Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About metylkinandrey
metylkinandrey
Communicator
Member since:
08-24-2022
11-22-2022
Community Statistics
| Posts | 81 |
| Solutions | 0 |
| Karma Given | 31 |
| Karma Received | 2 |
| Member Since | 08-24-2022 |
Activity Feed
- Posted Re: Receiving strange errors when searching messages by old dates? on Splunk Search. 11-22-2022 04:00 AM
- Posted Re: Receiving strange errors when searching messages by old dates on Splunk Search. 11-22-2022 03:56 AM
- Posted Re: Receiving strange errors when searching messages by old dates on Splunk Search. 11-22-2022 03:38 AM
- Posted Re: Why is Splunk ignoring timestamp in message? on Splunk Search. 11-17-2022 04:44 AM
- Karma Re: Why is Splunk ignoring timestamp in message? for yuanliu. 11-17-2022 04:43 AM
- Posted Re: Why is Splunk ignoring timestamp in message? on Splunk Search. 11-15-2022 04:52 AM
- Posted Re: Why is Splunk ignoring timestamp in message? on Splunk Search. 11-15-2022 03:48 AM
- Karma Re: Why is Splunk ignoring timestamp in message? for yuanliu. 11-15-2022 03:48 AM
- Karma Re: A field is lost in a message sent in raw for yuanliu. 11-15-2022 12:10 AM
- Karma Re: Receiving strange errors when searching messages by old dates for yuanliu. 11-15-2022 12:08 AM
- Posted Re: A field is lost in a message sent in raw on Splunk Search. 11-14-2022 04:42 AM
- Posted Receiving strange errors when searching messages by old dates? on Splunk Search. 11-14-2022 03:42 AM
- Karma Re: A field is lost in a message sent in raw for yuanliu. 11-14-2022 03:19 AM
- Posted Re: A field is lost in a message sent in raw on Splunk Search. 11-14-2022 03:18 AM
- Posted Re: A field is lost in a message sent in raw on Splunk Search. 11-10-2022 04:50 AM
- Posted Re: Ignoring timestamp in message on Splunk Search. 11-10-2022 04:49 AM
- Posted Re: A field is lost in a message sent in raw on Splunk Search. 11-10-2022 04:18 AM
- Karma Re: A field is lost in a message sent in raw for yuanliu. 11-10-2022 04:17 AM
- Posted Re: Ignoring timestamp in message on Splunk Search. 11-10-2022 04:16 AM
- Posted Re: A field is lost in a message sent in raw on Splunk Search. 11-10-2022 03:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-22-2022
04:00 AM
All. I'm sorry, I saw that these are the settings: limits.conf
... View more
11-22-2022
03:56 AM
I try like this for example: | eval src_Msg_Id=if(len('srcMsgId')==0 OR isnull('srcMsgId')," ",'srcMsgId') | stats list_maxsize = 10000 | stats list(diff) as TIME_DIF list(event_Time) as EventTime list(src_Msg_Id) as srcMsgId_Бизнес_Сообщения list(routepoint_ID) as RoutepointID list(t_i_d) as Tid list(GISGMP_Request) as GISGMPRequestID list(message_Type) as MessageType list(Packet_GIS_GMP_Id) as PacketGISGMPId count as Кол_Сообщений by srcMsgId_Исх_Сообщения But it doesn't help
... View more
11-22-2022
03:38 AM
Hello, tell me, where should I add this in the request? Request example: index="main" | eval srcMsgId_Исх_Сообщения=if(len('Correlation_srcMsgId')==0 OR isnull('Correlation_srcMsgId'),'srcMsgId','Correlation_srcMsgId') | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z") | sort -eventTime | streamstats values(time) current=f window=1 as STERAM_RESULT global=false by srcMsgId_Исх_Сообщения | eval diff=STERAM_RESULT-time | stats list(diff) as TIME_DIF list(eventTime) as eventTime list(srcMsgId) as srcMsgId_Бизнес_Сообщения list(routepointID) as routepointID count as Кол_Сообщений by srcMsgId_Исх_Сообщения
... View more
11-17-2022
04:44 AM
Thanks a lot!
... View more
11-15-2022
04:52 AM
And I also noticed a strange thing, the problem is only with short messages. These messages work fine: curl --location --request POST 'http://mo.pr.dev.org:8088/services/collector/raw' --header 'Authorization: Splunk 02-93-48-96-27' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F8978", "srcMsgId": "rwfsdfsfqwe121432gsgsfgd5000", "correlationMsgId": "", "baseSystemId": "abc1", "routeInstanceId": "abc2", "routepointID": "1.SA-GI.TO.KB.SEND", "eventTime": "1985-04-12T23:20:00", "GISGMPRequestID": "PS000BA780816-E404-444A-A2D9-FFD2D1712345", "GISGMPResponseID": "PS000BA780816-E404-444B-A2D9-FFD2D1712345", "messageType": "ED661", "tid": "4234rfre09-hi4334-34lk-3j09k-fc4353j9494", "PacketGISGMPId":"7642341379_20220512_123456789", "result.code": "", "resultdesc": "abc8" }'
... View more
11-15-2022
03:48 AM
Please tell me, did you find out that there is a similar problem with the splunk. But is it possible to disable checking messages for a timestamp in splunk altogether?
... View more
11-14-2022
04:42 AM
@yuanliu Do I understand correctly that forum users with the status - SplunkTrust, are also technical support?
... View more
11-14-2022
03:42 AM
I get strange errors when searching messages by old dates.
If I put a search for more than two hours, I immediately get the following errors:
2 errors occurred while the search was executing. Therefore, search results might be incomplete.
'stats' command: limit for values of field 'Time' reached. Some values may have been truncated or ignored.
'stats' command: limit for values of field 'messageType' reached. Some values may have been truncated or ignored.
From four days:
4 errors occurred while the search was executing. Therefore, search results might be incomplete.
'stats' command: limit for values of field 'Time' reached. Some values may have been truncated or ignored.
'stats' command: limit for values of field 'eventTime' reached. Some values may have been truncated or ignored.
'stats' command: limit for values of field 'messageId' reached. Some values may have been truncated or ignored.
'stats' command: limit for values of field 'messageType' reached. Some values may have been truncated or ignored.
One of my requests:
index="external_system" messageType="RABIS-HeartBeat" | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S") | sort -_time | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S") | eval Time=strftime(_time,"%Y-%m-%dT%H:%M:%S") | stats list(Time) as Time list(eventTime) as EventTime list(messageType) as MessageType list(messageId) as Messag11eId by messageType
Message example:
curl --location --request POST 'http://mon.pd.dev.sis.org:8088/services/collector/raw' --header 'Authorization: Splunk 02-93-48-9-27' --header 'Content-Type: text/plain' --data-raw '{ "messageType": "HeartBeat", "eventTime": "2022-11-14T13:34:15", "messageId": "ED280816-E404-444A-A2D9-FFD2D171F9999" }'
Can you please tell me how to solve these problems?
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
other
11-14-2022
03:18 AM
Tell me, you mean paid technical support? I assume that our clients have some support from splunk, but we should not bother them.) This is a bad idea) In our case, we are not using splunk for ourselves, we are just trying to implement monitoring of the system that we do for clients, on the stands clients. But our difficulties should not concern them. Or is there some other form of communication with splunk support?
... View more
11-10-2022
04:50 AM
My current configuration: [generic_single_line] DATETIME_CONFIG = NONE LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIME_FORMAT = disabled = false SHOULD_LINEMERGE = true
... View more
11-10-2022
04:49 AM
My current configuration: [generic_single_line] DATETIME_CONFIG = NONE LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true TIME_FORMAT = disabled = false SHOULD_LINEMERGE = true
... View more
11-10-2022
04:18 AM
I did everything by acting on this recommendation: Set DATETIME_CONFIG = NONE to prevent the timestamp processor from running. When timestamp processing is off, Splunk Enterprise does not look at the text of the event for the timestamp and instead uses the event time of receipt, the time the event arrives through its input. For file-based inputs, the event timestamp is taken from from the modification time of the input file. Let me not like this option very much ( After editing the file /opt/splunk/etc/system/local/props.conf I completely restarted the docker container so that splunk picks up the settings. And it broke everything for me! Now I can't see my messages even if I set the filter: for the last year ((( While the messages are being sent, I get the code: "Success","code":0
... View more
11-10-2022
04:16 AM
I did everything by acting on this recommendation: Set DATETIME_CONFIG = NONE to prevent the timestamp processor from running. When timestamp processing is off, Splunk Enterprise does not look at the text of the event for the timestamp and instead uses the event time of receipt, the time the event arrives through its input. For file-based inputs, the event timestamp is taken from from the modification time of the input file. Let me not like this option very much ( After editing the file /opt/splunk/etc/system/local/props.conf I completely restarted the docker container so that splunk picks up the settings. And it broke everything for me! Now I can't see my messages even if I set the filter: for the last year ((( While the messages are being sent, I get the code: "Success","code":0
... View more
11-10-2022
03:52 AM
I'm experimenting, so far in the file: /opt/splunk/etc/system/local/props.conf set the parameter: DATETIME_CONFIG = NONE Can you tell me how to apply the new settings in splunk?
... View more
11-10-2022
03:51 AM
I'm experimenting, so far in the file: /opt/splunk/etc/system/local/props.conf set the parameter: DATETIME_CONFIG = NONE Can you tell me how to apply the new settings in splunk?
... View more
11-10-2022
03:04 AM
I also want to ask, is there really no other option to bypass this problem, except to edit the file: props.conf ? Can you tell me how can I edit this file? If this is the only way out: a way and where to find it, do I need access to the file system? I'm afraid that editing this file: props.conf will affect all applications in splunk and other employees will not process their requests correctly. I will not be able to correct the requests of other employees purely physically, since this is our customer. (((
... View more
11-10-2022
02:07 AM
I forgot to add a screenshot. I'll add it here. I also want to ask, is there really no other option to bypass this problem, except to edit the file: props.conf ? Can you tell me how can I edit this file? If this is the only way out: a way and where to find it, do I need access to the file system?
... View more
11-10-2022
01:47 AM
Good afternoon, I have already raised a similar topic. The last time I was cleared up the situation, but the problem has not been resolved. I send messages to /services/collector/raw And splunk takes the value from my "eventTime" field: "1985-04-12T23:21:15Z", and substitutes _time, which breaks my normal search and the normal operation of alerts. sourcetype in my case substitutes splunk itself when checking the token. I tried adjusting the sourcetype but that didn't help. In the screenshot, I displayed what I tried to do.
Unfortunately, we do not have the ability to always send messages to the Event ((
Message example:
curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a2-b5-48-9ff7-95r 'Content-Type: text/plain' --data-raw '{ "messageType": "RABIS", "eventTime": "1985-04-12T23:21:15Z", "messageId": "ED280816-E404-444A-A2D9-FFD2D171F447" }'
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
other
11-09-2022
04:33 AM
I found where this is done, in the settings: Source Types I follow this recommendation: lick Timestamps. The list expands to show extraction options. Select from one of the following options: Current time: Apply the current time to all events detected. I tried to show it on the screenshot, but it did not help ((
... View more
11-09-2022
04:11 AM
Hello, I understand correctly, I need to study this particular article? It: https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/Setsourcetype I can't find this button in the interface: Click Event breaks ((
... View more
11-08-2022
06:10 AM
I still don't quite understand how I can make it work. Splunk itself gives my messages a sourcetype based on their token. It's just that I don't specify the sourcetype in the request, I made a new request: index="rs" messageType="RABIS" sourcetype="RS" | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z") | sort -_time | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z") | eval Time=strftime(_time,"%Y-%m-%dT%H:%M:%S") | stats list(Time) as Time list(eventTime) as EventTime list(messageType) as MessageType list(messageId) as MessageId by messageType I see my messages, but also as if they came yesterday and not today, that is, for the past date. Really sourcetype needs to be registered in the message?
... View more
11-08-2022
05:43 AM
I localized this problem, for some reason splunk takes the time from my eventTime field and substitutes it in the _time field, which violates the date the message was received, I see my messages as sent yesterday, I understand that they are, by the messageId field, I put them unique for each test submission. But I don't understand why this is happening.
... View more
11-08-2022
05:10 AM
That is? How will it help? All my posts go to one index, I don't use sourcetype. I see that I have a problem with the fact that the field format cannot be parsed by splunk.
... View more
11-08-2022
03:19 AM
esterday I tested a lot and realized that this message format works every other time: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a2-a2-a2' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F111", "messageType": "RABIS-HeartBeat", "eventTime": "1985-04-12T23:21:15" }' I just saw that the correct messages have 23 spaces, the problematic ones have 22. Not the point, I just copy the correct messages - for the test, we can assume that I figured it out. The problem remains with messages where the field is: "eventTime": "1985-04-12T23:21:15" in the middle. I have no guarantee that it will be different in production. Here is an example: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a24-a24-a24-a24' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F136", "eventTime": "2022-11-07T17:06:15", "messageType": "RABIS-HeartBeat" }' In this case, I can't find messages at all in the splank index. Although I can see that it was sent successfully in the bash console. Splank doesn't like our format(( This is how he likes it: 2022-11-0717:06:15
... View more
11-08-2022
03:19 AM
Yesterday I tested a lot and realized that this message format works every other time: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a2-a2-a2' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F111", "messageType": "RABIS-HeartBeat", "eventTime": "1985-04-12T23:21:15" }' I just saw that the correct messages have 23 spaces, the problematic ones have 22. Not the point, I just copy the correct messages - for the test, we can assume that I figured it out. The problem remains with messages where the field is: "eventTime": "1985-04-12T23:21:15" in the middle. I have no guarantee that it will be different in production. Here is an example: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a24-a24-a24-a24' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F136", "eventTime": "2022-11-07T17:06:15", "messageType": "RABIS-HeartBeat" }' In this case, I can't find messages at all in the splank index. Although I can see that it was sent successfully in the bash console. Splank doesn't like our format(( This is how he likes it: 2022-11-0717:06:15
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-22-2022
07:21 AM
|
