Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sphiwee
sphiwee
Communicator
Member since:
07-06-2020
12-02-2020
Community Statistics
| Posts | 70 |
| Solutions | 0 |
| Karma Given | 53 |
| Karma Received | 5 |
| Member Since | 07-06-2020 |
Activity Feed
- Posted Re: create EXTRACTION on Alerting. 12-01-2020 12:15 AM
- Karma Re: create EXTRACTION for gcusello. 12-01-2020 12:15 AM
- Posted create EXTRACTION on Alerting. 11-30-2020 10:18 PM
- Karma Re: Send alerts for status recovery for thambisetty. 11-25-2020 04:13 AM
- Posted cpRe: Log rotation affecting reading of logs on Splunk Enterprise. 11-24-2020 03:00 AM
- Posted Log rotation affecting reading of logs on Splunk Enterprise. 11-24-2020 01:46 AM
- Posted Re: Logs not forwarding after Log Rotation on Splunk Enterprise. 11-22-2020 10:33 PM
- Posted Re: Logs not forwarding after Log Rotation on Splunk Enterprise. 11-19-2020 01:27 PM
- Karma Re: Logs not forwarding after Log Rotation for richgalloway. 11-19-2020 01:27 PM
- Posted Re: Logs not forwarding after Log Rotation on Splunk Enterprise. 11-18-2020 11:24 PM
- Posted Re: Logs not forwarding after Log Rotation on Splunk Enterprise. 11-18-2020 08:13 AM
- Posted Logs not forwarding after Log Rotation on Splunk Enterprise. 11-18-2020 12:42 AM
- Tagged Logs not forwarding after Log Rotation on Splunk Enterprise. 11-18-2020 12:42 AM
- Posted Re: EXTRACTION OF FIELDS on Splunk Enterprise. 11-17-2020 10:43 PM
- Posted Re: EXTRACTION OF FIELDS on Splunk Enterprise. 11-17-2020 10:41 PM
- Karma Re: EXTRACTION OF FIELDS for inventsekar. 11-17-2020 10:39 PM
- Posted Re: EXTRACTION OF FIELDS on Splunk Enterprise. 11-17-2020 03:16 AM
- Karma Re: EXTRACTION OF FIELDS for inventsekar. 11-17-2020 02:55 AM
- Posted EXTRACTION OF FIELDS on Splunk Enterprise. 11-17-2020 02:05 AM
- Tagged EXTRACTION OF FIELDS on Splunk Enterprise. 11-17-2020 02:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
12-01-2020
12:15 AM
I want to have a message on the alert such as "Error code alert on host: ........" The way you're doing it is this achievable? and how?
... View more
11-30-2020
10:18 PM
Good day, I would like to create an alert for the below error, can i get a regex for the higlighted part and how would i go about creating the alert, or should I just look out for the event and set to trigger whenever its > 0. 2020-11-14 23:04:24 [ http-nio-127.0.0.1-7080-exec-7 ] LdapHealthChecker [ ERROR ] Error loading the user groups from LDAP server. Please check the ldap.server.url , ldap.bind.dn , ldap.bind.password secure connection properties. Refer to " Manage Configuration Properties Guide " . org.springframework.ldap.AuthenticationException: [ LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453 , comment: AcceptSecurityContext error , data 52e , v3839\x00 ]; nested exception is javax.naming.AuthenticationException: [ LDAP: error code 49 - 80090308: LdapErr: DSID-0C090453 , comment: AcceptSecurityContext error , data 52e , v3839\x00 ]
... View more
Labels
- Labels:
-
alert action
11-24-2020
01:46 AM
Hi there we noticed we are not getting some logs coming through @ some hours in the morning after log rotation. so we ran the below query. index=_internal host=* /opt/workfusion/supervisord/log/workfusion.out.log NOT Metrics earliest=-7d latest=now | timechart span=5m count as NumInt here's the result below 11-24-2020 01:30:03.080 + 0200 INFO WatchedFile - File too small to check seekcrc , probably truncated. Will re-read entire file= ' /opt/workfusion/supervisord/log/workfusion.out.log '. 11-19-2020 01:30:04.536 + 0200 INFO WatchedFile - Logfile truncated while open , original pathname file= ' /opt/workfusion/supervisord/log/workfusion.out.log ', will begin reading from start. How can I fix this since it's affecting our dashboard because there are no results or logs so the dashboard is empty.
... View more
Labels
- Labels:
-
configuration
-
metrics
-
troubleshooting
11-22-2020
10:33 PM
are you able to tell me what do these lines do [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] or [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] because watchdog.log and cloud.log are not the logs we are monitoring
... View more
11-19-2020
01:27 PM
[default] index = default _rcvbuf = 1572864 host = $decideOnStartup [blacklist:$SPLUNK_HOME/etc/auth] [blacklist:$SPLUNK_HOME/etc/passwd] [monitor://$SPLUNK_HOME/var/log/splunk] index = _internal [monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*] index = _internal [monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log] index = _telemetry [monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*] index = _telemetry :
... View more
11-18-2020
11:24 PM
hi I don't want the rotated log because its being archived, I want the new log that's been generated.. because somehow after log rotation logs stop being forwarded.
... View more
11-18-2020
12:42 AM
Hi our logs stop forwarding for a while after they have been archived, and this causes us to miss out on valuable data, how can I make splunk start monitoring that log after the old one has been renamed and archived ?
... View more
- Tags:
- forwarder
Labels
- Labels:
-
configuration
-
troubleshooting
11-17-2020
10:43 PM
Am I able to convert that 14% to a piechart that shows only 14% space used? and how? kinda struggling to do it
... View more
11-17-2020
10:41 PM
Hi @inventsekar i was able to fix it with this "| search memoryUsed=* OR directory=*"
... View more
11-17-2020
02:05 AM
Can I please get the extraction of "14%" as memory used & "boot" as directory, thank you. [2020-11-17 11:33:43+0200] Filesystem Size Used Avail Use% Mounted on /dev/sda1 2.0G 274M 1.8G 14% /boot
... View more
- Tags:
- extraction
Labels
- Labels:
-
configuration
10-30-2020
01:40 AM
1 Karma
is it possible to get alerts through whatsapp? and how?
... View more
Labels
- Labels:
-
Analytics Workspace
-
other
-
troubleshooting
10-28-2020
11:47 AM
Why is the time like this? and where is the start time taken from and the end time?
... View more
10-28-2020
08:01 AM
10-28-2020
04:01 AM
Business_field is a value I extracted from the data and it holds different processes within, this is what i used to extract it rex field=_raw "name\=\w+\s+(?<business_field>.*)\{" so different processes will have their own "Ready To Process" or "Completed" and i would be able to see it
... View more
10-28-2020
03:25 AM
for completed in search i add "completed" and for processing i use "processing" in search and so on.. if you look at the queries its business_field + "status" that's what makes it unique
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-02-2020
03:45 AM
|
Karma given to
