still not coming  the file is text file as below and its under Program Files\Crestron\CCS400\User\Logs\ and want to ingest the file CCSFirmwareUpdate.txt   ... View more

issue there is a json data want to ingest in splunk as i have attached sample data but its getting all in one single event. how we can get as separate events after which is enclosed with { } ... View more

its less events only but field value not getting ... View more

individual search is working for below which extracts host_name field and joining with host_name field in search but getting error " Error in 'rex' command: Invalid argument: '('  index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" | rex field=hostname "(?<host_name>[^.]+)\." but its giving less results when using below search but individual search has many  here is the full query    index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" | rex field=hostname "(?<host_name>[^.]+)\." [ | table host_name, sourceIp ... View more

getting error  Error in 'search' command: Unable to parse the search: unbalanced parentheses using below search  index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" group=tcpin_connections [ search index="INDEX1" \ (puppet-agent OR puppet)) AND *Error* AND "/Stage[" | rename host AS hostname | fields hostname ] | table hostname sourceIp | dedup hostname     ... View more

Hai can you help with full query to get status if down   index=test_index host="test" (source=ps COMMAND=*cybAgent* OR COMMAND=*event_demon* OR COMMAND=*as_server*) | streamstats current=f last(PID) as lastPID by COMMAND ... View more

hi i have some process data in the source=ps  want to get status if down. i have observed it can be done using PID. for example one command ./cybAgent.bin  which is running with some PID and after stopped it and started it PID will change and new PID is showing in the splunk data but how we can determine when its stopped below are the events before and after restarted 10/20/23 12:07:31.000 PM root    6043    0.7    1.2    6769248    201544    ?    Ssl    Oct06    158:59    ./cybAgent.bin    -a host = testhost 10/20/23 12:07:02.000 PM root    6043    0.7    1.2    6769248    201544    ?    Ssl    Oct06    158:59    ./cybAgent.bin    -a host = testhost           10/20/23 3:50:30.000 PM root 20414 1.0 1.1 6766164 189864 ? Ssl 01:41 2:12 ./cybAgent.bin -a host = testhost 10/20/23 3:50:03.000 PM root 20414 0.9 1.1 6766164 189864 ? Ssl 01:41 2:11 ./cybAgent.bin -a host = testhost ... View more

This is not working, the second search has one field StatusDescription, i want to add this using common field Name and host in 1st search 1st search: ```Table on Dashboard = M3_PROD_splunk__agent__universal_forwarder_status_is_down``` index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" group=tcpin_connections os=Windows | dedup hostname | eval age=(now()-_time) | eval LastActiveTime=strftime(_time,"%y/%m/%d %H:%M:%S") | eval Status=if(age< 3600,"Running","DOWN") | rename age AS Age | eval Age=tostring(Age,"duration") | lookup 0010_Solarwinds_Nodes_Export Caption as hostname OUTPUT Application_Primary_Support_Group AS CMDB2_Application_Primary_Support_Group, Application_Primary AS CMDB2_Application_Primary, Support_Group AS CMDB2_Support_Group NodeID AS SW2_NodeID Enriched_SW AS Enriched_SW2 Environment AS CMDB2_Environment | eval Assign_To_Support_Group=if(Assign_To_Support_Group_Tag="CMDB_Support_Group", CMDB2_Support_Group, CMDB2_Application_Primary_Support_Group) | where Status="DOWN" AND NOT isnull(SW2_NodeID) AND (CMDB2_Environment="Production" OR CMDB2_Environment="PRODUCTION") ```| table _time, hostname,sourceIp, Status, LastActiveTime, Age, SW2_NodeID,Assign_To_Support_Group, CMDB2_Support_Group,CMDB2_Environment``` | table _time, hostname,sourceIp, Status, LastActiveTime, Age, Assign_To_Support_Group, CMDB2_Environment 2nd search : index=index_name sourcetype="nodes" | lookup lookupfile1 Name OUTPUTNEW | dedup Caption | table Caption StatusDescription UnManaged UnManageFrom UnManageUntil | search UnManaged=true | eval UnManageUntil = strftime(strptime(UnManageUntil, "%Y-%m-%dT%H:%M:%S.%QZ"), "%Y-%m-%d %H:%M:%S") | eval UnManageFrom = strftime(strptime(UnManageFrom, "%Y-%m-%dT%H:%M:%S.%QZ"), "%Y-%m-%d %H:%M:%S") | eval UnManageUntil = coalesce(UnManageUntil, "NOT SET") ```replaces any null values in the "UnManageUntil" field with NOT SET``` | sort -UnManageFrom ```sorts the events in descending order based on the "UnManageFrom" field``` ... View more

yes installed in the server but can we get the related to application services  ... View more

i have tried with appendcols command but not getting column from sub search  index=_internal sourcetype=splunkd source="/opt/splunk/var/log/splunk/metrics.log" group=tcpin_connections os=Windows | dedup hostname | eval age=(now()-_time) | eval LastActiveTime=strftime(_time,"%y/%m/%d %H:%M:%S") | eval Status=if(age< 3600,"Running","DOWN") | rename age AS Age | eval Age=tostring(Age,"duration") | lookup 0010_Solarwinds_Nodes_Export Caption as hostname OUTPUT Application_Primary_Support_Group AS CMDB2_Application_Primary_Support_Group, Application_Primary AS CMDB2_Application_Primary, Support_Group AS CMDB2_Support_Group NodeID AS SW2_NodeID Enriched_SW AS Enriched_SW2 Environment AS CMDB2_Environment | eval Assign_To_Support_Group=if(Assign_To_Support_Group_Tag="CMDB_Support_Group", CMDB2_Support_Group, CMDB2_Application_Primary_Support_Group) | table _time, hostname,Status, sourceIp, LastActiveTime, Age, SW2_NodeID, Assign_To_Support_Group, CMDB2_Support_Group, CMDB2_Environment | appendcols [search index=ivz_em_solarwinds source=solwarwinds_query://Solarwinds_PROD_unmanaged_Nodes_Data | table Node Account Status From Until | dedup Node] ... View more

not getting status field from 2nd search  Not showing any results. actually i want to add status column based on the 2nd search results in the first. if any hostname is matches with node name in the 2nd comun then it show the respective status or not there it show as null for status  ... View more

Not showing any results. actually i want to add status column based on the 2nd search results in the first. if any hostname is matches with node name in the 2nd comun then it show the respective status or not there it show as null for status  ... View more

how can i achieve to get offline status if more than 10 mins . because might be status will change for next update during data collection, if bot still in offline for 2 interval of time then need to get those results ... View more

no as per events i have if any BOT was offline for 2 consecutive times , which data was updated in for every 5 mins so for example if when got data for first run WHENEVER the BOT IS IN OFFLINE AND NEXT TIME ALSO WHEN DATA IS UPDATED SAME BOT IS OFFLINE THEN I WANT TO GET THOSE    ... View more

Hi Thanks. below are the events for one bot based on the search  it went offline at 9:00 (lastupdated) and if it was offline next run interval also then it will be helpfull to tigger alerts 8/25/23 2:50:01.811 PM 2023-08-25 04:20:01.811, BOT_Name="HOUVMITBPRSMX10:8001", lastupdated="2023-08-25 09:19:59.597", BOT_Status="Working" host = TEST source = testcourcesourcetype =testsoucetype linecount = 1punct = --_::.,_=":",_="--_::.",_=""source = BP_Botstatus_Newquerysourcetype = db:blueprism_bot statussplunk_server = idx-i-0ad81b0fe967c9831.invesco.splunkcloud.com 8/25/23 2:45:01.003 PM 2023-08-25 04:15:01.003, BOT_Name="HOUVMITBPRSMX10:8001", lastupdated="2023-08-25 09:14:59.183", BOT_Status="Working" host = TEST source = testcourcesourcetype =testsoucetype linecount = 1punct = --_::.,_=":",_="--_::.",_=""source = BP_Botstatus_Newquerysourcetype = db:blueprism_bot statussplunk_server = idx-i-06bd71cc08ca3fde6.invesco.splunkcloud.com 8/25/23 2:40:02.103 PM 2023-08-25 04:10:02.103, BOT_Name="HOUVMITBPRSMX10:8001", lastupdated="2023-08-25 09:09:59.897", BOT_Status="Idle" host = TEST source = testcourcesourcetype =testsoucetype linecount = 1punct = --_::.,_=":",_="--_::.",_=""source = BP_Botstatus_Newquerysourcetype = db:blueprism_bot statussplunk_server = idx-i-0b3fd3ab5272edbd5.invesco.splunkcloud.com 8/25/23 2:35:00.976 PM 2023-08-25 04:05:00.976, BOT_Name="HOUVMITBPRSMX10:8001", lastupdated="2023-08-25 09:00:13.993", BOT_Status="Offline" host = TEST source = testcourcesourcetype =testsoucetype linecount = 1punct = --_::.,_=":",_="--_::.",_=""source = BP_Botstatus_Newquery BOT_Name BOT_Status lastupdated lastoffline offlinecount HOUVMITBPRSMX10:8001 Working 2023-08-25 09:14:59.183 2023-08-25 09:00:13.993 1 ... View more

hi its giving as offline count but how it can help for if any BOT status stays in offline for 10 mins or more. this is the search results Sshowing only count of offline. BOT1:8001 Idle 2023-08-24 15:30:00.85 2023-08-24 11:00:13.787 3 BOT2:8001 Idle 2023-08-24 15:29:56.897 2023-08-24 13:20:12.517 3 BOT3:8001 Idle 2023-08-24 15:29:58.693 2023-08-24 09:02:12.413 4 BOT4:8001 Idle 2023-08-24 15:30:00.537 2023-08-24 08:20:13.363 2 BOT24:8001 Idle 2023-08-24 15:29:59.443 2023-08-24 08:20:11.957 1 BOT15:8001 Idle 2023-08-24 15:29:57.43 2023-08-24 06:22:22.057 5       ... View more