About eduardo1989

eduardo1989 · ‎05-05-2022

Hello All, I have faced interesting issue. I have an ingest time extraction. [extract] REGEX = ^([^\r\n]+)$ FORMAT = message::$1 DEST_KEY = _raw Truncation not the case, I set it to zero and the whole event is not longer than 5000 characters BUT the message field is truncated exactly after 4023 characters. Where it is written that an extracted field cannot be longer than this amount of characters. Thanks.

eduardo1989 · ‎11-18-2021

Yeah I found out it was a MetaData problem. I checked the SourceTypes.data file in the actual db folder and my sourcetype was not prefixed with sourcetype:: and after I changed it fixed my problem. So somehow the data was incorrectly handled. Thanks for the help!

eduardo1989 · ‎11-17-2021

Nothing else showed the results. Only the one I mentioned.

eduardo1989 · ‎11-16-2021

I do not think so unfortunately, index=win host=MYHOST sourcetype=* This query gives me the results. Your second query regarding the characters gives me perfect results, there is no space or anything else. Moreover I checked with eval st=_sourcetype and it was perfectly fine.

eduardo1989 · ‎11-16-2021

Yes exactly, the field is there and the sourcetype is also but when I query it gives no results

eduardo1989 · ‎11-16-2021

It is shown and if I drilldown the query is formatted the same as for the another sourcetype which is shown correctly with the same query.

eduardo1989 · ‎11-16-2021

I have faced a very interesting situation and have no clue what is going wrong. I have a forwarded info from a particular host and if use a search like this I have all results. index=win host=MYHOST If I use this search it gives no results. index=win host=MYHOST sourcetype=mysourcetype BUT in realtime search it gives me the results! The setup on the host looks like this for mysourcetype. [mylogsource] disabled = 0 index = win sourcetype = mysourcetype

eduardo1989 · ‎04-29-2020

Dear All, I faced the following issue. I was using AWS add-on (5.0.0) to collect Generic S3 input from AWS but as soon as I start the collection the python script consume all memory and CPU of the host. More interesting thing is that if I use the older version(4.6.1) the issue does not come up. Thank you, Eduardo

eduardo1989 · ‎11-07-2019

Thank you very much for the fast response!

eduardo1989 · ‎11-07-2019

Dear All, I am facing the following issue on a Splunk 8.0 with WebSite Monitoring app: 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': Traceback (most recent call last): 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py", line 5, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': from website_monitoring_app.search_command import SearchCommand 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/etc/apps/website_monitoring/bin/website_monitoring_app/search_command.py", line 45, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': from splunk.appserver.mrsparkle.lib.util import make_splunkhome_path 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/util.py", line 22, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': import cherrypy 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/lib/python2.7/site-packages/cherrypy/init.py", line 73, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': from ._cptools import default_toolbox as tools, Tool 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/lib/python2.7/site-packages/cherrypy/_cptools.py", line 33, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': from cherrypy.lib import auth_basic, auth_digest 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': File "/opt/splunk/lib/python2.7/site-packages/cherrypy/lib/auth_digest.py", line 27, in 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': from six.moves.urllib.request import parse_http_list, parse_keqv_list 11-07-2019 12:09:51.967 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python2.7 /opt/splunk/etc/apps/website_monitoring/bin/web_ping_search_command.py url=https://google.com': ImportError: cannot import name parse_http_list 11-07-2019 12:09:51.975 ERROR script - sid:1573150191.65 External search command 'webping' returned error code 1. . On the other hand when I wanted to create a new input it says: Encountered the following error while trying to save: global name 'splunk' is not defined Thank you,

eduardo1989 · ‎11-04-2019

The Java task server was not started because the Java installation was not appropriate, then the precheck was hanging a bit. After the JAVA reinstall it was working. But I found out that the DB connect app use the older version of Python so in the future it will have more problems if the developer(s) not fixing it. BR

eduardo1989 · ‎10-25-2019

It was a Windows installation, but I found out it was a setup issue. Thank you for the quick response by the way!

eduardo1989 · ‎10-25-2019

Dear All, Splunk DB Connect is not working under the new release of Splunk. The app is constantly loading and nothing happens. DB Connect version is 3.2.0. See the screenshot below.

Posts	13
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎10-25-2019

Online Status	Offline
Date Last Visited	‎05-05-2022 04:34 PM

Field truncation at index time

Interesting behaviour

Splunk AWS Add-on consuming all memory and CPU

Splunk 8.0 Website Monitoring python fail

Splunk DB Connect not working with Splunk 8.0.0

Field truncation at index time

Re: Interesting behaviour

Re: Interesting behaviour

Re: Interesting behaviour

Re: Interesting behaviour

Re: Interesting behaviour

Interesting behaviour

Splunk AWS Add-on consuming all memory and CPU

Re: Splunk 8.0 Website Monitoring python fail

Splunk 8.0 Website Monitoring python fail

Re: Splunk DB Connect not working with Splunk 8.0....

Re: Splunk DB Connect not working with Splunk 8.0....

Splunk DB Connect not working with Splunk 8.0.0