About super_saiyan

super_saiyan · ‎11-25-2022

Hi, I have shared the logs with you in DM

super_saiyan · ‎11-25-2022

anyone ?

super_saiyan · ‎11-21-2022

Thanks much @kamlesh_vaghela I have shared the logs in DM, please check

super_saiyan · ‎11-21-2022

Hi everyone, currently, i am trying to expand one of the multiple field values but i am getting the result with the below error. Field 'deployment' does not exist in the data. index=json |rex mode=sed "s/.*-\s//g" |spath |rename ops{}.steps{}.steps{}.address{}.deployment as deployment |mvexpand deployment |mvexpand operation |table deployment

super_saiyan · ‎10-17-2022

How do i replace the Hyphen with dot. For example i have a field call IP and the value are 10-20-11-120 but i want to convert this to 10.20.11.120. I have tried the | rex mode=sed but it's only replacing the first hyphen with dot. Please refer to my below SPL SPL | makeresults | eval IP="10-20-11-120" | rex mode=sed field=IP "s/-/./"

super_saiyan · ‎10-12-2022

Hi everyone, New splunker here. I want to use WMI to collect windows event logs from different windows server instead of splunk forwarder. is it doable ? if yes, please provide steps how to collect logs remotely and send it to splunk ? What pull method do i need to use from splunk UI OR do i need to use Push method?

super_saiyan · ‎10-07-2022

But there is only one problem. I am getting multiple comments values in a single table events. Can we segregate that as well ? @kamlesh_vaghela

super_saiyan · ‎10-07-2022

Are you a magician? Because your magic spell(SPL) actually worked without giving any errors. Thanks much

super_saiyan · ‎10-07-2022

Hi Splunkers, There is one field is common in 2 indexes. Using that field how can i co-relate and make a table out of it without using JOIN, Append & Appendpipe command ? Because those command will take a lot of time and Please refer to the below pictures Thanks & regards

super_saiyan · ‎09-15-2022

Hi @richgalloway Many thanks for your quick response. Below is my props.conf TIME_PREFIX = (Sun|Mon|Tue|Wed|Thu|Fri|Sat)\s TIME_FORMAT = %b %d %H:%M NO_BINARY_CHECK = true SHOULD_LINEMERGE = false

super_saiyan · ‎09-15-2022

I've deployed below props to extract the time splunk. There are WARN messages in splunkd logs as follows DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (12) characters of event. Defaulting to timestamp of previous event. please refer to the below log Hounsaya add_user 4 Thu Sep 15 10:09 - 26:39 (60+00:47) Can you please help and let me know if i need to make any changes?

super_saiyan · ‎08-23-2022

Every time i run a specific SPL query( can not reveal due to some security process ). I am getting the below error. Currently displaying the recent 1000 events in the select range .Select a narrow range or zoom in to see more events. Please help me resolve this issue. Please provide splunk documentation if any.

super_saiyan · ‎08-18-2022

Hello Splunkers, How to check when splunk's automatic processing has been executed ? for example:- 1.scheduled processing 2.real-time processing

super_saiyan · ‎08-14-2022

While using the mvexpand command, i am getting the below error. ERROR - command.mvexpand: output will be truncated at 1000 results due to excessive memory usage. Memory threshold of 500 MB as configured in limits.conf /[mvexpand]/max_mem_usage_mb has been reached. Question 1- How can i resolve the above error ? Question 2 - Is there any other alternative command of mvexpand ?

super_saiyan · ‎07-28-2022

Thanks for your quick response @somesoni2 could you please also provide the spl using "isnull" ? Really appreciate your support.

super_saiyan · ‎07-28-2022

I am getting error while using the below SPL Query Could you please help me with that ? appreciate your help.

super_saiyan · ‎07-28-2022

Hi splunkers, I want to use "null" command in below query. If the message is "null" then it should replace with the below message otherwise it should only display the already extracted message. | eval message= if(Actor="superman","super hero", if(Actor="emma watson","model")) Thanks.

super_saiyan · ‎07-15-2022

Thank you for your quick response. could you please share some insights regarding " DailyRollingFileAppender" ?

super_saiyan · ‎07-15-2022

is it possible to change the log rotation timing for the internal logs that Universal Forwarder and Heavy Forwarder output to the OS. For example, splunkd.log. Currently, the logs are rotated by file size, but can we rotate on a daily basis. is it possible ?

super_saiyan · ‎07-15-2022

i am not having any performance issue. i am just curious if i can optimize the performance more by doing some changes in setting in os kernal level.

Posts	67
Solutions	0
Karma Given	48
Karma Received	0
Member Since	‎03-31-2022

Online Status	Offline
Date Last Visited	‎12-14-2022 12:40 AM

Receiving an error while using the mvexpand comman...

How to manipulate field values in raw log?

Is it possible to use WMI to collect windows event...

How to include two index events without using JOIN...

How do I fix this : Failed to parse timestamp in f...

How to resolve this error: Currently displaying th...

How to check when splunk's automatic processing is...

Receiving error while using mvexpand

Help with if "null" command

Is it possible to change rotation timing for the i...

Re: Receiving an error while using the mvexpand co...

Re: Receiving an error while using the mvexpand co...

Re: getting an error while using the mvexpand comm...