About vin_ven27

vin_ven27 · ‎08-04-2022

I believe @richgalloway that the Task name is not under a Message keyword accepted by the whitelisting. With this, do we have any work around? or once the keyword is not: Category, CategoryString, ComputerName, EventCode, EventType, Keywords, LogName, Message, OpCode, RecordNumber, Sid, SidType, SourceName, TaskCategory, Type, User meaning it will not work at all?

vin_ven27 · ‎08-03-2022

Will do. thanks buddy. Appreciated your help. Ciao. Alvin

vin_ven27 · ‎08-03-2022

Hi Giuseppe, Thank you for asking. Actually the client had CPU problem in windows server end and they seeing that this is the cause of Universal Forwarder as per they initial checks. So this is our work around just to refrain of getting the data real time. We believe (somehow) that it will resolve the problem by changing interval in every 30mins. However, we have also another approach which are the whitelist/blacklist but it seems like it is not working for us. We think that it is because the task name event is not a part of the filtering suggestion for whitelist/blacklist. The suggested events are EventID, Category, message, Opcode etc which are not available in the _raw events. This is related to this link: https://community.splunk.com/t5/Getting-Data-In/How-to-setup-to-whitelist-and-blacklist-in-inputs-conf-to-pulll/m-p/608021#M105525

vin_ven27 · ‎08-03-2022

Hi giuseppe, May I know what parameters I can use in outputs.conf for the frequency setup? I saw autoLBfrequency and polling_interval but I am not sure if I these is the parameter you are referring to. Please advise... tia

vin_ven27 · ‎08-03-2022

Hi, we are trying to pull a specific data from [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] but the problem is our unique event is not suggested for the white/blacklisting such as eventID, category, etc... we only have Task Name to filter it. so we tried: blacklist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\) and whitelist = $XmlRegex=(?<=Name='TaskName'\>)(\\TaskNameSample\\) but not working... do you have any suggested solution for this?

vin_ven27 · ‎08-02-2022

We install Universal forwarder in Windows Server for us to pull data from [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] to Splunk, to monitor jobs/event. Currently per check we are getting data real time from WinEventLog. Is there a way that we can change the timing/interval in every 10mins? We already tried: interval = 600, interval = <cron> , schedule = 600 and schedule = <cron> but doesn't work. May we know if you have any solution for this? Please...

vin_ven27 · ‎09-02-2021

We are using DBconnect with JTDS driver. When we enabling the connection in DBconnect we are seeing the below script in SQL Diagnostic Manager every 30mins: SELECT @@MAX_PRECISION SET TRANSACTION ISOLATION LEVEL READ COMMITTED SET IMPLICIT_TRANSACTIONS OFF SET QUOTED_IDENTIFIER ON SET TEXTSIZE 214###### May we know what is the use of this? Can we get rid of this or at least change the frequency to every hour instead? In addition, we are seeing the Sleeping Session in SQL Diagnostic Manager. Is this usual or is there a way to complete the session after SQL script run from DBconnect to SQL Diagnostic Manager. We are just getting the data from the database on demand but after triggering the DBXquery the Sleeping session occur. Please advise.

vin_ven27 · ‎08-03-2021

thanks for a quick response @venkatasri Actually that is our first schedule setup which is every 5mins it's just so happen that the client want a data updated of what will be the possible minimum time. So we change to 1min cron schedule and the SQL set as batch and get only past 1min of the data using updated time column. For us to resolve the missing data our work around is to get 90secs past data instead of 1min in SQL and the cron still 1min. But not sure though if this work this out. Any idea?/suggestion?

vin_ven27 · ‎08-03-2021

I used DBconnect to pull data from the database in every 1min *(cron: * /1 * * * *). I would like to ask if this schedule is simple as: #1 - Run every e.g. 10:00, then 10:01 then 10:02 and so on... or? #2 - Run every e.g. 10:00 (wait until the job done) example 10:00:35 so the job will run at 10:01:35. Please advise as we encountering missed of data when we tried the #1. Thanks

vin_ven27 · ‎07-04-2021

Thanks for your help.

vin_ven27 · ‎06-30-2021

I am using DBconnect to pull data in database then the setup would be RISING. Using SQL to select data from database. There are 3 dates from database column and I will convert to epoch time then the highest epoch time will be created as column (MaxDate) to be use as RISING COLUMN. Questions: May i know if the MaxDate will work in RISING COLUMN? If yes, I encountered "java.sql.SQLException: Parameter #1 has not been set." is there anyone could help? Or other ways cause our only choice is to use the date max to be able to pull the updated one. Thanks

vin_ven27 · ‎11-29-2020

Is it possible to have two words Status like "Not running"? I tried to put it in: <style> g.c3-shapes.c3-shapes-Not Running path.c3-shape.c3-arc-Not Running{ fill:orange !important; Tried: with underscore (Not_Running) and with d.quotes ("Not Running") but no luck. It seems status with space is not valid. Is there a way? Thanks

Posts	12
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎10-13-2020

Online Status	Offline
Date Last Visited	‎08-04-2022 10:41 AM

How to setup to whitelist and blacklist in inputs....

How to set timing/interval when pulling event in W...

DBconnect accessing SQL Diagnostic Manager every 3...

DBconnect cron schedule behavior

Created column will use as DBconnect Rising Column...

Re: How to whitelist specific TaskName in inputs.c...

Re: How to set Timing/Interval when pulling event ...

Re: How to set Timing/Interval when pulling event ...

Re: How to set Timing/Interval when pulling event ...

How to setup to whitelist and blacklist in inputs....

How to set timing/interval when pulling event in W...

DBconnect accessing SQL Diagnostic Manager every 3...

Re: DBconnect cron schedule behavior

DBconnect cron schedule behavior

Re: Created column will use as DBconnect Rising Co...

Created column will use as DBconnect Rising Column...

Re: Drilldown for Donut Custom Visualisation?