About power12

power12 · ‎06-10-2024

I have a search that outputs the hostlist by test. index=abc | stats count by host test | stats count as total_count values(host) as host_list by test which gives me list of hosts by test like below test host_list new abc0002 abc0003 abc0004 abc0005 abc0006 abc0007 abc0008 abc0009 abc0010 abc0011 abc0012 abc0013 abc0014 abc0015 abc0016 abc0017 abc0018 abc0019 abc0020 abc0022 abc0024 abc0025 abc0026 abc0027 abc0028 abc0029 abc0031 II would like to group the range of host like [abc0002-abc0020] [abc0022] [abc0024-abc0029] [abc0031] instead of the whole list by test like below image test host_list host_array new abc0002 abc0003 abc0004 abc0005 abc0006 abc0007 abc0008 abc0009 abc0010 abc0011 abc0012 abc0013 abc0014 abc0015 abc0016 abc0017 abc0018 abc0019 abc0020 abc0022 abc0024 abc0025 abc0026 abc0027 abc0028 abc0029 abc0031 [abc0002-abc0020] [abc0022] [abc0024-abc0029] [abc0031] Thank you in Advance Splunkers

power12 · ‎05-17-2024

anyone faced this issues?

power12 · ‎05-16-2024

Hello , i have logs in following path /abc-logs/hosta/mods/stdout.240513-070854 /abc-logs/hostb/mods/stdout.240513-070854 /abc-logs/hostc/mods/stdout.240513-070854 /abc-logs/hostd.a.clusters.abc.com/mods/stdout.240206-084344 /abc-logs/hoste/mods/stdout.240513-070854 when I am trying monitor this path to get logs into splunk .I only get two files .when checked internal logs i see following errors 05-16-2024 10:07:25.609 -0700 ERROR TailReader [1846912 tailreader0] - File will not be read, is too small to match seekptr checksum (file=/abc-logs/hosta/mods/stdout.240513-070854). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. A possible timestamp match (Fri Feb 13 15:31:30 2009) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: FileClassifier C:\abc-logs\hostd.a.clusters.abc.com\mods\stdout.240206-084344 I am using below props [ mods ] BREAK_ONLY_BEFORE_DATE=null CHARSET=AUTO CHECK_METHOD=entire_md5 DATETIME_CONFIG=CURRENT LINE_BREAKER=([\r\n]+) MAX_DAYS_AGO =2000 MAX_DAYS_HENCE=365 NO_BINARY_CHECK=true SHOULD_LINEMERGE=false category=Custom crcSalt=<SOURCE> initCrcLength = 1048576 i tried changing the CHECK_METHOD to other options but it did not work Thanks in advance

power12 · ‎03-21-2024

Is there way to change the permissions of all lookups in a app

power12 · ‎03-13-2024

Can we ingest these logs?

power12 · ‎03-12-2024

I have .gz syslog files but I am unable to fetch all files For each host(abc) it has 23 .tgz files with extension like syslog.log1.gz until syslog.log.24.gz ...I only see the one with 24 ingested but not others ..for all others in internal logs I see "was already indexed as a non-archive, skipping" Log path /ad/logs/abc/syslog/syslog.log.24.gz Internal logs : 03-12-2024 14:59:59.590 -0700 INFO ArchiveProcessor [1944346 archivereader] - Archive with path="/ad/logs/abc/syslog/syslog.log.2.gz" was already indexed as a non-archive, skipping. 03-12-2024 14:59:59.590 -0700 INFO ArchiveProcessor [1944346 archivereader] - Finished processing file '/ad/logs/abc/syslog/syslog.log.2.gz', removing from stats> Should I try crcsalt or crclength ?

power12 · ‎03-12-2024

I have single instance splunk environment where the license is 100 gb there is another single instance using the same license .and we get data every day around 6 GB both combined . Instance A is very fast but instance B is very slow .(both have same resources) All searches and dashboards are really slow .For instance if I run a search to do a simple stats for 24 hrs ..it takes 25 seconds when compared to the other one which takes 2 seconds .I checked the job inspection which was showing dispatch.evaluate.search = 12.84 dispatch.fetch.rcp.phase_0 =7.78 I want to know where should I start checking on the host and what are the steps to be taken

power12 · ‎03-08-2024

@bowesmana that worked thank you

power12 · ‎03-04-2024

I have a query where I am counting the PASS and fail and displaying it as a pie-chart.Also I modified the search so that it displays the count and status .When the status field which has pass and fail values the pie chart displays green for pass and red for fail as expected but when there is only pass it displays red not green Attached is the screenshot <chart> <search> <query>index="abc" | rex field=source "ame\/(?<Type>[^\/]+)" |search Type=$tok_type$ | rex field=_raw "(?i)^[^ ]* (?P<status>.+)" | stats latest(status) as status by host | stats count by status | eval chart = count + " " + status | fields chart, count</query> <earliest>$tok_time.earliest$</earliest> <latest>$tok_time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> <option name="charting.legend.labels">[FAIL,PASS]</option> <option name="charting.seriesColors">[#BA0F30,#116530]</option> <option name="refresh.display">progressbar</option> <option name="charting.chart.showPercent">true</option> </chart> Thanks in Advance

power12 · ‎02-28-2024

Thank You @victor_menezes .I tried below and it worked . | eval _time = strptime(replace(source, ".*(\d\d\d\d-\d\d-\d\d\_\d\d-\d\d-\d\d).*","\1"),"%Y-%m-%d_%H-%M-%S")

power12 · ‎02-27-2024

I have the following source .I want to extract time from source when data is ingesting source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log" in props TRANSFORMS-set_time =source_path_time In transforms [set_time_from_file_path] INGEST_EVAL = | eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S") I tried testing it but I am unable to get the _time | makeresults | eval source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log" | fields - _time ``` above set test data ``` | eval _time = strptime(replace(source, ".*/compute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S") Thanks in Advance

power12 · ‎02-23-2024

I have the following sample events coming from source="/project/admin/git/ys/es/perf/de/pure/abc0*/logs/*/results.csv" Event1: with no timestamp and these type of data is in files which are 2 days older abc|pxyz|0.1054|ops|0|null|null Event 2 with timestamp --these are new files from same location and going forward the data would be the same as below 2024-02-23T00:48:17|AID|read|454482.351348|PS|0|null|null I want to send data to splunk that has a timestamp and send the other to null queue or not to ingest it . Firstly I tried MAX_DAYS_AGO=2 which did not work then I tried the following props and transforms but it did not work . transforms [filter] REGEX = ^^\D* DEST_KEY = queue FORMAT = nullQueue props.conf CHARSET=AUTO SHOULD_LINEMERGE=false category=Custom disabled=false pulldown_type=true TRANSFORMS-null=filter Thanks in Advance

power12 · ‎08-03-2023

This worked. <html> <style> #myTable th:first-child,td:first-child { left:0; z-index: 9999; position: sticky; } #myTable th:nth-child(2), td:nth-child(2){ left: 110px !important; position: sticky; z-index: 9998; } </style> </html>

power12 · ‎08-03-2023

@ITWhisperer I tried the code but while scrolling I see only second column moving to right while scrolling to right

power12 · ‎08-02-2023

I am trying to make first two columns of a table output to be sticky...I can do one by using <html> <style> #myTable th:first-child,td:first-child { left:0; z-index: 9999; position: sticky; } The above code works for one column on the left..But I want two to be sticky

power12 · ‎08-02-2023

Does anyone have any idea on how to do it?

power12 · ‎07-28-2023

Hello Splunkers , I have created a script and places in <splunk_home>/etc/apps/search/bin/seq.py Below is the script for it import splunklib.client as client # Splunk connection details HOST = "localhost" PORT = 8089 USERNAME = "admin" PASSWORD = "changeme" # Create a Splunk service instance service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD ) # List of specific saved searches to run in sequence saved_searches_to_run = ['List of Indexes', 'List of Source Types', 'List of Sources'] # Function to run a saved search def run_saved_search(saved_search_name): saved_search = service.saved_searches[saved_search_name] job = saved_search.dispatch() while not job.is_done(): pass # Wait for the job to complete # Process the search results here results = job.results() # Print the raw search results print(f"Search results for {saved_search_name}:") for result in results: print(result) print() # Run the specific saved searches in sequence for saved_search_name in saved_searches_to_run: print("Running saved search:", saved_search_name) run_saved_search(saved_search_name) print("Completed saved search:", saved_search_name) print() I places the command <splunk_home>/etc/apps/search/local/commands.conf [seq] filename=seq.py But when I ran the command in splunk as |seq It returns error code External search command 'seq' returned error code 1. . This sample code works correctly with |test import sys import splunk.Intersplunk # Read parameters name_prefix = sys.argv[1] # Output data should be a list of dictionary like this data = [{'name': 'xyz', 'age': 23}, {'name': 'abc', 'age': 24}] # Corrected the syntax for record in data: record['name'] = name_prefix + record['name'] # Use the `outputResults` function from `splunk.Intersplunk` to send the data back to Splunk splunk.Intersplunk.outputResults(data) Should splunk SDK be installed? This is a single instance splunk

power12 · ‎06-29-2023

Ya even tried that but somehow it says "could not use regex to parse timestamp from source::source::C:\Users\vv\OneDrive-xx\Pictures\svc-logs\hostabc\mods\stdou."

power12 · ‎06-29-2023

I can try that but I am testing on my windows local splunk installed trying to do the same from C:\Users\vv\OneDrive-xx\Pictures\svc-logs\hostabc\mods\stdout.230629-081216.txt for this I changed it to [set_time_from_source_path] INGEST_EVAL = _time = strptime(replace(source, ".*\\stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") This also did not work. I am assuming something with "20\1"..how do we change that..Can you please let me know what should be changed for this case

power12 · ‎06-29-2023

In the regex its looking for .*/stdout so even if its _ or . ..it matches everything until stdout right INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S")

power12 · ‎06-29-2023

Yes...I did restart splunk after applying that...I tried mimicking the same on my local. I went to my local (C:\Program Files\Splunk\etc\apps\search\local) where I set the transforms to be [set_time_from_source_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") and in the props. [sourcetime] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom disabled = false pulldown_type = true TRANSFORMS-set_time = set_time_from_source_path Restarted> Then from WEB UI--->ADD DATA -->SELECTED FILE (_svc-logs_hostbac_mods_stdout.230629-053900) -->selected sourcetype (sourcetime) to see the preview I get errors(attached) that its failed to parse time

power12 · ‎06-29-2023

I tried this as well [< sourcetype name>] TRANSFORMS-set_time = set_time_from_file_path Added below in transforms.conf [set_time_from_file_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") Should we have the "set_time" extension after the TRANSFORMS

power12 · ‎06-28-2023

@isoutamo I Added below conf...but somehow the data still did not take the source path time.Is there other steps I need to add props.conf [< sourcetype name>] TRANSFORMS-set_time = set_time_from_source_path Added below in transforms.conf [set_time_from_file_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S")

power12 · ‎06-27-2023

Thank you it worked

power12 · ‎06-27-2023

I get the below | makeresults | eval source="/svc-logs/hostabc/mods/stdout.230626-203719" ``` above set test data ``` | eval _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%y%m%d-%H%M%S")

Posts	87
Solutions	2
Karma Given	9
Karma Received	2
Member Since	‎10-11-2021

Online Status	Offline
Date Last Visited	‎06-10-2024 08:45 PM

How can I add list of field values into an array

Seeing checksum errors when on-boarding data

change bulk permissions of lookup in a app

Cant ingest .gz syslog files - was already indexed...

Searches taking long time to show results

Pie chart colors not changing when only one value

Use source path time when ingesting data

Send events to null queue which dont have time

How to make first two columns and header of those ...

How run python script as command?

How can I add list of field values into an array

Re: Seeing checksum errors when on-boarding data

Seeing checksum errors when on-boarding data

change bulk permissions of lookup in a app

Re: Cant ingest .gz syslog files - was already ind...

Cant ingest .gz syslog files - was already indexed...

Searches taking long time to show results

Re: Pie chart colors not changing when only one va...

Pie chart colors not changing when only one value

Re: Use source path time when ingesting data

Use source path time when ingesting data

Send events to null queue which dont have time

Re: How to make first two columns and header of th...

Re: How to make first two columns and header of th...

How to make first two columns and header of those ...

Re: How run python script as command?

How run python script as command?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?