am already doing xmlkv and extracting the XML values for me.
Eg:
body=Payment Overdue.Amount=176.Discount=16.Pay=160
I can see rex command will be usefull. But i am looking for a generic rule which will extract every thing in "body" automatically.
Regards
kkn
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
