Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About vjsplunk
vjsplunk
Loves-to-Learn Everything
Member since:
04-12-2022
11-14-2024
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-12-2022 |
Activity Feed
- Posted Re: EXTRACT-field command is not working in Splunk cloud for props.conf file on Splunk Enterprise. 11-14-2024 12:43 AM
- Posted EXTRACT-field command is not working in Splunk cloud for props.conf file on Splunk Enterprise. 11-11-2024 10:03 PM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-23-2024 07:14 AM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-23-2024 06:25 AM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-23-2024 05:48 AM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-23-2024 05:24 AM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-22-2024 11:35 PM
- Posted Re: One Dashboard panel is not showing any results on Splunk Search. 09-22-2024 11:28 PM
- Posted One Dashboard panel is not showing any results on Splunk Search. 09-22-2024 09:41 PM
- Posted Logs from windows server are getting delayed to indexed in splunk on All Apps and Add-ons. 11-23-2022 08:47 PM
- Posted Re: Why am I receiving fewer events when using rename command in Splunk? on Splunk Search. 10-25-2022 08:00 AM
- Posted Why am I receiving fewer events when using rename command in Splunk? on Splunk Search. 10-25-2022 07:43 AM
- Posted How to resolve this error on search head: The metric> value=0.00003393234971117585 provided> on Splunk Search. 08-01-2022 12:07 AM
- Posted Is there any reason why syntax highlighting is not working by default for splunk logs? on Splunk Search. 07-11-2022 11:19 PM
- Posted Re: Mapping index to another index on Splunk Search. 05-13-2022 05:02 AM
- Posted Re: Mapping index to another index on Splunk Search. 05-13-2022 04:52 AM
- Posted Re: Mapping index to another index on Splunk Search. 05-10-2022 09:27 PM
- Posted Is it possible to map one index to another index? on Splunk Search. 05-10-2022 09:14 PM
- Tagged Is it possible to map one index to another index? on Splunk Search. 05-10-2022 09:14 PM
- Posted Re: Timestamp Parsing on Splunk Search. 04-12-2022 11:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-14-2024
12:43 AM
Sample logs looks like this: adshdsfkdlfpofgsk message hdksodb Stage=8 gjhjyeomhf hjhdgy … I deployed the configurations in the cloud instance from the settings > sourcetypes option.
... View more
11-11-2024
10:03 PM
I am trying to add an EXTRACT-field command in Splunk cloud. I added the regex, it is working in search and capturing the value. But the field is not populating when applied to the props.conf file. The value I want to extract is "Stage=number". The regex I created is:
EXTRACT-Stage = Stage=(?<Stage>\d+)
What could be the reason?
... View more
Labels
- Labels:
-
splunk-assist
-
troubleshooting
09-23-2024
07:14 AM
Found the issue. It was because I am not using null values before the transforming command
... View more
09-23-2024
06:25 AM
Chart also not giving the results
... View more
09-23-2024
05:48 AM
index="test" source="test2" "REPORT RequestId: "| eval Latency = rex(***) |xyseries avg(Latency) as avg_Latency over _time by useragent
... View more
09-23-2024
05:24 AM
I am using an xyseries command after the filtering commands it is not giving any results.
... View more
09-22-2024
11:35 PM
Yes. If I open the panel from "Open in Search" it is giving the results.
... View more
09-22-2024
11:28 PM
Yes. If I open the panel from "Open in Search" it is giving the results.
... View more
09-22-2024
09:41 PM
One of my dashboard panel is not showing any results. But when I run the search manually it is giving results. Out of 8 panels only one panel is having the issue. I am not using base searches.
... View more
Labels
- Labels:
-
timechart
11-23-2022
08:47 PM
Logs from windows server are getting delayed to indexed in splunk. Noticed the below error in plunked.log in the windows server. — ERROR [MethodServerMonitor] wt.manager.ServerTable - Dead MethodServer reported; reported exception -- Any thoughts?
... View more
Labels
- Labels:
-
search
10-25-2022
08:00 AM
Without rename: index="A" sourcetype="B" | stats values(project_name2), count(linecount) by pod | sort - count(linecount) | head 10 With rename: index="A" sourcetype="B" | stats values(project_name2) as project count(linecount) as lines by pod | sort - count(linecount) | head 10
... View more
10-25-2022
07:43 AM
I am getting fewer events when using rename command in splunk. ( Compared to the search where I haven't used rename). What could be the reason behind this?
... View more
08-01-2022
12:07 AM
Got this error on the search head, Please help us to resolve this .
> Search peer xxxxxx has the following> message: The metric> value=0.00003393234971117585 provided> for > source=/opt/splunkforwarder/var/log/splunk/metrics.log,> sourcetype=splunk_metrics_log,> host=xxxxx, index=_metrics is not a> floating point value. Using a> "numeric" type rather than a "string"> type is recommended to avoid indexing> inefficiencies. Ensure the metric> value is provided as a floating point> number and not as a string. For> instance, provide 123.001 rather than> "123.001"
... View more
Labels
- Labels:
-
metadata
07-11-2022
11:19 PM
Is there any reason why syntax highlighting is not working by default for splunk logs?. While clicking on the Syntax hightlight option I am getting the logs Highlighted.
... View more
Labels
- Labels:
-
search job inspector
05-13-2022
05:02 AM
Thank you. This is for mapping one prod index to another prod index
... View more
05-13-2022
04:52 AM
I haven't find any documents for mapping one index to another via summery index..Can you gave the documents or process
... View more
04-12-2022
11:11 PM
Thank you. These are the sample lines: ======== Sat Mar 19 16:33:08 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_44388_20220319163308485740872483.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.14.0.0.0 Sat Mar 19 15:25:42 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_4908_20220319152542116439456508.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production ==============
... View more
04-12-2022
11:01 PM
Yes. I have applied the below 2 rules: LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true Line breaking is proper. Not sure it is showing the error
... View more
04-12-2022
10:03 PM
I am trying to set timestamp for the event :
========
Sat Mar 19 16:33:08 2022 -05:00
LENGTH : '228'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
=========
The rules I used are:
TIME_FORMAT = %a %b %d %H:%M:%S %Y %:z
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 32
It is catching the timestamp correctly. However showing the error "could not use strptime to parse timestamp from LENGTH : '228' "
I am not sure how to resolve the error.
... View more
Labels
- Labels:
-
metadata
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-14-2024
01:22 AM
|
