About sourabhguha

sourabhguha · ‎10-30-2013

Hi Ayn, did the above information help with understanding the root cause of the issue?

sourabhguha · ‎10-28-2013

here are details that you requested. Following are the sourcetypes in my system. i have highlighted the one corresponding to my input. Splunk has identified there are 196 files for that sourcetype. See this image - http://sdrv.ms/1iosB8H However, when i try to search for it, in the data summary - i do not see any events from that sourcetype. see image here - http://sdrv.ms/1iosMRf here is the sample log file that i am indexing into splunk - http://sdrv.ms/1g6yDht thanks.

sourabhguha · ‎10-27-2013

Hi, I have the following events in my log files. These are tab delimited fields. The files are not getting indexed by Splunk. 78a581fb-c193-45b0-86c5-2736777c7b58 60ef9efb-496f-1050-34bb-a9a1c782a7ba All Hosts 10.0 \N \N \N \N \N 2.2 \N \N 31.996002197265625 15.100006103515625 16.89599609375 52.80658499015208 15.998001098632812 3.590625 1.122210511757889 16.89599609375 2013-10-23 00:00:00 2013-10-23 00:59:59 a3532c01-3b5e-4dd1-9508-b2153f98b4f0 a854ba84-57fb-0bc6-e241-00a050dab35a Marc's Servers 3.0 \N \N \N \N \N 1.3333333333333333 \N \N 7.9211578369140625 3.3072255452473955 4.613932291666667 58.24820546012715 7.9211578369140625 0.6666666666666666 0.2524883408685066 4.613932291666667 2013-10-23 00:00:00 2013-10-23 00:59:59 a8ea7c79-50f5-4851-947a-3dcdbfab1cf5 d5a74d0c-c896-42e8-70f8-beedc69105f6 All Hosts 150.0 100.0 75.0 25.0 25.0 4.0 4.0 6.0 150.0 399.9500274658203 -0.05028128147136357 400.0003087472916 100.01257189099096 15.998001098632812 4.0 1.500187420417857 400.0003087472916 2013-10-23 00:00:00 2013-10-23 00:59:59 Would you know why that would be the case. I tried indexing iis log files and they are working fine as expected. PLease let me know, if you would any additional information for troubleshooting. Thanks,

sourabhguha · ‎10-27-2013

btw, here's what i am doing to update the configs. i am updating the files in the following location. C:\Program Files\Splunk\etc\system\local then going to splunk UI and restarting the server.

sourabhguha · ‎10-27-2013

Hi, I tried the above updates. But am still having the same issue. Is there any additional information that I can send.

sourabhguha · ‎10-27-2013

Hi, Following is my input. It is a set of tab delimited files. Here is a sample. I made updates to props.conf and transforms.conf. I have included the sections for it below. When I go to the Search app - no data showing up in the data summary. I get a message saying "Waiting for data" 30cb85e3-a3e5-46f9-89e6-3fc0ff9ea70c 3bf80a12-74f8-d104-1d0d-7a05bd517eb4 San Jose \N 4.0 \N \N \N 4.0 \N \N \N 7.999561309814453 1.57784907023112 6.421712239583333 80.2758050207666 7.999561309814453 \N \N \N 2013-10-26 00:00:00 2013-10-26 00:59:59 I did local updates to props.conf and transforms.conf. here are the updates to it. PROPS.CONF [ComputeUtilization2] NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %M-%D-%Y %H:%M:%S TIME_PREFIX = ^([^\t]*\t){20} pulldown_type = 1 REPORT = getcsvfields TRANSFORMS.CONF [getcsvfields] DELIMS = "\t" FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG,AvgTotalCoresPerHost,vCoresPerVMForHG,vCoreTopCoreRatio,FreevCoresForHG,TotalpMemInGBForHG,UsedpMemInGBForHG,FreepMemInGBForHG,MemAvailabilityPercentForHG,AvgTotalMemoryPerHost,vMemPerVMForHG,vMemTopMemRatio,FreevMemForHG,BucketStartTime,BucketEndTime

sourabhguha · ‎10-26-2013

Hi, I am indexing a set of csv files. the files do not have the header fields in it. While I am creating the sourcetype, I would like to specify the following fields name for the sourcetype - which is a comma separated list. How can i do that? tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG,

sourabhguha · ‎04-05-2013

Hi, I have an existing sourcetype for which I had some data earlier by pointing to a file. The events in the file show up in the search. Now I added another file and used the same sourcetype for it. However, the events from the new file do not show up in the search. i believe they are not getting indexed. Please let me know what additional information or logs i can provide to help investigate this issue. Thanks,

sourabhguha · ‎03-24-2013

hi Vince, i did reindex my data with the option you suggested and it worked. thanks for your help!

sourabhguha · ‎03-23-2013

thanks! that resolved the issue. I renamed it to OMObjectname (removed the '-', did not use underscore).

sourabhguha · ‎03-23-2013

I have the following regex for an extracted field (?i)^(?:[^,]*,){1}(?P<OM-InstanceName>[^,]+) (?i)^(?:[^,]*,){2}(?P<OM-ObjectName>[^,]+) (?i)^(?:[^,]*,){3}(?P<OM-PerfCounterDataID>[^,]+) When I test the regex it does return the expected fields. However, the fields do not show up in the search app (on the left side menu - next to the events list) I have other sourcetypes with extracted fields and they work fine. The only difference for this sourcetype is that I chose the option to 'index only once' when I added the data to Splunk. Any clues on why the extracted fields are not showing up.

sourabhguha · ‎03-22-2013

thanks for the response. I did that, but it did not resolve the problem for existing events. Do I need to delete the data and re-import it into splunk for the fix to take effect

sourabhguha · ‎03-21-2013

Hi, I have the following events. You can see that the timestamps are the same to the second. Due to this Splunk seems to be treating them as one event. However, each is a discrete event. How can i have splunk treat them as discrete events? 9B4C74AF-24D5-45EC-B250-E0B3815F8744,twi1gjni2q.database.windows.net,: Database,DB Number Sessions,20,2013-03-22 02:48:17.003 F4FEF78F-FBEF-4201-B0B1-02B0221099C5,twi1gjni2q.database.windows.net,: Database,DB Network Internal Egress (KB),17740.686528,2013-03-22 02:48:17.030 0014E747-4BCB-4542-9B5B-A6D7CE9D0110,qa84z9y1vj.database.windows.net,: Database,DB Total Used Space (%),28.9451599121094,2013-03-22 02:48:17.997 D7448FB8-2CBB-4F54-B229-81E6BD3B604C,qa84z9y1vj.database.windows.net,: Database,DB Total Free Space (%),71.0548400878906,2013-03-22 02:48:18.013 D744C4C8-1C49-4075-A47F-19F0D6B04533,qa84z9y1vj.database.windows.net,: Database,DB Total Used Space (MB),296.3984375,2013-03-22 02:48:18.023 0A95EAE0-D7B9-428F-826E-0D4D6341CD2D,qa84z9y1vj.database.windows.net,: Database,DB Total Space Quota (MB),1024,2013-03-22 02:48:18.030

Posts	13
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎03-21-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk not indexing data for files

No results showing up in search after adding sourc...

Creating fields based on a comma seperated list of...

Data not showing up in search

Extracted fields not showing up in Interactive sea...

Splunk treating multiple lines as one event since ...

Re: Splunk not indexing data for files