Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About arjangoos
arjangoos
Path Finder
Member since:
09-23-2011
12-03-2020
Community Statistics
| Posts | 25 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 09-23-2011 |
Activity Feed
- Posted splunk alert every hour with all hits for the search result on Alerting. 12-03-2020 02:00 AM
- Karma Re: How edit props.conf to replace characters in a log? for sundareshr. 06-05-2020 12:48 AM
- Posted append search to different sources on Splunk Search. 02-08-2017 05:45 AM
- Tagged append search to different sources on Splunk Search. 02-08-2017 05:45 AM
- Posted Location Tracker - Custom Visualization: How to disable drilldown? on All Apps and Add-ons. 02-06-2017 06:37 AM
- Tagged Location Tracker - Custom Visualization: How to disable drilldown? on All Apps and Add-ons. 02-06-2017 06:37 AM
- Tagged Location Tracker - Custom Visualization: How to disable drilldown? on All Apps and Add-ons. 02-06-2017 06:37 AM
- Posted How edit props.conf to replace characters in a log? on Splunk Search. 12-05-2016 07:35 AM
- Tagged How edit props.conf to replace characters in a log? on Splunk Search. 12-05-2016 07:35 AM
- Tagged How edit props.conf to replace characters in a log? on Splunk Search. 12-05-2016 07:35 AM
- Tagged How edit props.conf to replace characters in a log? on Splunk Search. 12-05-2016 07:35 AM
- Posted How to generate a search that will combine two events with different fields that contain the same value and calculate response time? on Splunk Search. 11-02-2016 08:40 AM
- Tagged How to generate a search that will combine two events with different fields that contain the same value and calculate response time? on Splunk Search. 11-02-2016 08:40 AM
- Tagged How to generate a search that will combine two events with different fields that contain the same value and calculate response time? on Splunk Search. 11-02-2016 08:40 AM
- Tagged How to generate a search that will combine two events with different fields that contain the same value and calculate response time? on Splunk Search. 11-02-2016 08:40 AM
- Posted How to search the license usage per index per department? on Splunk Search. 10-27-2016 04:38 AM
- Tagged How to search the license usage per index per department? on Splunk Search. 10-27-2016 04:38 AM
- Tagged How to search the license usage per index per department? on Splunk Search. 10-27-2016 04:38 AM
- Tagged How to search the license usage per index per department? on Splunk Search. 10-27-2016 04:38 AM
- Posted Re: Splunk Add-on for Squid Proxy: Why do I get a 404 error on /splunk/en-US/app/Splunk_TA_squid/setup ? on All Apps and Add-ons. 06-14-2016 04:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-03-2020
02:00 AM
we want 1 alert if something happens more than 1 time in that hour. But if it happens multiple times we want to see all those events also in the email. And we only want 1 alert in an hour. alter type: real time expires: 24 hours Trigger alert when: number of results is greater than 0 in 1 hours Trigger: Once Trottle: yes Supress triggering for: 1 hours
... View more
Labels
- Labels:
-
alert action
-
alert condition
02-08-2017
05:45 AM
Hi,
I want to combine to searches:
index=bla | stats count(al_responsecode) as "Total per responseCode al" by al_responsecode | appendcols [ search index=blaat2 sourcetype=access_log | stats count(responseCode) as "Total per responseCode" by responseCode] | table al_responsecode responseCode "Total per responseCode al" "Total per responseCode"
1e search:
response code; total
200;122
204;16
302;13
304;23
401;19
404;44
505;1
2e search:
200;113
204;9
304;23
401;19
404;4
outcome:
200;122;113
204;16;9
302;13;23
304;23;19
401;19;4
404;44
505;1
But I want:
200;122;113
204;16;9
302;13;0
304;23;23
401;19;19
404;44;4
505;1;0
... View more
02-06-2017
06:37 AM
We use the Location Tracker - Custom Visualization app and we want to disable the drilldown. How can we do this?
... View more
12-05-2016
07:35 AM
Log:
Dec 5 15:25:48 host : app='smtp', name='Email Status', policy_name='', dvc_host='', virtual_host='host', event_id=8888, reason_id=11, direction=2, src_ip='xx.xx.xx.xxx', src_host='', dest_ip='xx.xx.xx.xx', dest_host='', rhdr_ip='', is_primary_action=, scanner='', action='', status='Email Delivered', sender=<x.aaaaa@boa.bla.nl>, recipient='<ff.aa@aaa.com>', msgid='jkjkjkkljdfijijiji', orig_msgid='', nrcpts=1, relay='', subject='subject blaat hoe is het', size=34343, attachments='', number_attachments=0, virus_name='', file_name='', spamscore=, spamthreshold=, spamrules='', URL='', contentrule='[]', content_terms='[]', tz='CET', tz_offset='+0100', dlpfile='', dlprules='', dlpclassification='', dlpfileuploaded='', dlpfiledigest='', dlpfilesize='', url_filter_categorization='', ts_reputation_score=, ts_geo_location='', ts_ip_rep_status=, ts_hash_length=, ts_lookup_hash=''
Now we want the sender without <> and the recipient without '<>' . I think we have to do this in the props.conf with a regex but how?? Can someone help us?
... View more
11-02-2016
08:40 AM
I want to combine two events based on different fields (ID and PARENT_ID) that have the same value and then find the difference of CREATION_TIMESTAMP of event1 and the CREATION_TIMESTAMP of event2, in order to calculate the response time.
event 1
ID =1, PARENT_ID=NULL, CREATION_TIMESTAMP=1478097923354
event 2
ID=2, PARENT_ID=1, CREATION_TIMESTAMP=1478097924800
... View more
10-27-2016
04:38 AM
I want the license usages per index per department.
department 1 has indexes:
idx volume
acc_jboss 100
prod_jboss 150
test_jboss 50
department 1 volume is 300
department 2 has indexes
idx volume
prod_network 1000
acc_network 509
test_network 100
department 2 volume is 1609
... View more
06-14-2016
04:40 AM
Ok I understand but is there an app where I can see the results of the squid logs?
... View more
06-10-2016
08:23 AM
Hi,
I installed the Splunk Add-on for Squid Proxy on a search head and when I try to start the app, I get a 404 error on /splunk/en-US/app/Splunk_TA_squid/setup.
Kind regards,
Arjan Goos
... View more
10-30-2015
01:35 AM
this is my inputs.conf
[mi_input://opentunnel_acc_metrics]
connection = opentunnel_acc
index = acc_opentunnel_db
interval = 150
max_rows = 10
mode = tail
output_timestamp_format = epoch
query = SELECT * FROM "OPENTUNNEL_RUNTIME"."METRICS"
source = /opt/splunk/var/log/splunk/acc_opentunnel_db.log
sourcetype = acc_opentunnel_db
tail_follow_only = 1
tail_rising_column_name = TUNNEL_ENTRY_TS
tail_rising_column_number = 1
ui_query_catalog = NULL
ui_query_mode = advanced
ui_query_schema = OPENTUNNEL_RUNTIME
ui_query_table = METRICS
tail_rising_column_checkpoint_value = 1443682436344
input_timestamp_column_name = TUNNEL_ENTRY_TS
input_timestamp_column_number = 17
... View more
10-29-2015
07:13 AM
In DB Connect, I only want to collect the new rows since the last update. Now each time it collects the last 1000 records because that is the Max Rows to Retrieve.
... View more
- Tags:
- Splunk DB Connect
07-29-2015
02:19 AM
I have installed the S.o.S - Splunk on Splunk app. I want only the admin user to have access (view) to this app. I set the permissions on this app to Read/Write admin only. But when I login with another user, I still can start the S.O.S application. This should not be possible.
Thanks,
Arjan
... View more
07-23-2015
02:31 AM
this is not working, the data gets sent to one target-group but not to the two groups at the same time.
... View more
07-22-2015
01:03 AM
Hi,
I want to send my log files to two different Splunk instances, but the data is only only being sent to one of the two environments.
outputs.conf:
[tcpout]
defaultGroup=noredirect
disabled = false
maxQueueSize = 500KB
[tcpout:twd104]
server = 10.9.3.35:9997
[tcpout:splunk_prod]
server = splunk-indexer01.rotterdam.local:9997,splunk-indexer02.rotterdam.local:9997
inputs.conf:
[monitor:///var/log/mule/.../*]
_TCP_ROUTING=splunk_prod
disabled = false
followTail = 0
sourcetype = log4j
index = acc_abkr
[monitor:///var/log/mule/.../*]
_TCP_ROUTING=twd104
disabled = false
followTail = 0
sourcetype = log4j
The data is only send to splunk_prod.
Why is this not working?
... View more
07-21-2015
02:30 AM
Is it possible to nest serverclasses?
[serverClass:UF_acc]
whitelist.0=host3
whitelist.1=host4
[serverClass:UF_all]
whitelist.0=host1
whitelist.1=host2
whitelist.2=UF_acc
so I want to add the class UF_acc to the class UF_all.
... View more
- Tags:
- serverclass.conf
05-12-2015
08:37 AM
Hi,
I made this search:
tag::host="jboss_prod" source="/usr/share/jbossas/domain/log/servers/sso/saml*" loglevel=ERROR earliest=-5d@d latest=now |join _time [search tag::host="jboss_prod" source="/usr/share/jbossas/domain/log/servers/sso/access*" earliest=-5d@d latest=now]
But no results, am I doing something wrong?
... View more
05-12-2015
07:31 AM
Ok but how can I do that?
... View more
05-12-2015
06:49 AM
We have an access_log file with an 500 error and want to relate this to the application log of the application:
access_log:
84.86.179.166 - - 16 0.016 [12/May/2015:15:27:01 +0200] GET /wmo/wicket/bookmarkable/nl.rotterdam.ioo.wmo.web.wizard.pages.OverzichtPage?18 HTTP/1.1" 500 3961 Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko ZrD6VR3+lj9yqADqNbE3RFxE"
application_log:
ERROR | [http-jboss-local/10.9.8.162:8430-14] | 2015-05-12 15:27:01,160 | org.apache.wicket.DefaultExceptionMapper.java | Unexpected error occurred
java.lang.NullPointerException
How can we relate these two files/lines together?
... View more
02-11-2015
01:29 AM
Hi MuS:
/opt/splunkforwarder/etc/system/default/inputs.conf [tcp]
/opt/splunkforwarder/etc/system/default/inputs.conf _rcvbuf = 1572864
/opt/splunkforwarder/etc/system/default/inputs.conf acceptFrom = *
/opt/splunkforwarder/etc/system/default/inputs.conf connection_host = dns
/opt/splunkforwarder/etc/system/local/inputs.conf host = vaaasu4054.vld04.local
/opt/splunkforwarder/etc/system/default/inputs.conf index = default
/opt/splunkforwarder/etc/apps/meos_forwarders/local/inputs.conf [tcp://8088]
/opt/splunkforwarder/etc/system/default/inputs.conf _rcvbuf = 1572864
/opt/splunkforwarder/etc/system/local/inputs.conf host = vaaasu4054.vld04.local
/opt/splunkforwarder/etc/system/default/inputs.conf index = default
/opt/splunkforwarder/etc/apps/meos_forwarders/local/inputs.conf persistentQueueSize = 2GB
/opt/splunkforwarder/etc/apps/meos_forwarders/local/inputs.conf queueSize = 500KB
When I send data to the UF on port 8088 with an curl command it stops processing. But the persistentQueue is not growing. Why not?
... View more
02-10-2015
11:34 PM
We have an application that sends it's data to the UF on tcp port 8088. When the indexers are down we want the UF to store the log data in a persistentQueue untill the indexers are online again. Is this possible?
in the inputs.conf we have this stanza:
[tcp://8088]
persistentQueueSize=2GB
But this is not working. Can anyone help me?
,We have an application that offers it's logging to the UF API on tcp://8088 and we want to use a persistentQueue to store data when the indexers would be down. Is this possible? What we did is create een app with inputs.conf:
[tcp://8088]
persistentQueueSize=2GB
But this is not working we expected.
Can someone help us?
... View more
- Tags:
- persistent-queue
- uf
10-22-2012
02:15 AM
At this time it is not possible to change the log4j format. So I think I need to use the interactive Field Extrator. But I am not able to get the result I want.
ERROR rss.AbstractPostcodeBasedFeedPanel -
What is the regex to get the text between ERROR and -.
Kind regards,
Arjan
... View more
10-19-2012
05:54 AM
Hi,
I want to make a timechart of the different errors in my application. To do this I need a fieldextractions.
the log4j format is like this:
10-19@09:25:45 ERROR rss.AbstractPostcodeBasedFeedPanel - Failed to load feeds from: [http://10.9.1.192/Cms.Backend/wscmsrssservice.asmx/GetBekendmakingenByPostcode?pPostcode=3071AS]
nl.rotterdam.ioo.mijnloket.homepage.util.rss.UnableToCreateSyndFeedListException: java.net.SocketTimeoutException: Read timed out
So I want the time (10-19@09:25:45) | type of message (ERROR) | the text between ERROR and - | and the text between : and : | and the text between : and :
How can I do that. The field extraction for time and type of messages is simple but can you help me with the other extractions
Kind regards
... View more
- Tags:
- extract
07-23-2012
10:40 PM
Ok thanks for your reply. But it is not an answer to my question. So if anyone knows how I can solve my problem.
... View more
07-20-2012
01:33 AM
I want to create a timechart line graph based on: total kb per source over time. Now I have:
index="_internal" source="*metrics.log" per_source_thruput access_log | bin _time span=1d as day | timechart sum(kb) as totalKB | streamstats sum(totalKB)
This search works but only for access_log, I want to see all sources in one graph
time size result
on 0:00 100kb 100kb
on 1:00 50kb 150kb
on 1:30 27kb 177kb
... View more
- Tags:
- license-violation
10-19-2011
03:33 AM
We found out that the app was developed by McAfee.
... View more
10-14-2011
12:38 AM
Hi,
We upgraded from splunk 4.1.7 to 4.2.3. After the upgrade the application McAfee Email and Web Security Reporter (McAfeeEWSReporter) is not working anymore. I want to know if there is a new version of this app. But I can't find the app anywhere on splunk.com.
The errors I got are:
Unable to find an eventtype web-traffic
Unable to get viewstate information; formatting may not be correct
The lookup table 'reason_id' does not exist. It is referenced by configuration 'syslog'.
The lookup table 'scanner' does not exist. It is referenced by configuration 'syslog'.
Regards,
Arjan Goos
... View more
- Tags:
- apps
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-03-2020
07:56 PM
|
