cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Dingu
Explorer
Member since: ‎06-17-2020
‎08-20-2020
Community Statistics
Posts 5
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎06-17-2020
Activity Feed
View All

Monitor files which have special characters in the...

by in Getting Data In
‎07-13-2020 02:25 PM
‎07-13-2020 02:25 PM
Hello there, I'm trying to monitor inputs files which have spaces in it which are in the below format but not all of the files are being captured .  Kindly advise me if my inputs need to be corrected in any way. E:\files\xxxxx\eeeee\Error_20200528173833_70515016_ssss yyyy  Planning Mapping - Update Dimensions.log E:\files\xxxx\eeee\Error_20200615161548_31008196_ Origination Dimension Build.log My current configuration: [monitor://E:\files\xxxx\eeee\Error_*] index = <myindex> disabled = false sourcetype = <mysourcetype> ignoreOlderThan = 30d crcSalt = <SOURCE> ... View more
Labels

Re: How to configure my props.conf for a file with...

by in Getting Data In
‎06-25-2020 07:42 AM
‎06-25-2020 07:42 AM
Thank you for your response @richgalloway  The file will be monitored , sadly I don't have any control over the way it created and the header fields will be matching the no. of field values in the data.  ... View more

How to configure my props.conf for a file with hea...

by in Getting Data In
‎06-24-2020 09:00 AM
‎06-24-2020 09:00 AM
Hello , I'm trying to configure my props.conf for one of the files in which it has header. I don't have any props.conf configured yet, looking for help in configuring this. Thanks in advance example logfile: Field1 Field2 Field3 Field4 Field5 Field6 Field7 ------+------+---------------------------+---------------------------+--------------------------- 0 1 6/16/20 18:35:23:193 EDT 6/16/20 18:35:23:193 EDT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 1 1 6/16/20 18:35:23:216 EDT 6/16/20 18:35:23:216 EDT yyyyyyyyyyyyyyyyyyyyyy 2 1 6/16/20 18:35:23:285 EDT 6/16/20 18:35:23:285 EDT zzzzzzzzzzzzzzzzz ... View more
Labels

Re: Parsing Multiline logs into single event

by in Getting Data In
‎06-18-2020 07:30 AM
‎06-18-2020 07:30 AM
@richgalloway Thank you for your response. I have set my current props.conf as follow [sourcetype] TRUNCATE=240000 SHOULD_LINEMERGE=false TIME_PREFIX=^ TIME_FORMAT= %Y-%m-%d %H:%M:%S,%3N MAX_TIMESTAMP_LOOKAHEAD=30 KV_MODE = auto And I would like to break my event breaking at the highlighted part. 2020-06-05 07:03:56,639 2020-06-05 11:03:56,639 ERROR [11] Error Message: [RecId=xxxxxxxx][host=xxxxxxx][userID=xxxxxxx] Exception: System.InvalidOperationException: The view 'Error' or its master was not found or no view engine supports the searched locations. The following locations were searched: ~/Areas/Summary/Views/PaySummary/Error.aspx ~/Areas/Summary/Views/PaySummary/Error.ascx ~/Areas/Summary/Views/Shared/Error.aspx ~/Areas/Summary/Views/Shared/Error.ascx ~/Views/PaySummary/Error.aspx ~/Views/PaySummary/Error.ascx ~/Views/Shared/Error.aspx ~/Views/Shared/Error.ascx ~/Areas/Summary/Views/PaySummary/Error.cshtml ~/Areas/Summary/Views/PaySummary/Error.vbhtml ~/Areas/Summary/Views/Shared/Error.cshtml ~/Areas/Summary/Views/Shared/Error.vbhtml ~/Views/PaySummary/Error.cshtml ~/Views/PaySummary/Error.vbhtml ~/Views/Shared/Error.cshtml ~/Views/Shared/Error.vbhtml at System.Web.Mvc.ViewResult.FindView(ControllerContext context) at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass3_1.<BeginInvokeAction>b__5(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) at System.Web.Mvc.Controller.<>c.<BeginExecuteCore>b__152_1(IAsyncResult asyncResult, ExecuteCoreState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.<>c.<BeginProcessRequest>b__20_1(IAsyncResult asyncResult, ProcessRequestState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) -------------------------------------------------------------------------------------------------------------------------------------- 2020-06-05 07:03:56,843 2020-06-05 11:03:56,843 ERROR [15] Error Message: [RecId=xxxxxxxx][host=xxxxxx][userID=xxxxxx] Exception: System.InvalidOperationException: The view 'Error' or its master was not found or no view engine supports the searched locations. The following locations were searched: ~/Areas/Summary/Views/PaySummary/Error.aspx ~/Areas/Summary/Views/PaySummary/Error.ascx ~/Areas/Summary/Views/Shared/Error.aspx ~/Areas/Summary/Views/Shared/Error.ascx ~/Views/PaySummary/Error.aspx ~/Views/PaySummary/Error.ascx ~/Views/Shared/Error.aspx ~/Views/Shared/Error.ascx ~/Areas/Summary/Views/PaySummary/Error.cshtml ~/Areas/Summary/Views/PaySummary/Error.vbhtml ~/Areas/Summary/Views/Shared/Error.cshtml ~/Areas/Summary/Views/Shared/Error.vbhtml ~/Views/PaySummary/Error.cshtml ~/Views/PaySummary/Error.vbhtml ~/Views/Shared/Error.cshtml ~/Views/Shared/Error.vbhtml at System.Web.Mvc.ViewResult.FindView(ControllerContext context) at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass3_1.<BeginInvokeAction>b__5(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) at System.Web.Mvc.Controller.<>c.<BeginExecuteCore>b__152_1(IAsyncResult asyncResult, ExecuteCoreState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.<>c.<BeginProcessRequest>b__20_1(IAsyncResult asyncResult, ProcessRequestState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) ... View more

Parsing Multiline logs into single event

by in Getting Data In
‎06-17-2020 03:56 PM
‎06-17-2020 03:56 PM
Hello All, I'm new to splunk and working on one of my error logs onboarding to splunk. somehow my props.conf for the below sample logs seems to be not working. Any help could be greatly appreciated. 2020-06-05 07:03:56,639 2020-06-05 11:03:56,639 ERROR [11] Error Message: [RecId=xxxxxxxx][host=xxxxxxx][userID=xxxxxxx] Exception: System.InvalidOperationException: The view 'Error' or its master was not found or no view engine supports the searched locations. The following locations were searched: ~/Areas/Summary/Views/PaySummary/Error.aspx ~/Areas/Summary/Views/PaySummary/Error.ascx ~/Areas/Summary/Views/Shared/Error.aspx ~/Areas/Summary/Views/Shared/Error.ascx ~/Views/PaySummary/Error.aspx ~/Views/PaySummary/Error.ascx ~/Views/Shared/Error.aspx ~/Views/Shared/Error.ascx ~/Areas/Summary/Views/PaySummary/Error.cshtml ~/Areas/Summary/Views/PaySummary/Error.vbhtml ~/Areas/Summary/Views/Shared/Error.cshtml ~/Areas/Summary/Views/Shared/Error.vbhtml ~/Views/PaySummary/Error.cshtml ~/Views/PaySummary/Error.vbhtml ~/Views/Shared/Error.cshtml ~/Views/Shared/Error.vbhtml at System.Web.Mvc.ViewResult.FindView(ControllerContext context) at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass3_1.<BeginInvokeAction>b__5(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) at System.Web.Mvc.Controller.<>c.<BeginExecuteCore>b__152_1(IAsyncResult asyncResult, ExecuteCoreState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.<>c.<BeginProcessRequest>b__20_1(IAsyncResult asyncResult, ProcessRequestState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) 2020-06-05 07:03:56,843 2020-06-05 11:03:56,843 ERROR [15] Error Message: [RecId=xxxxxxxx][host=xxxxxx][userID=xxxxxx] Exception: System.InvalidOperationException: The view 'Error' or its master was not found or no view engine supports the searched locations. The following locations were searched: ~/Areas/Summary/Views/PaySummary/Error.aspx ~/Areas/Summary/Views/PaySummary/Error.ascx ~/Areas/Summary/Views/Shared/Error.aspx ~/Areas/Summary/Views/Shared/Error.ascx ~/Views/PaySummary/Error.aspx ~/Views/PaySummary/Error.ascx ~/Views/Shared/Error.aspx ~/Views/Shared/Error.ascx ~/Areas/Summary/Views/PaySummary/Error.cshtml ~/Areas/Summary/Views/PaySummary/Error.vbhtml ~/Areas/Summary/Views/Shared/Error.cshtml ~/Areas/Summary/Views/Shared/Error.vbhtml ~/Views/PaySummary/Error.cshtml ~/Views/PaySummary/Error.vbhtml ~/Views/Shared/Error.cshtml ~/Views/Shared/Error.vbhtml at System.Web.Mvc.ViewResult.FindView(ControllerContext context) at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass3_1.<BeginInvokeAction>b__5(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) at System.Web.Mvc.Controller.<>c.<BeginExecuteCore>b__152_1(IAsyncResult asyncResult, ExecuteCoreState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.<>c.<BeginProcessRequest>b__20_1(IAsyncResult asyncResult, ProcessRequestState innerState) at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-20-2020 04:39 PM
Karma given to
View All