About CarolinaHB

CarolinaHB · ‎08-18-2020

Hi @rabbidroid , I'm trying with $SPLUNK_HOME/bin/splunk start --debug but It is not running. It send me the same message WARNING: web interface does not seem to be available! I already installed it again and nothing Regards.

CarolinaHB · ‎08-17-2020

User Splunk is running as root

CarolinaHB · ‎08-17-2020

Hi, I'm running with root the following command ./splunk start --accept-license

CarolinaHB · ‎08-17-2020

Hi , I installed splunk on a linux server but it sent me the following error "Warning: web interface does not seem to be avaible" in Splunk Enterprise. I searched in /opt/splunk/var/log/splunk/ but I can't find anything. Can you help me, please? Regards.

CarolinaHB · ‎06-16-2020

Hi @MasterOogway You were able to solve this problem, I currently have this detail with version 7.2.4.2. I work in a development environment but when I migrate production environment the sourcetype doesn't recognize me. I already copied and pasted the props but it doesn't work Your solution would help me a lot. https://community.splunk.com/t5/Splunk-Cloud/MultiLine-Event-Line-Breaker/m-p/504155#M28 Regards

CarolinaHB · ‎06-12-2020

Hi, I try SHOULD_LINEMERGE = false It doesn't work

CarolinaHB · ‎06-11-2020

Hi, I have a file with many records but when it is indexed in a single event. Example: 20859000133104142002020052140014M101000042394286020200521012000136024001R0001400000000000039500111342817111342817211342818311342818300000000011342819911342820800000000011342837310500 2085900013320414208085904142200000000046 20200521012000136024001R0050200000000000000056211344550011344550211344551211344551200000000011344552511344553300000000011344569410500 2085900013330414206085904142200000000047 20200521012000136024001R0050200000000000000056311351275511351275511351276711351276700000000011351278411351279500000000011351293910500 My props.conf file is configured [Prueba] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD = 17 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIME_FORMAT = %Y%m%d0%H%M%S%3Q TIME_PREFIX = ^.{49} category = Custom pulldown_type = true BREAK_ONLY_BEFORE_DATE = disabled = false I changed the regex in LINE_BREAKER by ^.+\n but it does not work. Regards,

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-11-2020

Online Status	Offline
Date Last Visited	‎12-21-2022 03:39 PM

Why is the Web interface not available in splunk e...

MultiLine Event - Line Breaker

Re: Web interface does not seem to be avaible splu...

Re: Web interface does not seem to be avaible splu...

Re: Web interface does not seem to be avaible splu...

Why is the Web interface not available in splunk e...

Re: How to determine what Props.conf settings affe...

Re: MultiLine Event - Line Breaker

MultiLine Event - Line Breaker