Hi Need help to fix the below error  My Props : Sample events:   ... View more

Hello Need some help to fix the below error 03-14-2014 17:11:49.108 -0300 ERROR LineBreakingProcessor - Line breaking regex has no capturing groups: ^\{ - data_source=.......... My props: [source::abc] disabled=false pulldown_type=true TRUNCATE=25000 TIME_PREFIX="timestamp"\s* :\s*" LINE_BREAKER=^\{ BREAK_ONLY_BEFORE=^{ CHARSET=UTF-8 SHOULD_LINEMERGE=true category=Custom pulldown=true Sample log:   { "maexUniqueld": "414D51204D4532352020202020202020B3A95C64016F0040", "mgexEventCommon": { "examgr": "ME25", "exreason": "CHLSTPU", "extype": "CHANNEL", "evobjname": "DIRECT.TCP", "exobjtype": "CHANNEL", "evuserid":"", "summary": "Channel - Stopped by User - Channel:DIRECT.TCP", "cfbcmd": 46, "cfhreason": 2279, "extime": "2023-05-11T08:39:23Z", "extimesecs": 1683794363 }, "mgexData": { "channel": "DIRECT.TCP", "csnqual": 10 } ... View more

Hello Need some help on below issue. 05-11-2023 07:01:23:156 -0400 ERROR LineBreakingProcessor [1956104 parsing_3] - Line breaking regex has no capturing groups: ^\{ - data_source="D:\Apps.......TXT", ..... My Props : LINE BREAKER=^\{ NO BINARY CHECK-true BREAK ONLY_BEFORE=^\{ CHARSET=UTF-8 disabled=false KV MODE=json MAX TIMESTAMP LOOKAHEAD=70 TIME PREFIX=timeStamplevtime"\: \s*"  TIME FORMAT=%Y-%m-%dT%I:%M:%S TRUNCATE=999999   Sample logs : { "maexUniqueld": "414D51204D4532352020202020202020B3A95C64016F0040", "mgexEventCommon": { "examgr": "ME25", "exreason": "CHLSTPU", "extype": "CHANNEL", "evobjname": "DIRECT.TCP", "exobjtype": "CHANNEL", "evuserid":"", "summary": "Channel - Stopped by User - Channel:DIRECT.TCP", "cfbcmd": 46, "cfhreason": 2279, "extime": "2023-05-11T08:39:23Z", "extimesecs": 1683794363 }, "mgexData": { "channe l": "DIRECT.TCP", "csnqual": 10 } ... View more

We are facing data quality issue  Sample internal log: WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (40) characters of event. Defaulting to timestamp of previous event (Thu May 4 13:02:33 2023).  I saw some different kind of logs are reporting to production splunk Sample log of production: ++++++++++++++++++++++++++++++++++++++++++++++++ + New app   'esign-ec-api'                                                    + ++++++++++++++++++++++++++++++++++++++++++++++ + Initializing app  'esign-ec-api'                                                    + ++++++++++++++++++++++++++++++++++++++++++++++ Pinging the JVM took 7 seconds to respond. ++++++++++++++++++++++++++++++++++++++++++++++ + starting app  'esign-ec-api'                                                    + ++++++++++++++++++++++++++++++++++++++++++++++ [props] Charset=UTF-8 TIME_PREFIX=^\w{4,7}\s+ TIME_FORMAT=%Y-%m-%d %H.%M.%S,%3N MAX_TIMESTAMP_LOOKAHEAD=40 SHOULD_LINEMERGE=false NO_BINARY_CHECK=true TRUNCATE=50000 Pulldown_Type=True LINE_BREAKER=([\r\n])\w+\s+\d+\-\d+\-\d+\s\d+\:\d+\:\d+ EXTRACT-field1=regex EXTRACT-field2=regex Thank You ... View more

Hi, This is the log sent from Docker ("log":"[21:52:02] [/home/a143519/.local/share/code-server/extensions/ms-toolsai.jupyter-2021.9.1303320346]: Extension is not compatible with Code 1.66.2. Extension requires: 1.72.0.\n","stream":"stderr","time":"2023-03-06T21:52:02.2194402152"}{"log":"[21:52:02] [/home/a15 3509/.local/share/code-server/extensions/ms-python.vscode-pylance-2023. 1.10]: Extension is not compatible with Code 1.66.2. Extension req uires: 1.67.0.\n", "stream":"stderr","time": "2023-03-06T21:52:02.219891147Z")("log": "[21:52:02] [\u009cunknown\u009e][80d9f7e6][Extension HostConnection] New connection established.\n","stream":"stdout","time":"2023-03-06T21:52:02.604222684Z"){"log":"[21:52:02] [\u009cunknow n\u009e][80d9f7e6][ExtensionHostConnection] \u003c1453\u009e Launched Extension Host Process. \n","stream":"stdout","time":"2023-03-06T21: 52:02.617643295Z"]["log": "[IPC Library: Pty Host] INFO Persistent process "1": Replaying 505 chars and 1 size events\n","stream":"stdo ut", "time":"2023-03-06T21:52:06.9270320622"} ["log":"[IPC Library: Pty Host] WARN Shell integration cannot be enabled for executable \"/b in/bash and args undefined\n", "stream":"stdout","time":"2023-03-06T21:52:56.754368802Z"}{ log":"[21:57:00] [\u009cunknown\u009e][laf3f4 9a][ExtensionHostConnection] \u007c766\u007e Extension Host Process exited with code: 0, signal: null.\n","stream"stdout", "time":"2023- 03-06T21:57:00 839878031Z"}"log" [02:12:50] [\u009cunknown\u009e][abc26d01][ManagementConnection] The client has disconnected, will wai t for reconnection 3h before disposing...\n","stream":"stdout, "time":"2023-03-07T04:12:50. 7892655182")("log":"[05:12:59] [\u007cunknown \u007e][abf26c01][ManagementConnection] The reconnection grace time of 3h has expired, so the connection will be disposed. \n", "stream":"s tdout","time":"2023-03-07T05:12:59.567198587Z" log":[13:16:53] [\u003cunknown\u003e][adf26d01][ManagementConnection] Unknown reconnect ion token (seen before) \n","stream":"stderr","time":"2023-03-07T13:17:53 2951627292")("log":"[14:16:53] [\u003cunknown\u003e][90d9f9e6] [ExtensionHostConnection] The client has reconnected. \n","stream":"stdout", "time": "2023-03-07T13: 16:53.453120386Z") Here is my props.conf :   auto learned SHOULD LINEMERGE=false LINE BREAKER=([\n\r]+)\s*("log":"{\n NO BINARY CHECK-true TIME PREFIX="time" MAX TIMESTAMP LOOKAHEAD=48 TIME FORMAT=%Y-%m-%dT%H:%M:%S.9N%z TRUNCATE=999999 CHARSET=UTF-8 KV MODE=json ANNOTATE POINT=false   I have tried many different props.conf. Configurations but no luck. Any help would be greatly appreciated! ... View more

Hi I want to write the props for below logs. Actually the logs are coming with no timestamp and the file name having the timestamp.  These are the logs: Message Is: https POST failed: . Status Is: Ok Message Is: https POST successful: 200. Status Is: Ok Changed .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac Unable to change .Pac File to http://liteway.prog2.com/proxyins/proxy_client.oac File name coming like  zscalerhttp_2023-01-09-18-03-25 Can anyone help to write the props for this logs..    ... View more

Hi  I want to create log level field for info logs.It should show the status information .  For example the field name status, the field should show the, okay count, information count, etc count. Please find the logs below  Status: INFORMATION: Description: Beginning GDP Fransaction Script: 01-22-2023-01-13-04-PM Status: INFORMATION: Description: txt file already exists Status: INFORMATION: Description: csv file already exists Status: OK: Description: C:\GDPFransactionScript\Inputs \GDPTestFile.csv copy to USB successful Status: OK: Description: C:\GDPTransactionScript\Inputs \GDPTestFile.txt copy to USB successful Status: ERROR: Description: http POST failed: Status: ERROR: Description: https POST failed: Status: INFORMATION: Description: End of GDP Transaction Script: 01-22-2023-01-13-04-PM ... View more

I have below logs  Status: INFORMATION: Description: Beginning GDP Fransaction Script: 01-22-2023-01-13-04-PM Status: INFORMATION: Description: txt file already exists Status: INFORMATION: Description: csv file already exists Status: OK: Description: C:\GDPFransactionScript\Inputs \GDPTestFile.csv copy to USB successful Status: OK: Description: C:\GDPTransactionScript\Inputs \GDPTestFile.txt copy to USB successful Status: ERROR: Description: http POST failed: Status: ERROR: Description: https POST failed: Status: INFORMATION: Description: End of GDP Transaction Script: 01-22-2023-01-13-04-PM   I have mentioned in my props  CHARSET=AUTO SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\Status NO_BINARY_CHECK=true disabled=false TIME_PREFIX=^ But i am seeing error like failed to parse timestamp. Default to file modtime How to resolve this issue   ... View more

Hi Everyone, We need a PAM server logs without installing any third-party app in Pam server. Is it possible to do the monitoring without installing the Third-party app ??   Regards, Jack  ... View more

I want to track multiple ORA numbers, we received different format logs as below, can you help me to write a query for this.   Logs/Events:   2022-08-04T06 : 55 : 54.009110 + 01 : 00 opiodr aborting process unknown ospid ( 8696 ) as a result of ORA - 609 2022-08-04T06 : 51 : 54.137474 + 01 : 00 WARNING : inbound connection timed out ( ORA - 3136 ) ... View more

Hi Team, We are unable to get the alert emails even when the events matching the alert condition is present in Splunk cloud. Please help how we can resolve this? ... View more

Can't find splunk enterprise rpm 7.2.6 version  download link. So if anyone can show me where can I download the 7.2 .6 version. I will be grateful    ... View more