About phamxuantung

livehybrid · ‎11-05-2025

Hi @phamxuantung When you say you have checked the number of events in the log ingested, are you checking this for the number of events in Splunk or number of lines in the log file? Assuming that an event is a single line in the log file, you could do something like this to get the number of events in the log file: wc -l <pathToLog> This will provide the number of lines in the log, you should then to a check in Splunk: | tstats count where index=yourIndex source=pathToLog Please can you check these values and let us know what you get back? 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing

isoutamo · ‎07-05-2023

What job inspector shows for both queries?

richgalloway · ‎05-31-2023

Check the DBX logs for messages that might explain why the fields were not extracted. Perhaps they contain bad characters or something like that (just guessing).

gcusello · ‎03-22-2023

Hi @phamxuantung , as I said it's a strange behavior that I never experienced before, anyway I'm happy that you solved your issue. Ciao. Giuseppe

LRF · ‎03-03-2023

hi @phamxuantung LINE_BREAKER is applied during the Parsing Pipeline, so the instance with the LINE_BREAKER and SHOULD_LINEMERGE = false (merging pipeline) must be set on HF/Indexer level. LINE_BREAKER on Search Heads would work if that Search Heads are directly indexing events (i.e. in Splunk all-in-one architectures), hence parsing events themself. Hope this helps, Fabrizio

phamxuantung · ‎03-02-2023

Hello, Our Splunk Enterprise structure are 1 Master, 2 Search Head and 4 Indexer Cluster. The Master will configure Forwarder Management and the deployment apps stay there. Now I want to index some logs file from a server (which already installed an UF) with csv structure, but not have csv extension. The log file is like this api_key,api_method_name,bytes,cache_hit,client_transfer_time,connect_time,endpoint_name,http_method,http_status_code,http_version,oauth_access_token,package_name,package_uuid,plan_name,plan_uuid,pre_transfer_time,qps_throttle_value,quota_value,referrer,remote_total_time,request_host_name,request_id,request_time,request_uuid,response_string,service_definition_endpoint_uuid,service_id,service_name,src_ip,ssl_enabled,total_request_exec_time,traffic_manager,traffic_manager_error_code,uri,user_agent,org_name,org_uuid,sub_org_name,sub_org_uuid unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641598.598_unknown_unknown,2023-02-05T23:59:58,dafeac38-123d-4bb7-aa1c-59680afbc0b2,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641608.030_unknown_unknown,2023-02-06T00:00:08,e4cd645a-5471-4097-baf0-67f90f4d2cee,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.001,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641618.607_unknown_unknown,2023-02-06T00:00:18,ee18e506-2ea5-4792-a586-f0274e6c823b,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641627.988_unknown_unknown,2023-02-06T00:00:27,5cc9f704-61a3-443c-b670-26373afe5502,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- The log file is named as: access_worker5_2023_2_5.log or access_worker5_2023_2_5.log.1 Before config input.conf in my deployment I config props.conf and transfroms.conf in my Search Head in /splunk/etc/apps/search/local as props.conf [mllog.new] CHARSET = UTF-8 INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = sourcetype for index csv disabled = false pulldown_type = true FIELD_NAMES = api_key,api_method_name,bytes,cache_hit,client_transfer_time,connect_time,endpoint_name,http_method,http_status_code,http_version,oauth_access_token,package_name,package_uuid,plan_name,plan_uuid,pre_transfer_time,qps_throttle_value,quota_value,referrer,remote_total_time,request_host_name,request_id,request_time,request_uuid,response_string,service_definition_endpoint_uuid,service_id,service_name,src_ip,ssl_enabled,total_request_exec_time,traffic_manager,traffic_manager_error_code,uri,user_agent,org_name,org_uuid,sub_org_name,sub_org_uuid TIMESTAMP_FIELDS = request_time REPORT-tibco-mllog-new = REPORT-tibco-mllog-new DATETIME_CONFIG = HEADER_FIELD_LINE_NUMBER = 1 FIELD_DELIMITER = , HEADER_FIELD_DELIMITER = , ###THIS IS FOR TESTING### [mllog.new2] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Custom disalbe = false pulldown_type = 1 transfroms.conf [REPORT-tibco-mllog-new] DELIMS = "," FIELDS = "api_key","api_method_name","bytes","cache_hit","client_transfer_time","connect_time","endpoint_name","http_method","http_status_code","http_version","oauth_access_token","package_name","package_uuid","plan_name","plan_uuid","pre_transfer_time","qps_throttle_value","quota_value","referrer","remote_total_time","request_host_name","request_id","request_time","request_uuid","response_string","service_definition_endpoint_uuid","service_id","service_name","src_ip","ssl_enabled","total_request_exec_time","traffic_manager","traffic_manager_error_code","uri","user_agent","org_name","org_uuid","sub_org_name","sub_org_uuid" Then I config deployment apps like normal, with input.conf like this input.conf [monitor:///u01/pv/log-1/data/trafficmanager/enriched/access/*] disabled = 0 index = myindex sourcetype = mllog.new ###THIS IS FOR TESTING### [monitor:///u01/pv/log-1/data/trafficmanager/enriched/access/*] disabled = 0 index = myindex sourcetype = mllog.new2 After configuration and restart. I ran 2 query index = myindex sourcetype = mllog.new -> 0 events index = myindex sourcetype = mllog.new2 -> Have events, but not with correct line breaking, some event have 1 line (correct) some events have 2 lines or even 257 lines (which clearly wrong), indexed header and don't have fields seperation. So clearly I have config wrong somewhere, can someone point me to the right direction.

phamxuantung · ‎02-07-2023

Sorry for the late reply, this is the sample of the log, from line 1 foward: api_key,api_method_name,bytes,cache_hit,client_transfer_time,connect_time,endpoint_name,http_method,http_status_code,http_version,oauth_access_token,package_name,package_uuid,plan_name,plan_uuid,pre_transfer_time,qps_throttle_value,quota_value,referrer,remote_total_time,request_host_name,request_id,request_time,request_uuid,response_string,service_definition_endpoint_uuid,service_id,service_name,src_ip,ssl_enabled,total_request_exec_time,traffic_manager,traffic_manager_error_code,uri,user_agent,org_name,org_uuid,sub_org_name,sub_org_uuid unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641598.598_unknown_unknown,2023-02-05T23:59:58,dafeac38-123d-4bb7-aa1c-59680afbc0b2,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641608.030_unknown_unknown,2023-02-06T00:00:08,e4cd645a-5471-4097-baf0-67f90f4d2cee,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.001,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641618.607_unknown_unknown,2023-02-06T00:00:18,ee18e506-2ea5-4792-a586-f0274e6c823b,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641627.988_unknown_unknown,2023-02-06T00:00:27,5cc9f704-61a3-443c-b670-26373afe5502,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641633.592_unknown_unknown,2023-02-06T00:00:33,8a4a97c6-9fc6-4f67-9165-a55e3cd67979,596 Service Not Found (Proxy),-,unknown,-,10.244.3.1,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641628.644_unknown_unknown,2023-02-06T00:00:28,251c26bb-4dfd-44b2-b88a-0143fb7148da,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641638.625_unknown_unknown,2023-02-06T00:00:38,c18cd8de-18f7-4bd8-b5bc-90d244fe32fd,596 Service Not Found (Proxy),-,unknown,-,10.244.1.0,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- unknown,-,30,0,0.0,0.0,-,POST,596,HTTP/1.1,-,-,-,-,-,0.0,0,0,-,0.0,developer.napas.com.vn,1675641642.970_unknown_unknown,2023-02-06T00:00:42,d71a2b1b-d438-4e5e-8173-e48f0f129d6e,596 Service Not Found (Proxy),-,unknown,-,10.244.3.1,1,0.0,tm-deploy-0-97674db57-smcdv,ERR_596_SERVICE_NOT_FOUND,/healthcheck,-,-,-,-,- Curiously, the log stop after 9/1, comeback at 26/1 with only 2 line of log and then stop since that time. The only change they made was change the name of the log from on access_worker6.log to access_worker_6_YYYY_MM_DD.log. But I in input.conf I put it as /*.log then it should catch it nonetheless.

Manasa_401 · ‎01-05-2023

Hello @phamxuantung you can also achieve it using mvjoin command. |stats list(USER_PHONE) as phone |eval phone=mvjoin(phone,";") If this helps, karma would be appreciated. Thanks, Manasa

gcusello · ‎12-19-2022

Hi @phamxuantung, in other words, you want to filter (find) events in the index that match the values of the csv, if this is your need, please try this: index=myindex [ | inputlookup mycsv.csv | fields HASHPAN ] | lookup your_lookup.csv HASHPAN | table PAN total_trans total_amount HASHPAN _time TRACE TRANSACTIONID otherwise, if you're sure that a field of the lookup (e.g. PAN) has always values, you could also use a simpler solution: index=your_index | lookup your_lookup.csv HASHPAN OUTPUTNEW PAN total_trans total_amount | where PAN=* | table PAN total_trans total_amount HASHPAN _time TRACE TRANSACTIONID Ciao. Giuseppe

gcusello · ‎12-05-2022

Hi @phamxuantung, the approach should be of putting the data source in regex101.com and test or adapt the regex there. Then you can bring it and test again in Splunk search. Ciao. giuseppe

yuanliu · ‎10-10-2022

Just want to note that the second effort to survive year-end was still incorrect.☹️ I must use modulus in mrange: | eval mrange = mvrange(0, (nmax - nmin + 13) % 12) ``` previous two definitions will not work across year ``` Put together, | eval _time = strptime("01-".month, "%d-%m-%Y") ``` Use first day as marker ``` | stats min(_time) as min_month max(_time) as max_month values(_time) as month by Employee | where max_month == relative_time(now(), "-0mon@mon") ``` only if Employee in current month ``` | eval nmin = strftime(min_month, "%m"), nmax = strftime(max_month, "%m") | eval mrange = mvrange(0, (nmax - nmin + 13) % 12) ``` previous 2 definitions will not work across year ``` | mvexpand mrange | eval rmonth = relative_time(min_month, "+".tostring(mrange)."mon") ``` this survives year boundary ``` | eval outmonth = if(isnull(mvfind(strftime(month, "%m"), strftime(rmonth, "%m"))), rmonth, null()) ``` when Employee has no record ``` | stats max(outmonth) as maxout by Employee month max_month ``` last month when Employee has no record ``` | eval maxout = if(isnull(maxout), 0, maxout) | where month > maxout | rename max_month as _time | stats count by Employee _time Or, if anyone prefers mvmap (Splunk 8 or later) over mvexpand, | eval _time = strptime("01-".month, "%d-%m-%Y") ``` Use first day as marker ``` | stats min(_time) as min_month max(_time) as max_month values(_time) as month by Employee | where max_month == relative_time(now(), "-0mon@mon") ``` only if Employee in current month ``` | eval nmin = strftime(min_month, "%m"), nmax = strftime(max_month, "%m") | eval mrange = mvrange(0, (nmax - nmin + 13) % 12) ``` previous 2 definitions will not work across year ``` | eval nmonths = mvmap(mrange, relative_time(min_month, "+".tostring(mrange)."mon")) ``` also much less convoluted ``` ``` ^ calculate calendar months in range ``` | eval outmonth = max(mvmap(nmonths, mvappend(outmonth, if(IN(nmonths, month), null(), nmonths)))) ``` last month when Employee had no record ``` | eval month = mvmap(month, mvappend(lastmonths, if(month < outmonth, null(), month))) ``` only count last months when Employee has record ``` | eval count = mvcount(month) | rename max_month as _time | table Employee _time count

isoutamo · ‎10-04-2022

Hi can you just add scheduled search which a run a daily base and create a local lookup with it? Then just use that lookup on those alerts and where ever you need it. Basically same than use dblookup, but this don't need a active connection between your database and SH all time, just when that lookup has updated. And when update don't replace old without having a new with lines. Then it is not an big issue if connection fails when lookup has updates (just one day old data). r. Ismo

gcusello · ‎10-02-2022

Hi @phamxuantung, ok, only for check, copy the log to ingest in a new file with a different name, and see if it's indexed. If yes, choose one of the input stanzas and delete the crcSalt row. One question. the fielname is always the same, but the content (especially the first 256 chars) are always the same or theyt change? I suppose that they should change because the timestamp should change. About the user, you have to check this point because it's a relevant one. About your questions: Does this have anything to do with the getting logs? no because the time format doesn't give format misunderstanding, I thought Splunk can automate the indexing process. If not, should I add to config anything? the indexing proces is automated but you have to copnfigure it: inputs, parsing, etc... The new Data Strema Processor is coming but it isn't still present. Also, I don't define sourcetype in my syntax in input.conf, would that be a problems? Splunk usually identifies the sourcetype, but I always prefer to force it in my inputs.conf. remember that, with few exceptions, the parsing phase is done (with props.conf and transforms.conf) on indexers or (when present) on Heavy Forwarders, this means that you don't need to putt props.conf and transfroms.conf in the UFs but on Indexers and Heavy Forwarders. Ciao. Giuseppe

chaker · ‎09-29-2022

Hi @phamxuantung , It's because the regex I have you is looking for digits using \d In this example, field F62 is extracted. I used a wildcard so it will catch anything in that field regardless of digit or string match. |rex field=_raw "\"F62\"\:\"(?<F62>.+?)\""

isoutamo · ‎09-26-2022

Hi this seems to work | rest splunk_server=<your indexer group name> /services/server/introspection/queues | eval current_fill_perc = round(current_size_bytes / max_size_bytes * 100, 0) | fields title, current_fill_perc | search title="parsingQueue*" OR title="aggQueue*" OR title="typingQueue*" OR title="indexQueue*" | rex field=title "(?<queue_name>^\w+)\.?(?<pipeline_number>\d+)?" | fillnull VALUE=0 pipeline_number | chart values(current_fill_perc) over pipeline_number by queue_name | fields pipeline_number, parsingQueue, aggQueue, typingQueue, indexQueue | rename pipeline_number as "Pipeline Number", parsingQueue as "Parsing Queue Fill Ratio (%)", aggQueue as "Aggregator Queue Fill Ratio (%)", typingQueue as "Typing Queue Fill Ratio (%)", indexQueue as "Index Queue Fill Ratio (%)" You should add correct wildcard like splunk-idx-* to splunk_server to target this query towards correct server. Also you should create this as a report which are owned by some admin user (which have capability to run REST query) and run it "as owner" to allow other people to see results. r. Ismo

isoutamo · ‎09-05-2022

Hi This means that you have something wrong on your connection definition. Probably you have some wrong character on your database name or something similar in DB Connect definitions. r. Ismo

phamxuantung · ‎08-22-2022

I'm considering making an alert for each company, but we're having over 40 associates, so that will require a bit of work creating and management, so I try to find a work around for a small requirement such as filename.

gcusello · ‎08-18-2022

Hi @phamxuantung, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉

dural_yyz · ‎08-16-2022

The DMC comes with most reports you will want to start with. From here you can start to understand some behavior and then when ready deep dive the individual panels to understand what indexes have which values and what those values mean. DMC -> Monitoring Console -> Search Here you can look at "Search usage Statistics: Deployment" OR "Search Activity: Deployment", you can try instance but that is a single server view and not the entire picture if you have search head clusters. Here is a basic interpretation of the start of a DMC search - there is more to it but it is a good place to start. index=_audit sourcetype=audittrail action=search search_id!="rsa_*" | eval user=if((user == "n/a"),null(),user), search_type=case(match(search_id,"^SummaryDirector_"),"summarization",match(search_id,"^((rt_)?scheduler__|alertsmanager_)"),"scheduled",match(search_id,"\\d{10}\\.\\d+(_[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})?$"),"ad hoc",true(),"other"), search=if((isnull(savedsearch_name) OR (savedsearch_name == "")),search,savedsearch_name) | stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id, host

matt8679 · ‎08-16-2022

Try this in the CLI, path to where splunk is installed on the master indexers: ./splunk apply cluster-bundle

phamxuantung · ‎08-07-2022

Ah yes, I forgot stats count doesn't count null value. Thank you.

isoutamo · ‎08-05-2022

When you have installed DBX on SH side you can use it’s monitoring views to get information about how it works. It also write it’s own log files under …/logs/splunk.

phamxuantung · ‎08-04-2022

Your query extract a different fields than what I want, because there're many rows that have 'in [ ]' before, so I tweak it a bit | rex "in\[ *62+: *]<(?<msg>\D[^>]+)" Then it work just the way I want it to. Thank you

isoutamo · ‎08-01-2022

Hi you could find some solutions from community by searching with Google. Here is one example index=_internal sourcetype=scheduler search_type=scheduled alert_actions!="" alert_actions!="summary_index" | table savedsearch_name, sid, app, alert_actions, scheduled_time, *time Just update table part to get your needed columns and/or add other queries if that one event didn't contain all needed fields. r. Ismo

PickleRick · ‎07-28-2022

OK. Firstly - I think it's a false positive. As I said - splunk on its own doesn't use SQL at all. The only SQL thing regarding Splunk I know is the use of DBConnect app but this "finding" doesn't seem to have anything to do with that. Secondly - Splunk doesn't allow you to customize HTTP operations on such low level. Short of putting a reverse-proxy in front of it and forcing all traffic to go through that proxy there is no way to configure this on Splunk alone.

Posts	103
Solutions	0
Karma Given	23
Karma Received	0
Member Since	‎01-11-2021

Online Status	Offline
Date Last Visited	‎11-05-2025 12:54 AM

Missing data in ingested log

Why is my schedule search produce less result than...

Why does DBConnect sometime index events that's la...

Why is wildcard not working in log file name for i...

Splunk incorrect default line breaking- What am I ...

How to correctly configure Splunk to monitor csv s...

Deployment app suddenly stopped indexing monitored...

How to use stats list() but separate each value wi...

How to take sample events in an index from a CSV f...

Need help writting a rex query

Re: Missing data in ingested log

Re: Why is my schedule search produce less result ...

Re: DBConnect sometime index events that lacking f...

Re: wildcard don't work in log file name for input...

Re: Splunk incorrect default line breaking

How to correctly configure Splunk to monitor csv s...

Re: Deployment app suddenly stop index monitored f...

Re: stats list() but seperate each value with ";"

Re: Take sample events in an index from a CSV file

Re: Need help writting a rex query

Re: How to add a column to count for consecutive o...

Re: How to reindex data to get new data with chanc...

Re: How to know and verify if my syntax I write fo...

Re: Need help writting a rex query

Re: How to create an alert/dashboard for queueing ...

Re: ORA-12505, TNS:listener does not currently kno...

Re: Customize output csv file name base on field v...

Re: Can't I read file in this directory, or should...

Re: What is accelerate_search vs search in _audit ...

Re: How to change the total disk space use in Splu...

Re: stats count by command missing number of resul...

Re: Troubleshooting DBConnect stop indexing data

Re: Help writting and fixing a rex query

Re: Details about all savedsearch that fire in a d...

Re: How do I resolve the following security issues...

Join the Conversation