×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
isha_ish
Engager
Member since: ‎10-14-2020
‎10-14-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎10-14-2020
Activity Feed
View All

index.conf file query

by in Dashboards & Visualizations
‎10-15-2020 12:10 PM
‎10-15-2020 12:10 PM
what does the below DataSize MB means on the index.conf file. just wanted to know how it works   homePath = volume:hot1/fxmp_core_prod/db coldPath = volume:cold1/fxmp_core_prod/colddb thawedPath = $SPLUNK_DB/fxmp_core_prod/thaweddb homePath.maxDataSizeMB = 2048 --> what does this implies maxTotalDataSizeMB = 5120 --> what does this implies ... View more

Re: multi-line events

by in Dashboards & Visualizations
‎10-14-2020 10:18 PM
‎10-14-2020 10:18 PM
Multiline events are solved now. but the line which should be on multiline like the postman commands and the result are also coming in separate line. any way to fix it ?     15/10/2020 06:06:16.069   1875094 < Transfer-Encoding: chunked host = lonrsxxx index = agile-xxx source = /exxx sourcetype = amservices-log splunk_server = lonrsxxx   15/10/2020 06:06:16.069   1875094 < Server: Apache-Coyote/1.1 host = lonrsxxx index = agile-xxxx source = /exxx sourcetype = amservices-log splunk_server = lonrxxxx   15/10/2020 06:06:16.069   1875094 < Date: Thu, 15 Oct 2020 05:06:15 GMT host = lonrs1xxx index = agile-main source = /exxxx sourcetype = amsexxx splunk_server = lonrsxxxx   15/10/2020 06:06:16.069   1875094 < Content-Type: application/json;charset=UTF-8 ... View more

multiline events

by in Dashboards & Visualizations
‎10-14-2020 11:52 AM
‎10-14-2020 11:52 AM
Am getting multiline events. below events should be shown separately for each time. how to fix this . on my props.conf i have the below config. but it isn't working BREAK_ONLY_BEFORE_DATE=true TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ MAX_TIMESTAMP_LOOKAHEAD = 24 14/10/2020 19:46:58.035   2020-10-14T19:46:58.035+01:00 INFO [r] (default task-11) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-82) Checking user auth. [token(abbr.)=null,xForwardedFor=,remoteAddr=11.18xxx] 2020-10-14T19:46:58.035+01:00 INFO [] (default task-11) User token loaded. [windowsId=null,internal=false,externalOrigin=false,status=TOKEN_IS_NULL_OR_EMPTY] 2020-10-14T19:46:58.035+01:00 INFO [sso.AuthFilter ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-14-2020 01:41 PM
Karma given to
View All