Hi All, I need your urgent help in fixing one of the issue in my PROD environment.  we have an application log which rotates twice daily. once in the afternoon and once around midnight. Logs starts feeding in splunk when log rotates around afternoon and stops feeding when log rotates around midnight. if we do some minor changes to inputs like adding any extra parameter to inputs.conf if starts feeding again and then stops again in few seconds. This is my inputs.conf [monitor:///var/log/logpath/logpath/xx*.log] sourcetype = abcd disabled = false index = xyz   this is my props.conf [abcd] SHOULD_LINEMERGE=TRUE BREAK_ONLY_BEFORE = \w\|\d+\|\d{2}:\d{2}:\d{2}\.\d{6} MAX_TIMESTAMP_LOOKAHEAD = 15 NO_BINARY_CHECK = true TIME_FORMAT = %H:%M:%S.%6N TIME_PREFIX = \w.*\|\d*\| category = Custom disabled = false pulldown_type = true TRUNCATE=50000 MAX_EVENTS = 9999 Please let me know if any other information is required here. Any help here will be highly appreciated. Thanks in advance Prateek  ... View more

Hi All, I need your help in creating cron expression for alert schedule. I need to schedule a alert from  Monday 02:00 - Saturday 00:30. If any other information is required please let me know. Any help will be highly appreciated.    Thanks in advance. ... View more

Hi Team, I need urgent help on how to whitelist  specific lines from logfile and ignoring rest. As an example this is a feed in my logfile :- [2021-08-18 03:32:09.797] 2021-08-18 03:31:59.000, ip: 10.7.128.219, folder: 0, size: <nil>, event: ObjectRemoved:DeleteMarkerCreated, session: 15849,10.7.128.219, type: 2, region: eu-west-2, bucket: proftpd-prod-replicated, topic: arn:aws:sns:eu-west-2:563028249984:proftpd_prod_replicated_event_topic, key: export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest/CREDIT_INDICES_LIVE_PRICING-20210811-0315.csv, sequencer: 00611C7F3529A4C883 deleteObject: Warning: Couldn't remove object '/export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest/CREDIT_INDICES_LIVE_PRICING-20210811-0315.csv' from cache, cache might be stale Detected cache out of sync, now relisting whole directory [/export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest] === Now testing diff of folder and cache... [folder: export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest/] =============================== DIFF CALCULATION TOOK: 0.015115 [diffs: [/export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest]: additions: 0, removals: 0, updates: 0, timestamp: 1629257529.797306] Updating timestamp from: 1629253911.017497 to: 1629257529.797306 RESULT [/export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest]: Size: 499, folders: 5, footprint: 30856, cache_: 0x7f6781fd2878 /:D:1 1629257529.812982 /..:D: [VIRTUAL] - export 0 /export:D:1 1629257529.812975 /export/..:D: [VIRTUAL] - sftp 0 /export/sftp:D:1 1629257529.812971 /export/sftp/..:D: [VIRTUAL] - ABE0A4FD16B68ADBC0B28AD415F 0 /export/sftp/ABE0A4FD16B68ADBC0B28AD415F:D:1 1629257529.812988 /export/sftp/ABE0A4FD16B68ADBC0B28AD415F/..:D: [VIRTUAL] - Credit_Index_Live_Latest 0 /export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest:D:494 1629257529.797306 /export/sftp/ABE0A4FD16B68ADBC0B28AD415F/Credit_Index_Live_Latest/..:D: [VIRTUAL] - CREDIT_INDICES_LIVE_PRICING-20210818-0330.csv 115660 - CREDIT_INDICES_LIVE_PRICING-20210818-0315.csv 115638 - CREDIT_INDICES_LIVE_PRICING-20210818-0300.csv 115636 - CREDIT_INDICES_LIVE_PRICING-20210818-0245.csv 115636   Out of the above lines I want only to enable feed for the line which is highlighted in red and ignore rest of the lines.  Please suggest this can be achieved?  Thanks in advance.   Regards, Prateek Sawhney  ... View more

Hi All, I need your help urgently, I am facing issue with one of the forwarder as it keeps taking lots of space in /opt directory and due to which sometimes it stops running. Upon checking further I noticed that this directory is taking maximum space. /opt/splunk/var/lib/splunk/fishbucket/splunk_private_db   On further investigation I came to know that if I do changes in limits.conf file I can limit size of this directory. But unfortunately I cannot find this file limits.conf under /opt/splunk/etc/system/local.    Please suggest what can I do about it. Any replies to this will be highly appreciated. Also please correct me if I am using a wrong approach here.   Thanks in advance. Prateek ... View more

Hi Folks, I need your help in fetching latest event from a particular field. Sharing you a sample event  and query when I execute for last 15 mins. Query -> index=Blah sourcetype=blah_blah* Example event :- 2020-11-02   05:35:00.319 ,  SOURCE= " Tullett ",  COUNTVOL= " 879 ",  TO_CHAR ( SNAPTIME ,' MM/DD/YYHH24:MI:SS ') = " 08/31/20   00:59:00"   Initial date on this event seems to be OK which is todays date" 2020-11-02   05:35:00.319 ", but date at the end which is field SNAPTIME_NEW seems to be old   " 08/31/20   00:59:00" . Can you please help me with a query so that I see only "todays" events in a sorted manner by date in field SNAPTIME_NEW when I execute query for last 15 mins.    Screenshot attached.   Thanks,  Prateek ... View more