×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
saty586
Explorer
Member since: ‎04-02-2021
‎04-08-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎04-02-2021
Activity Feed
View All

Re: Getting Data in from S3 : Blacklist option

by in Getting Data In
‎04-08-2021 08:34 AM
‎04-08-2021 08:34 AM
Thanks @96nick  But is it possible to filter out 2 events out of 10 events present in same file in a bucket. For example - I have only 1 file in the bucket - "xyz.txt" Content of xyz.txt event_id    flag     user_id U123           Y              123 I123             N              101 U125           Y                234 is it possible to ingest only rows with   flag with value "Y" in splunk . using regex in blacklist option? ... View more

Getting Data in from S3 : Blacklist option

by in Getting Data In
‎04-08-2021 06:36 AM
‎04-08-2021 06:36 AM
Trying to get a part of file in S3 into Splunk. Can i use blacklist option to filter out part of file and ingest rest of data in Splunk? ... View more

Splunk Input from S3

by in Getting Data In
‎04-06-2021 05:13 AM
‎04-06-2021 05:13 AM
I am quite new to the Splunk currently Working on getting data from S3 file into Splunk. File Constraints -> 1) File will be replaced daily with updated file having previous and new data. 2) there will be field with - timestamp that can be used to find out which rows are new or updated.   Is it possible to configure splunk to get only new data from that file on daily basis. What configuration needs to be updated.   ... View more

Find Job Duration from two separate events.

by in Splunk Search
‎04-02-2021 04:08 AM
‎04-02-2021 04:08 AM
Jobs Running on daily basis. Events like- 1) "Job_Name": "XYZ", "status":" Start" 2) "Job_Name": "XYZ", "status":" SUCCESS" 3) "Job_Name": "XYZ", "status":" Failure" Need to calculate and display the job run time  and status on dashboard for multiple days/runs. Below query works well for single run but for multiple run runtime is not getting calculated. search to fetch both "job started" and "job finished" events | eval eventType=if(searchmatch("job started"),"Start","End") | chart values(_time) over Job_Name by eventType | eval jobduration=End-Start   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-08-2021 03:04 PM
Karma given to
View All