Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sunnyparmar
sunnyparmar
Communicator
Member since:
03-17-2015
06-05-2020
Community Statistics
| Posts | 188 |
| Solutions | 0 |
| Karma Given | 47 |
| Karma Received | 5 |
| Member Since | 03-17-2015 |
Activity Feed
- Karma Re: Need to shorten data and show it by count for andrey2007. 06-05-2020 12:49 AM
- Karma Re: How to enable deployment server functionality on a universal forwarder? for muebel. 06-05-2020 12:48 AM
- Karma Re: Does splunk upload old logs on server for woodcock. 06-05-2020 12:48 AM
- Karma Re: Does splunk upload old logs on server for ddrillic. 06-05-2020 12:48 AM
- Karma Re: license help for gfreitas. 06-05-2020 12:48 AM
- Karma Re: How to use timechart with stats and eval command for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to search two different events by two different eventtypes? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to extract file tyes from .txt file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to extract file tyes from .txt file for gcato. 06-05-2020 12:47 AM
- Karma Re: Extract not giving the exact result for woodcock. 06-05-2020 12:47 AM
- Karma Re: Extract not giving the exact result for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to make multiple field extractions from my sample data? for woodcock. 06-05-2020 12:47 AM
- Karma Re: Why is a user unable to search data from a certain index, even with the permissions and role assigned for the proper app? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to make dashboard for the different events with the help of extraction for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How do I search the license usage by sourcetype for a particular app? for javiergn. 06-05-2020 12:47 AM
- Karma Re: How do I edit my search to find the difference between two fields? for renjith_nair. 06-05-2020 12:47 AM
- Karma Re: How do I edit my search to find the difference between two fields? for renjith_nair. 06-05-2020 12:47 AM
- Karma Re: how to find license usage by indexes for renjith_nair. 06-05-2020 12:47 AM
- Karma Re: convert query to display the results in GB for javiergn. 06-05-2020 12:47 AM
- Karma Re: DMC Alert - Critical System Physical Memory Usage for ddrillic. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
12-03-2018
04:28 AM
Hi @burwell,
Could you please help me out. Waiting for your help.
Thanks
Ankit
... View more
11-30-2018
07:59 AM
In case of OK acknowledgement -
2018-09-29 00:41:25,590 [AS2Servlet.java] [http-bio-8080-exec-358] [DEBUG] [eu.peppol.inbound.server.AS2Servlet] Served request, status=OK:
In case of ERROR acknowledgment -
2018-09-29 00:01:57,418 [InboundMessageReceiver.java] [http-bio-8080-exec-358] [ERROR] [eu.peppol.as2.InboundMessageReceiver] Unexpected error: Unable to persist XML document for PeppolMessageMetaData
... View more
11-30-2018
01:30 AM
In case of Negative acknowledgement getting these two errors in log for the same file -
841392-1538181685-12005_ehfd.jcloud.no.xml - Returned negative MDN ERROR: and Unable to persist XML document
For positive acknowledgment, logs generating -> status=ok
Thanks in advance..
... View more
11-29-2018
07:52 PM
Hi Guys,
I have multiple .xml files, around 1100 and all files have the status of either negative or positive in logs so I want to search all files on Splunk in a one go corresponding there status. Any insights would be appreciated.
Thanks in Advance
Ankit
... View more
10-21-2018
10:53 PM
I have one Excel sheet in which there are around 1150 bum IDs. One of example given below.
bum_id a62f1ede-e3c2-418a-8376-945d94288c56
Can anybody suggest to me how I can search all of those in one shot in Splunk? Any insights would be appreciated.
... View more
12-18-2017
03:40 AM
Could you please let me know how you made this possible by rex as I have tried also but didn't get succeed. Thank you so much
... View more
12-17-2017
11:33 PM
Hi All,
I am executing query which is giving me the below result and I want to shorten the data and show in table format by total no. of count count. So what I want in table from the below result that is "code=200", "method=GET" and "SENDID=OSUUSPANKKI". Any insight would be appreciable. Thanks in advance
2017-12-18 07:26:50,357 [bwReqId=] [play-akka.actor.default-dispatcher-68163] [INFO ] [application] front-play - time=3ms code=200 method=GET remote_ip=85.76.XX.XX host=XXX.basware.com uri=/invoices/attachment/8fc60422e0de11e792e8f398?VERSION=0001&PMTREFNB=f171abc1-eef1-4cb3-a537-54ae4d638a65&TIMESTMP=2017-12-18-092641%2B02&KEYVERS=0001&ALG=0001&LANGCODE=1&SESSIONID=dGpohCr1yQJe-iKenar-&STATUS=Prod&SENDID=OSUUSPANKKI&PMTORIG=1&USERMAC=4901FF5EC300D405133A757F7FA0245B&MAC=B82F0BEECA1B8680CFD9889A94248EC9
... View more
07-27-2016
01:25 AM
Hi,
how can I provide the screenshot of splunk data. I am not able to paste here any type of snapshot so could you please guide me for the same
Thanks
... View more
07-26-2016
09:11 AM
sourcetype definition is sc-kofax-ktm. you are asking about entry in props.conf on main Splunk server or on forwarder side? and yes you are right in log files date are not configured. logs format are given below -
08168 00:01:40 [Info] 00000001 #01 Loading batch '20160726_1900 - 02745216_04'.
08168 00:01:40 [Info] 00000002 #01 Loading project associated to batch.
08168 00:01:41 [Info] 00000003 #01 Verifying that sufficient licenses are available.
08168 00:01:41 [Info] 00000004 #01 Batch opened '20160726_1900 - 02745216_04'
08168 00:01:41 [Info] 00000005 #01 Batch class: "ExxonMobilNAStripes - Live"
08168 00:06:56 [Info] 00000006 #01 Start processing of 10 document(s).
08168 00:08:03 [Info] 00000007 #01 Processing results of document 1
08168 00:08:03 [Info] 00000008 #01 Form type "FT_Invoice3341" associated with class "CA"
08168 00:08:03 [Info] 00000009 #01 Document classified as "CA"
08168 00:08:03 [Info] 00000010 #01 Document extracted successfully, 174 field(s) found.
08168 00:08:08 [Info] 00000011 #01 Processing results of document 2
08168 00:08:09 [Info] 00000012 #01 Form type "FT_Invoice3341" associated with class "CA"
08168 00:08:09 [Info] 00000013 #01 Document classified as "CA"
08168 00:08:09 [Info] 00000014 #01 Document extracted successfully, 171 field(s) found.
08168 00:09:00 [Info] 00000015 #01 Processing results of document 3
08168 00:09:01 [Info] 00000016 #01 Form type "FT_Invoice3341" associated with class "CA"
08168 00:09:01 [Info] 00000017 #01 Document classified as "CA"
08168 00:09:01 [Info] 00000018 #01 Document extracted successfully, 173 field(s) found.
08168 00:10:10 [Info] 00000019 #01 Processing results of document 5
08168 00:10:11 [Info] 00000020 #01 Form type "FT_Invoice3341" associated with class "CA"
08168 00:10:11 [Info] 00000021 #01 Document classified as "CA"
08168 00:10:11 [Info] 00000022 #01 Document extracted successfully, 175 field(s) found.
... View more
07-26-2016
06:36 AM
Hi,
I am facing date related issue in my some of the splunk logs. Today is 26 July but it is showing timing something like given below -
7/28/16 22848 14:15:55 [Info] 00001332 #01 Batch opened '20160728_0500 - 02749648_11'
6:45:55.000 PM 22848 14:15:55 [Info] 00001333 #01 Batch class: "HammondCare - Live - Email"
I have checked inputs.conf and time zone of the server from where the logs coming and with this check the Splunk server time as well. All things are in correct format then why i am facing this issue? Any insight would be appreciated.
Thanks
... View more
07-05-2016
09:18 AM
Hi,
I have three pools in my production splunk and allocated different amount of license to each and every pool. Now suppose if one of my pool has crossed its allocated license limit (means license violation) then is it automatically start consuming license from other pool?
Thanks
... View more
06-23-2016
12:36 PM
thanks buddy..
... View more
06-23-2016
11:31 AM
thanks a lot for your answer..
... View more
06-23-2016
11:26 AM
Hi,
But in my default input.conf file the parameter you have mentioned is not included so what happened when next day i will start forwarder? Does it uploaded the logs of that time period during which it was stopped?
Thanks
Sunny
... View more
06-23-2016
10:27 AM
Hi,
I have a doubt about logs uploading data. Like I have installed Splunk forwarder on a server. In mid-night to avoid license violation if I stopped forwarder on the server and in next morning around 6 am once I will again restarted it so does forwarder send the logs for that time period as well during which it was stopped.
Thanks
Sunny
... View more
03-01-2016
04:27 AM
Hi,
Could anyone please tell me that what is needed on the universal forwarder side to enable deployment server functionality, and how can we configure new input with deployment server?
Thanks in Advance
... View more
02-14-2016
07:29 PM
Number of Cores - 4
Physical Memory Capacity (MB) - 7865
Operating System - Linux
CPU Architecture - x86_64
Main server is not an indexer. Indexer is on some other server i.e. on Windows OS and DMC is also on main server where Splunk is installed.
Thanks
... View more
02-14-2016
07:24 PM
thanks for replying.. I am using version 6.2.1
... View more
02-14-2016
06:54 PM
Thanks for the answer. it works but i have one more query related to the same. Currently it is showing me values in bytes for daily basis. If I have to convert it into GB's so how could I do that with the same query?
I am using parameter something like this but didn't give me the exact result-
| eval total_usage = round((total_usage/1024/1024/1024), 2) | sort -total_usage
... View more
02-14-2016
06:54 PM
Thanks for the help. it works but i have one more query related to the same. Currently it is showing me values in bytes for daily basis. If I have to convert it into GB's so how could I do that with the same query?
I am using parameter something like this but didn't give me the exact result-
| eval total_usage = round((total_usage/1024/1024/1024), 2) | sort -total_usage
Thanks
... View more
02-14-2016
05:15 AM
1 Karma
Hi,
My below given query for License usage logs showing me data but there is "NULL" column is also coming in that with some data so how to get rid of this NULL column? When I am clicking on NULL column to see the events it contains nothing. Any suggestions would be appreciated.
Query -
index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | timechart span=1d sum(b) as total_usage by baname
I have used already below given parameters but still null values are showing-
| stats values() as * by Id
| streamstats count as Id | stats values() as * by Id
Thanks.
... View more
Labels
- Labels:
-
license
02-14-2016
05:04 AM
Hi,
Currently i am running below query and it is showing me data in bytes. How do I convert in into GB's?
index=_internal source=*license_usage.log type=usage | lookup index_name indexname AS idx OUTPUT baname | chart sum(b) as total_usage by baname | sort -total_usage
Thanks in Advance
... View more
Labels
- Labels:
-
other
02-13-2016
11:38 PM
Hi,
I am getting physical memory usage alert from my main Splunk server for the server itself where it is installed and as I have figured out splunkd, mongod and python (all three processes of Splunk itself) consuming the highest memory on server so how to get rid of this? I have restarted Splunk services twice but didn't get the expected result so any advise would be appreciated.
Thanks
... View more
02-13-2016
11:26 PM
ok thanks J..
Regards
... View more
02-11-2016
01:57 AM
| stats count by mnd
or
| stats count by sum(mnd)
... View more
