Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About yohhpark
yohhpark
Path Finder
Member since:
07-07-2022
10-20-2023
Community Statistics
| Posts | 40 |
| Solutions | 0 |
| Karma Given | 16 |
| Karma Received | 0 |
| Member Since | 07-07-2022 |
Activity Feed
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-20-2023 04:58 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 09:46 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 08:49 AM
- Karma Re: value appearing twice for JSON, none of the old answers work for snethala_splunk. 10-18-2023 08:47 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 08:42 AM
- Karma Re: value appearing twice for JSON, none of the old answers work for snethala_splunk. 10-18-2023 08:42 AM
- Karma Re: value appearing twice for JSON, none of the old answers work for snethala_splunk. 10-18-2023 08:42 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 08:26 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 07:15 AM
- Tagged Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 07:15 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-18-2023 06:57 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-16-2023 01:32 PM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-16-2023 10:44 AM
- Posted Re: value appearing twice for JSON, none of the old answers work on Getting Data In. 10-16-2023 10:02 AM
- Posted value appearing twice for JSON, none of the old answers work on Getting Data In. 10-16-2023 09:16 AM
- Tagged value appearing twice for JSON, none of the old answers work on Getting Data In. 10-16-2023 09:16 AM
- Posted Re: Data onboarding, splunk-server field massing up the whole data on Getting Data In. 10-10-2023 11:49 AM
- Posted Data onboarding, splunk-server field massing up the whole data on Getting Data In. 10-10-2023 06:21 AM
- Tagged Data onboarding, splunk-server field massing up the whole data on Getting Data In. 10-10-2023 06:21 AM
- Tagged Data onboarding, splunk-server field massing up the whole data on Getting Data In. 10-10-2023 06:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-20-2023
04:58 AM
any update? I've replied before.
... View more
10-18-2023
09:46 AM
root@armor-index:/opt/splunk/etc/system/local# cat props.conf [armor_json_02] KV_MODE = json root@armor-uf:/opt/splunkforwarder/etc/apps/armor/local# cat props.conf [armor_json_02] SHOULD_LINEMERGE = true LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true CHARSET = UTF-8 #INDEXED_EXTRACTIONS = json KV_MODE = json category = Structured description = JavaScript Object Notation format. For more information, visit http://json.org/ disabled = false pulldown_type = true AUTO_KV_JSON = false set let me test getting same results
... View more
10-18-2023
08:49 AM
before I go ahead, correct me if i don't understand correctly. From the forwarder, props.conf > remove I_E and add KV_MODE = json THEN from the indexer, create same props.conf from above and keep KV_MODE = json OR delete one from forwarder and keep one from the SH (indexer)?
... View more
10-18-2023
08:42 AM
I have that sourcetype setup on the forwarder side. on indexer/SH, can't find that specific sourcetype. Should I had to have the props.conf on the indexer too? IF you mean to update the props.conf to show as KV_MODE = JSON and disable the I_E, iv'e done it on the fowarder side already. UPDATE jusdt found this * When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also
set 'KV_MODE = json' for that source type. This causes the Splunk software to
extract the JSON fields twice: once at index time, and again at search time. should I still not use IE?
... View more
10-18-2023
08:26 AM
1) /opt/splunkforwarder/etc/apps/armor/local/props.conf [armor_json_02] /opt/splunkforwarder/etc/apps/armor/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/apps/armor/local/props.conf CHARSET = UTF-8 /opt/splunkforwarder/etc/apps/armor/local/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/armor/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/apps/armor/local/props.conf LINE_BREAKER = ([\r\n]+) /opt/splunkforwarder/etc/apps/armor/local/props.conf NO_BINARY_CHECK = true /opt/splunkforwarder/etc/apps/armor/local/props.conf SHOULD_LINEMERGE = true /opt/splunkforwarder/etc/apps/armor/local/props.conf category = Structured /opt/splunkforwarder/etc/apps/armor/local/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ /opt/splunkforwarder/etc/apps/armor/local/props.conf disabled = false /opt/splunkforwarder/etc/apps/armor/local/props.conf pulldown_type = true 2) i'll try using KV_MODE for JSON isnetad of I_E now.
... View more
10-18-2023
07:15 AM
I believe it's because the data is being extracted at index and search time? is there a way for me to stop one or the other? 😞 i believe you're on the right track
... View more
- Tags:
- i
10-18-2023
06:57 AM
/opt/splunkforwarder/etc/system/default/props.conf [_json] /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ /opt/splunkforwarder/etc/apps/armor/local/props.conf [armor_json_02] /opt/splunkforwarder/etc/apps/armor/local/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/armor/local/props.conf description = JavaScript Object Notation format. For more information, visit http://json.org/ /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf [json_no_timestamp] /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf [log2metrics_json] /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf METRIC-SCHEMA-TRANSFORMS = metric-schema:log2metrics_default_json /opt/splunkforwarder/etc/apps/splunk_internal_metrics/default/props.conf description = JSON-formatted data. Log-to-metrics processing converts the numeric values in json keys into metric data points. /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json /opt/splunkforwarder/etc/system/default/props.conf INDEXED_EXTRACTIONS = json json only extraction all props.txt is way too long.
... View more
10-16-2023
01:32 PM
@snethala_splunk wrote: remove the INDEXED_EXTRACTIONS = json on your props. I've tried and actually ended up not extracting at all.
... View more
10-16-2023
10:44 AM
search is not the problem it's the backend, the data is coming in extracted twice. thank you. someone will know.
... View more
10-16-2023
10:02 AM
result is like such |table test_id test_id AB-17[3] AB-17[3] XY-17[2] XY-17[2] SI-17[1] SI-17[1] exactly above. 200% result. it should 100%, it's extracting twice? i don't know..
... View more
10-16-2023
09:16 AM
using UF to send json file and below are the props.conf. [test_json] pulldown_type = true LINE_BREAKER = ([\r\n]+) INDEXED_EXTRACTIONS = json KV_MODE = none SHOULD_LINEMERGE = true AUTO_KV_JSON = false category = Structured and from the inputs.conf also contain crcSalt = <SOURCE> result keep showing as below AB-17[3] AB-17[3] XY-17[2] XY-17[2] SI-17[1] SI-17[1] can't figure out the problem.
... View more
- Tags:
- prop.sconf
Labels
- Labels:
-
props.conf
-
universal forwarder
10-10-2023
11:49 AM
I think the issue is more complicated than that. I understand not to look for internal. that is not the issue. the issue is that splunk generates different data from the orginal source with different test date. which is NOT in the file. it has to do with the cluster environment. anyone super expert in such?
... View more
10-10-2023
06:21 AM
can someone help me with this issue where splunk is reading the file, but 'adding' a information that is NOT in the original file.
If you search below
index="acob_controls_summary" sourcetype=acob:json source="/var/log/acobjson/*100223*rtm*"
|search system=CHE control_id=AU2_A_2_1 compliance_status=100%
You will get two result, and mainly separated by “last_test_date”
one showing "2023-10-02 15:42:30.784049" and other showing
"2023-10-02 14:56:45.047265"
ironically,
attached file is the SAME file (just changed the file name after copied onto my machine), that we are seeing from the splunk,
yet there is only ONE entry which is the second the one "2023-10-02 14:56:45.047265
where does that “2023-10-02 15:42:30.784049” came from?
we have a cluster environment therefore many splunk-server auto creates but why is it making a new 'test date' which actually separates one entry into two, AND give one a good return yet another one with wrong info.
... View more
Labels
- Labels:
-
universal forwarder
10-03-2023
11:35 AM
for example index=test |search control_id=AC-2* this would give me AC-2, AC-2a, AC-20a, AC-22b, and so on. I just want AC-2, AC-2a and not the tenth digit of 2s.
... View more
10-03-2023
10:21 AM
trying to set a token where system_id shows ABC1, ABC1-a, ABC10, ABC10-a and so on. when I set the token for that system_id as ABC1* to return all the ABC1 and ABC1-a and so on, it also returns the ABC10, and ABC10-a and so on. BUt obvisouly if I just do ABC10* it will return the right result. the first portion is the problem. hope my question makes sense.
... View more
Labels
- Labels:
-
rex
10-03-2023
09:59 AM
system_id = AA-1, AA-1-a, AA-1-b, AA-10, AA-10-a, AA-10-b, AA-12, AA-12-a, AA-12-b,,, and so on. Notice all the system_id starts with common 'AA-1' and * afterward. However, when use it as a token, as you've already feel the problem, AA-10* would return ALL the following id's start with AA-10* and nothing else, so good. however, if I choose AA-1*, not only it returns the values that start with AA-1 but also AA-10 and AA-12, which I do not want. Trying to make this a dashboard, dropdown with token, where user pikc AA-1, and it only returns ALL the values that only ahs AA-1, aa-1-a, aa-1-b and so on. I need your help search guru, I want to search for All result AA-1 NOT showing AA-10 or AA-12, YET also need them in one token.
... View more
- Tags:
- token
Labels
- Labels:
-
regex
10-03-2023
09:58 AM
system_id = AA-1, AA-1-a, AA-1-b, AA-10, AA-10-a, AA-10-b, AA-12, AA-12-a, AA-12-b,,, and so on. Notice all the system_id starts with common 'AA-1' and * afterward. However, when use it as a token, as you've already feel the problem, AA-10* would return ALL the following id's start with AA-10* and nothing else, so good. however, if I choose AA-1*, not only it returns the values that start with AA-1 but also AA-10 and AA-12, which I do not want. Trying to make this a dashboard, dropdown with token, where user pikc AA-1, and it only returns ALL the values that only ahs AA-1, aa-1-a, aa-1-b and so on.
... View more
10-03-2023
08:06 AM
For example,
system_id = AA-1, AA-1-a, AA-1-b, AA-10, AA-10-a, AA-10-b, AA-12, AA-12-a, AA-12-b,,, and so on.
Notice all the system_id starts with common 'AA-1' and * afterward. However, when use it as a token, as you've already feel the problem, AA-10* would return ALL the following id's start with AA-10* and nothing else, so good. however, if I choose AA-1*, not only it returns the values that start with AA-1 but also AA-10 and AA-12, which I do not want. Trying to make this a dashboard, dropdown with token, where user pikc AA-1, and it only returns ALL the values that only ahs AA-1, aa-1-a, aa-1-b and so on.
hope this question makes sense. has anyone fix such issue before?
... View more
09-06-2023
08:25 AM
it's really nothing to share honestly. [test] DATETIME_CONFIG = current
... View more
09-05-2023
02:17 PM
it's EST. also that is not the problem. it's the date also. docuemtn name is 09042023_test.txt and inside it has something like ID= 101010 processed_date=09/03/2023 and today's date is 09/05/2023 but when the forwarder forwards, it takes the date inside of the document resulting the search has to go 2 days back to find the data
... View more
09-05-2023
01:44 PM
forwarder is forwarding (ex) /var/log/test.txt and the file IS test.txt and it is active because I can see the files from the search, except the dates are not feeding. props.conf is seating on the /etc/apps/test/local/props.conf
... View more
- Tags:
- $
09-05-2023
08:37 AM
test_id": "CHICKEN-0123456", "last_test_date": "2023-09-04 12:34:00"
with such above file and todays date 09/25/2023
once it is monitored by the splunk, I cannot search this data with the 'current' date or even current time; 15 or 60mintues.
instead it tends to read the dates off of the file which is the 'last test date' = 09/24/2023 therefore from the search I have to put either on that day or 1day to find the data.
Props.conf currently set as
DATETIME_CONFIG = CURRENT
I want the file to be 'read' today if it was uploaded today. (or 15 min if it was uploaded within 15min) NOT going off of the date in the file.
Gurus hop in plesae.
... View more
- Tags:
- props
- splunk search
Labels
- Labels:
-
other
08-11-2023
09:25 AM
thank you. if I'd like to perform taht myself, would i use limit.conf? do you happen to have the link that I can possibly take look at? thankyou
... View more
08-11-2023
08:27 AM
I have a search that takes quite some time to run. *using py to run the search with splunk api it returns by saying it "role-based disk usage quita of search artifacts for user "test" has been reached (used 192mb quota=100mb) how can I increase the disk quota?
... View more
Labels
- Labels:
-
search job inspector
-
subsearch
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-20-2023
08:19 AM
|
Karma given to
