About saty586

saty586

Thanks @96nick But is it possible to filter out 2 events out of 10 events present in same file in a bucket. For example - I have only 1 file in the bucket - "xyz.txt" Content of xyz.txt event_id flag user_id U123 Y 123 I123 N 101 U125 Y 234 is it possible to ingest only rows with flag with value "Y" in splunk . using regex in blacklist option?

saty586

Trying to get a part of file in S3 into Splunk. Can i use blacklist option to filter out part of file and ingest rest of data in Splunk?

saty586

I am quite new to the Splunk currently Working on getting data from S3 file into Splunk. File Constraints -> 1) File will be replaced daily with updated file having previous and new data. 2) there will be field with - timestamp that can be used to find out which rows are new or updated. Is it possible to configure splunk to get only new data from that file on daily basis. What configuration needs to be updated.

saty586

Jobs Running on daily basis. Events like- 1) " Job_Name " : "XYZ ", " status " : " Start " 2) " Job_Name " : "XYZ ", " status " : " SUCCESS " 3) " Job_Name " : "XYZ", " status " : " Failure " Need to calculate and display the job run time and status on dashboard for multiple days/runs. Below query works well for single run but for multiple run runtime is not getting calculated. search to fetch both "job started" and "job finished" events | eval eventType=if(searchmatch("job started"),"Start","End") | chart values(_time) over Job_Name by eventType | eval jobduration=End-Start

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎04-02-2021

Online Status	Offline
Date Last Visited	Thursday

Getting Data in from S3 : Blacklist option

Splunk Input from S3

Find Job Duration from two separate events.

Re: Getting Data in from S3 : Blacklist option

Getting Data in from S3 : Blacklist option

Splunk Input from S3

Find Job Duration from two separate events.