Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lessthan80
lessthan80
Explorer
Member since:
01-31-2017
03-07-2023
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 01-31-2017 |
Activity Feed
- Got Karma for Re: timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format?. 03-07-2023 06:19 AM
- Posted Re: timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format? on Getting Data In. 03-07-2023 05:57 AM
- Karma Re: timestamp in _raw contains p.m. And I'm unable to configure props.conf to correctly interpret this format. for richgalloway. 03-07-2023 05:55 AM
- Karma Re: timestamp in _raw contains p.m. And I'm unable to configure props.conf to correctly interpret this format. for PickleRick. 03-07-2023 05:55 AM
- Posted timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format? on Getting Data In. 03-03-2023 12:50 PM
- Tagged timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format? on Getting Data In. 03-03-2023 12:50 PM
- Tagged timestamp in _raw contains p.m. -How to configure props.conf to correctly interpret this format? on Getting Data In. 03-03-2023 12:50 PM
- Got Karma for Re: Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old.. 08-30-2022 11:49 AM
- Posted Re: Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old. on All Apps and Add-ons. 08-30-2022 10:07 AM
- Posted Re: Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old. on All Apps and Add-ons. 08-30-2022 07:24 AM
- Posted Splunk Add-on for Microsoft Office 365 --Why can't I index files over 7 days old? on All Apps and Add-ons. 08-30-2022 06:12 AM
- Tagged Splunk Add-on for Microsoft Office 365 --Why can't I index files over 7 days old? on All Apps and Add-ons. 08-30-2022 06:12 AM
- Posted Re: How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-10-2018 07:37 AM
- Posted Re: How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 12:42 PM
- Posted How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
- Tagged How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
- Tagged How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
- Tagged How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
- Tagged How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
- Tagged How to present a readable time value when epoch value is on the y-axis in a scatter chart? on Splunk Search. 05-09-2018 11:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-07-2023
05:57 AM
1 Karma
I started reviewing both answers and they both appear to be correct. With this information i expect to be able the correct the eventtime problem. Thanks to both.
... View more
03-03-2023
12:50 PM
the output in splunk console: 3/3/23 2:05:41.000 AM 03/03/2023 02:05:41 p.m. 14664 5046661
Note that the splunk _time is pulling the timestamp from _raw, but not interpreting the "p.m." so splunk is posting the time of the event as 2:05 AM. I have have tried a few different combinations for the TIME_FORMAT in the props.conf file, and nothing is helping. here is the current TIME_FORMAT stanza
[###_###_###_#######] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 26 TIME_FORMAT = %d/%m/%Y %I:%M:%S TIME_PREFIX = ^ category = Custom disabled = false pulldown_type = true EXTRACT-total_processing_time = ^[^\t\n]*\t(?P<total_processing_time>\d+\t) EXTRACT-application_id = ^(?:[^\t\n]*\t){2}(?P<application_id>.+)
current TIME_FORMAT TIME_FORMAT = %d/%m/%Y %I:%M:%S I've tried this with %p and %P with no success. Any ideas?
... View more
Labels
- Labels:
-
props.conf
08-30-2022
10:07 AM
1 Karma
i had started looking at documentation for the API and found https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-service-communications-api-reference which states the historical is today - 7 thanks for guiding me to the correct location for the configuration. I will follow up with O365 support to see if this can or should be changed. calling this question answered
... View more
08-30-2022
07:24 AM
This specifc Add-on https://docs.splunk.com/Documentation/AddOns/released/MSO365/Configureinputs# states The retention period for historical data is 7 days. We had an authentication failure that was not corrected for about 3 weeks; and once corrected these logs did not index anything older than 7 days. I searched the .conf files for any configuration that might have limited the lookback time and did not find any. I'm hoping there is a configuration in this add-on that can be adjusted to pick up these older than 7 days logs. thanks for your input.
... View more
08-30-2022
06:12 AM
Splunk Add-on for Microsoft Office 365 -- I'm unable to index files over 7 days old.
Where can this configuration be changed in the Add-on?
Splunk Add-on for Microsoft Office 365 Version: 2.0.2 Build: 1
Splunk Version:8.1.5
... View more
Labels
- Labels:
-
administration
-
configuration
05-10-2018
07:37 AM
Since the line chart does provide a good time stamp and somewhat recognizable as an anomolie, I will present a single dashboard with both line and scatter charts of the same data. If something looks out of place, the charts are using the same color for each job, so it's relatively easy to move between them and determine which event needs attention.
Thanks for your help
... View more
05-09-2018
12:42 PM
I stared at both column and bar charts for several hours, but could not make sense of that type of representation of individual file size values each time a specific job ran. To make either of those useful would require a separate chart for each job, when a single scatter chart provides an understandable view of all the jobs, quickly illustrating the anomolies for each job.
Let's go at it at another angle. Each square value in the scatter chart produces a pop-up as you hover over them. This pop-up includes specific variable values -- How do I include a good timestamp variable inside that pop-up?
... View more
05-09-2018
11:07 AM
My goal is to present a scatter chart with the size of a file each time a job runs. This requires 3 values: time, size of file, name of job. I have reviewed much of the documentation about time and timecharts and the best representation I have is with time on the y-axis, size of file on the x-axis and the name of job as the legend. the problem is the time value is in epoch and I have been unable to relate a readable time to this chart.
Search saved as a scatter chart
index=main
sourcetype="MFT_byte_size_data"
| table MFT_job_name, MFT_fromFileBytes, timestamp, _time
Saved as a scatter chart
Data csv file
MFT_job_name MFT_fromFileBytes timestamp _time
xxxxxxxx - CAD xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 370 1525659756 2018-05-06T21:22:36.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 50940 1525486960 2018-05-04T21:22:40.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 35580 1525400533 2018-05-03T21:22:13.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 45060 1525314133 2018-05-02T21:22:13.000-0500
xxxxxxxx - CAD xxxxxxxx UL Sun-Fri 40860 1525227747 2018-05-01T21:22:27.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4049 1525719615 2018-05-07T14:00:15.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 353 1525633211 2018-05-06T14:00:11.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 15473 1525546814 2018-05-05T14:00:14.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20737 1525460420 2018-05-04T14:00:20.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 20121 1525374057 2018-05-03T14:00:57.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 22473 1525287653 2018-05-02T14:00:53.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 26897 1525201201 2018-05-01T14:00:01.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 2PM New 4217 1525114867 2018-04-30T14:01:07.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3769 1525478474 2018-05-04T19:01:14.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 3993 1525392038 2018-05-03T19:00:38.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4441 1525305625 2018-05-02T19:00:25.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 4889 1525219222 2018-05-01T19:00:22.000-0500
xxxxxxxx - CAN-xxxxxxxx UL 7PM Sun-Fri 5561 1525132818 2018-04-30T19:00:18.000-0500
xxxxxxxx - CAN-xxxxxxxx UL new path on FIS side Sat only 15473 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - US xxxxxxxx UL Sat only 130 1525558529 2018-05-05T17:15:29.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10288060 1525659756 2018-05-06T21:22:36.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 14757070 1525486960 2018-05-04T21:22:40.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10684390 1525400533 2018-05-03T21:22:13.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 10858010 1525314133 2018-05-02T21:22:13.000-0500
xxxxxxxx - US xxxxxxxx UL Sun-Fri 13944050 1525227747 2018-05-01T21:22:27.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 584438 1525719615 2018-05-07T14:00:15.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525633211 2018-05-06T14:00:11.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 72 1525546814 2018-05-05T14:00:14.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 411325 1525460420 2018-05-04T14:00:20.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 346750 1525374057 2018-05-03T14:00:57.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 348905 1525287653 2018-05-02T14:00:53.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 388810 1525201201 2018-05-01T14:00:01.000-0500
xxxxxxxx - US-xxxxxxxx UL 2PM New 545209 1525114867 2018-04-30T14:01:07.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 72 1525651216 2018-05-06T19:00:16.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 253468 1525478474 2018-05-04T19:01:14.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 234053 1525392038 2018-05-03T19:00:38.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 203982 1525305625 2018-05-02T19:00:25.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 250691 1525219222 2018-05-01T19:00:22.000-0500
xxxxxxxx - US-xxxxxxxx UL 7PM Sun-Fri 188952 1525132818 2018-04-30T19:00:18.000-0500
xxxxxxxx - US-xxxxxxxx UL new path on FIS side Sat only 72 1525558529 2018-05-05T17:15:29.000-0500
Below is a good presentation of how I want the data to look, but the timestamp values mean nothing a human.
... View more
01-31-2017
07:08 AM
I've recently installed splunk 6.5.1 on windows 2008 R2. I've also enabled 'Health Check' in Monitoring Console, but any Health Check search that includes something like "| rest $rest_scope$ /services/server/info " fails with -- Error in 'rest' command: Invalid argument: '/services/server/info' --
I am unable to locate any directory called /services. Where can I get this configured?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-07-2023
04:01 PM
|
