About kenchisho

kenchisho · ‎12-15-2014

I am using the "dbquery" command to update tables in MSSQL 2008. The search is something like: | dbquery test_db "UPDATE test_table1, test_table2 SET Data1='test1', Data2='test2', Status='Closed' WHERE AccountNumber='1234567890988'" The inline search updates the database as expected. However the search provides no results which I can use to tell the user if it succeded or not. The Job inspector shows a message... Update statement executed. 1 rows affected. Is it possible to display this message as a search result?

kenchisho · ‎10-21-2014

Environment: Windows Server 2008 R2 x64 MS SQL 2008 R2 Splunk 6.1.4 win x64 DBX 1.1.4 When trying to add a tail input from a database using a SQL Query statement I get an error... Encountered the following error while trying to save: In handler 'dbx-monitors': Unable to xml-parse the following data: Failed to validate: com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://SrvDb/... See splunkd.log for full data. The SQL Query work like a charm when running it manually with the dbquery command. SELECT RecordLog.RecordID , CallLog.StartTime, CallLog.StopTime, RecordLog.UserName AS Name, CallLog.UserID, CallLog.Team, RecordLog.FileName, CallLog.StopTime-CallLog.StartTime AS Duration FROM CallLog INNER JOIN RecordLog ON CallLog.ServerID = RecordLog.ServerID AND CallLog.GlobalID = RecordLog.GlobalID AND CallLog.UserID = RecordLog.UserID {{WHERE $rising_column$ > ?}} The rising column is set to RecordLog.RecordID. I am out of ideas and any help is welcome. Kenan

kenchisho · ‎02-22-2013

I'v already tried that. Been playing with this all day. The case is that I am indexing a binary encoded log file... Splunk indexes all ASCII characters without a problem... but there are a few non-ASCII characters that are indexed as "\x6\xD1" which would be "Đ". I've tried modifying the CHARSET but the only one that works is CP852, which is sadly not supported by Splunk. As for SED I have not been able to match the pattern with a sed regex within Splunk, however when using standalone Regex tools or OSX CLI sed I match and replace the patterns without problems... I have managed to work this out using transforms.conf with a regex and then applying that in props multiple times (ex. 10 times for a possibe 10 repetitions of the same character in 1 event). This is a very ugly workaround and I will try to find another way. Example: raw data: \x6\xD1\x6\xD1\x6\xD1\x6\xD1\x6\xD1 transforms.conf [bin2text] REGEX = (?)(.*)\x6\\xD1(.*) FORMAT = $1Đ$2 props.conf [sourcetype] TRANSFORM-test = bin2text, bin2text, bin2text, bin2text, bin2text result data: ĐĐĐĐĐ As I said a very ugly solution but the only one I got working. I'm open to suggestions if someone has an idea...

kenchisho · ‎02-22-2013

Hi guys, I have been playing around trying to match multiple ocurances of a pattern and replace it with a regex in transforms.conf. sample data [email protected] I am trying to match the pattern "-x" and replace it with "_". It works perfect for one match but for the rest of the matches in the event it doesnt. This is not a multiline event and the characters I wish to replace may appear multiple times even in a single word. Desired Result Kenan_ Muharemagic_ _ [email protected]_ _ (excuse the " " at _) I was able to do this earlier with the max_matches parameter during search time. This time I am trying to replace these characters before indexing, like when anonimyzing CC numbers or so... Is there a way to tell splunk to replace all matches of a pattern in transforms.conf?

kenchisho · ‎08-03-2012

well the number of working hours between the start_time and end_time for example i start working on a task at 09:00 AM on monday and finish at 13:00 PM on wednesday... i wish to count the number of working hours on the task...

kenchisho · ‎08-02-2012

I am trying to build a working hours report with splunk... I have a start date and an end date like so: start_time 2012-07-03 12:56:07 end_time 2012-07-14 16:30:22 calculating calendar hours is simple but how do i get working hours? any ideas?

kenchisho · ‎07-30-2012

Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search...

kenchisho · ‎07-30-2012

no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month...

kenchisho · ‎07-30-2012

Thanks for the quick reply... that comes close but not quite what I am looking for... example... the max(_time) of the events is 15.08.2011 the latest time of the search is 31.08.2011 i run this search on the 15.09.2011 i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working...

kenchisho · ‎07-30-2012

Hi guys, I have a question for You, if anyone has had a similar requirement... I need to use the "latest" time of a search, what ever it may be, as a field value to get the day diff between a certain datetime field in the data from the latest time of the search... is this possible?

kenchisho · ‎04-17-2012

I just tried using this and works pretty good. Is it possible to apply the css to a certain field insted of the row?

kenchisho · ‎04-12-2012

Hi jbsplunk, thanks for the quick reply. I have tried seting the charset manualy but splunk still garbles up the data when indexing. I have tried pretty much all the charsets available with splunk. Usualy with this type of data i use CP1250 and all goes well but with this set of data it is a no go with any charset config... I have tried this with a linux install of splunk, thinking it might be an OSX related issue, and get the same results... I am geusing this might be a bug but am not quite sure yet...

kenchisho · ‎04-12-2012

Hi guys, I have installed Splunk 4.3 on a MAC OSX 10.7. I am trying to index data with non utf encoding. I have tried pretty much every encoding available with splunk without any luck... the non unicode characters get replaced with some other symbols. Example in my log files i have "DAVOR ĆORIĆ" and it gets indexed as "DAVOR žORIž" or some other symnbol depending on which charset i use with this sourcetype... I never get the correct data indexed... Has anyone had similar problem... and possibly a simple solution?

kenchisho · ‎03-28-2012

Hi guys, I am trying to use the ValueSetter module to populate default values to a multi-select Pulldown module... the purpose is to provide the users with a simple option to hide fields from certain tables with a lot of columns... the code sample is shown bellow <module name="ValueSetter" > <param name="delim">,</param> <param name="name">field_filter</param> <param name="value ">Field1,Field2,Field3,Field4,Field5</param> <module name="Pulldown"> <param name="size">2</param> <param name="separator">+</param> <param name="searchFieldsToDisplay"> <list> <param name="value">field_filter</param> <param name="label">field_filter</param> </list> </param> <param name="name">field_filter</param> <param name="label">Hidden Fields</param> </module> </module> I have a search with a "| fields - $field_filter$" at the end When i save the view with the above ValueSetter module it breaks the view and splunk cannot find/display it... any ideas... or maybe a better way of getting this done?

kenchisho · ‎02-14-2012

the schedule is set to run at midnight on the first day of every month... 0 0 1 * *

kenchisho · ‎02-14-2012

Hi... here is the complete command... ./splunk cmd python fill_summary_index.py -app noc -index firewall_summary -name fw_web_monthly_top_domain -et -1mon@mon -lt @mon -j 8 -owner admin -showprogress true -auth admin:changeme

kenchisho · ‎02-13-2012

Hi guys, I am trying to backfill data into a summary index... when i run the command using the py script i get an error saying: *** For saved search 'fw_web_monthly_top_domains' *** No scheduled times for your time range. I have turned off the schedule for this search and tried playing around with the et and lt values with no effect... any ideas?

kenchisho · ‎02-03-2012

thnx. i'we seen the guide but this will not work in this case... the examples in the guide match a regex and then based on that match set the source type manually... [some_stanza] REGEX = some_regex FORMAT = sourcetype::my_log (manually set source type to my_log) DEST_KEY = MetaData:Sourcetype This would require a stanza in props.conf for every source type i wish to have for a single scripted input source... what i am trying is to extract the source type itself using a regex and route those events to that source type...

kenchisho · ‎02-03-2012

Hi guys... I have a couple of script inputs that generate network status data... the issue is that a single script inputs data for multiple sourcetypes... The data itself has a filed sourcetype=$value$ is there a simple way to override the default sourcetype "exec" like for host override: [sourcetype-override] REGEX = (?i)sourcetype=(\w+) FORMAT = sourcetype::$1 DEST_KEY = MetaData:SourceType

kenchisho · ‎07-19-2011

The setup above works perfectly... It kicked in after splunk was restarted a few times...

kenchisho · ‎07-19-2011

Yes they exist... this is now working... for some reason the config kicked in after i restarted splunk a few times... wierd

kenchisho · ‎07-19-2011

Assuming your earliest timeis a relative earliest easiest would be to say something like earliest=-2h latest=-1h That would grab events from 2 hours ago to 1 hour ago. hope that helps

kenchisho · ‎07-19-2011

Hi guys. I am having some trouble routing data from one source to different indexes. Here is my setup inputs.conf [monitor://C:\Program Files\Splunk\etc\apps\idsplunk\logs\test.log] disabled = false followTail = 0 index = main sourcetype = test transforms.conf [reroute_index_1] REGEX = 192.168.210.10 DEST_KEY = _MetaData:Index FORMAT = testindex1 [reroute_index_2] REGEX = 192.168.200.10 DEST_KEY = _MetaData:Index FORMAT = testindex2 props.conf [test] TRANSFORMS-index1=reroute_index_1 TRANSFORMS-index2=reroute_index_2 At the moment I am testing this out so there are only 2 indexes... In production there should be 20+ indexes where all the data is coming in from one source (syslogNG). With this setup my data does not get indexed at all... what am I missing?

kenchisho · ‎06-28-2011

I have this set up and working fine... I have the panels within the tabs arranged identically when using columns... You have another option, to use the _grpx param instead of the colx... that way the panels do not have to be identical across tabs... you can have 2 charts/tables on row1 in one tab and 1 or 3 on the other tab working nicely... I still have some issues with panel titles but found i could use generic titles to describe all the modules within the panels... Requires some playing around but works great

kenchisho · ‎06-01-2011

Thank you also for the quick answer... i can't just use index and sourcetype because i run postprocess searches on the results and i get nothing unless i specify the fields=*... using the NOT != is a bit messy... i resolved my issue by using eval to write "NULL" into the empty fields. Again thanks for the help.

Posts	33
Solutions	1
Karma Given	1
Karma Received	6
Member Since	‎02-18-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Using DBQuery to update DB table data

DB Connect: Why am I getting an error trying to ad...

Regex - match all ocurances of a character

How to calculate working hours between start and e...

Latest time as a field value

Charset Encoding

Pulldown default selection using ValueSetter

Summary Index Backfill

Sourcetype Override

Distribute data from one source to different index...

Using DBQuery to update DB table data

DB Connect: Why am I getting an error trying to ad...

Re: Regex - match all ocurances of a character

Regex - match all ocurances of a character

Re: How to calculate working hours between start a...

How to calculate working hours between start and e...

Re: Latest time as a field value

Re: Latest time as a field value

Re: Latest time as a field value

Latest time as a field value

Re: Customised Data Overlays

Re: Charset Encoding

Charset Encoding

Pulldown default selection using ValueSetter

Re: Summary Index Backfill

Re: Summary Index Backfill

Summary Index Backfill

Re: Sourcetype Override

Sourcetype Override

Re: Distribute data from one source to different i...

Re: Distribute data from one source to different i...

Re: Latest + add 1 hour

Distribute data from one source to different index...

Re: use multi-panel in the TabSwitcher ?

Re: splunk search language

Join the Conversation