About metylkinandrey

metylkinandrey · ‎11-22-2022

All. I'm sorry, I saw that these are the settings: limits.conf

metylkinandrey · ‎11-17-2022

Thanks a lot!

yuanliu · ‎11-14-2022

Tell me, you mean paid technical support? I assume that our clients have some support from splunk, I'm not sure which support tier is appropriate but a product defect should concern everyone in Splunk. I do not believe that a bug report is a billable event.

metylkinandrey · ‎11-08-2022

esterday I tested a lot and realized that this message format works every other time: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a2-a2-a2' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F111", "messageType": "RABIS-HeartBeat", "eventTime": "1985-04-12T23:21:15" }' I just saw that the correct messages have 23 spaces, the problematic ones have 22. Not the point, I just copy the correct messages - for the test, we can assume that I figured it out. The problem remains with messages where the field is: "eventTime": "1985-04-12T23:21:15" in the middle. I have no guarantee that it will be different in production. Here is an example: curl --location --request POST 'http://10.10.10.10:8088/services/collector/raw' --header 'Authorization: Splunk a24-a24-a24-a24' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "ED280816-E404-444A-A2D9-FFD2D171F136", "eventTime": "2022-11-07T17:06:15", "messageType": "RABIS-HeartBeat" }' In this case, I can't find messages at all in the splank index. Although I can see that it was sent successfully in the bash console. Splank doesn't like our format(( This is how he likes it: 2022-11-0717:06:15

metylkinandrey · ‎11-01-2022

Thank you so much!

metylkinandrey · ‎10-31-2022

It seems to be what you need! Thank you!

metylkinandrey · ‎10-31-2022

It seems that this is not exactly what I need.) Tell me, I can send a message in this format: curl --location --request POST 'http://170.25.25.25:8088/services/collector/event' --header 'Authorization: Splunk ееееее-еееееееее-ееееее-e6fc' --header 'Content-Type: text/plain' --data-raw '{ "messageId": "<ED280816-E404-444A-A2D9-FFD2D171F928>", "srcMsgId": "<rwfsdfsfqwe121432gsgsfgdg>", "correlationMsgId": "<rwfsdfsfqwe135432gsgsfgdg>", "baseSystemId": "<SDS-IN>", "routeInstanceId": "<TPKSABS-SMEV>", "routepointID": "<1.SABS-GIS.TO.KBR.SEND>", "eventTime": "<1985-04-12T23:20:50>", "messageType": "<ED123>", "GISGMPResponseID": "<PS000BA780816-E404-444A-A2D9-FFD2D1712345>", "GISGMPRequestID": "<PS000BA780816-E404-444A-A2D9-FFD2D1712344>", "tid": "<ED280816-E404-444A-A2D9-FFD2D171F900>", "PacketGISGMPId": "<7642341379_20220512_123456789>", "result.code": "<400>", "result.desc": "<Ошибка: абвгд>" }' And don't get an error: {"text":"No data","code":5}

richgalloway · ‎10-21-2022

The stats command by itself won't search anything. If you've already read the KVstore collection using inputlookup then that stats command should list all available keys. If it still doesn't work then try assigning _key to a new field. | inputlookup mykvstorelookup | eval key=_key | stats list(key) as key To learn more about the KVstore, see https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/AboutKVstore To learn more about using the KVstore, see https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/

johnhuang · ‎10-20-2022

You can try scheduling it as a real time search which causes it to run continously and process data as it comes in.

PickleRick · ‎10-11-2022

@gcuselloBut searching this way is kinda pointless. You can as well do <your_search> latest=-30s And it makes much more sense (unless it's done way further down the pipeline where it actually might make sens if the _time comes from some heavy processing; otherwise let Splunk take care of time-based limiting).

gcusello · ‎10-06-2022

Hi @metylkinandrey, if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉

metylkinandrey · ‎10-06-2022

Excellent thank you!

metylkinandrey · ‎10-06-2022

Tell me, what should I do in my case, I need from the field: 1.SAPS-SIS.TO.LSP.SEND, or: "12.SAPS-SIS.TO.LSP.RECEIVE Get field: "routepointIDnum": "1" or "routepointIDnum": "12" I tried like this and it almost works: index="main" sourcetype="testsystem-script333" | eval routepointID_num=substr(routepointID,1,2) | table routepointID_num Almost because I get: "routepointIDnum": "1." or "routepointIDnum": "12" And I need: "routepointIDnum": "1" or "routepointIDnum": "12"

metylkinandrey · ‎10-03-2022

Good afternoon! Please tell me, on the following request, unfortunately I'm not so familiar with spl to issue a working version now (( This request is required for notification. Let me describe the workflow first: We have a post thread, 12 posts. Each message has a unique routepointID field, the values of this field begin with numbers and with each message in the chain, the value grows: 1.pointID, 2.pointID (this is an example). The notification should be processed if one of the messages came out out of order, for example: Received 1.pointID, 2.pointID waiting for 3.pointID, and comes: 4.pointID need to run an alert. An example of our query to find message threads from a message flow: index="main" sourcetype="testsystem-script4" | eval srcMsgId_Исх_Сообщения=if(len('Correlation_srcMsgId')==0 OR isnull('Correlation_srcMsgId'),'srcMsgId','Correlation_srcMsgId') | eval timeValue='eventTime' | eval time=strptime(timeValue,"%Y-%m-%dT%H:%M:%S.%3N%Z") | sort -eventTime | streamstats values(time) current=f window=1 as STERAM_RESULT global=false by srcMsgId_Исх_Сообщения | eval diff=STERAM_RESULT-time | stats list(diff) as TIME_DIF list(eventTime) as eventTime list(srcMsgId) as srcMsgId_Бизнес_Сообщения list(routepointID) as routepointID count as Кол_Сообщений by srcMsgId_Исх_Сообщения

richgalloway · ‎09-30-2022

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

metylkinandrey · ‎09-29-2022

wow, it works! Thank you!

metylkinandrey · ‎09-29-2022

Thank you! Edited the request according to your advice, it works.

metylkinandrey · ‎09-07-2022

We have created two types of requests that work: index="main" | append [ search sourcetype=testsystem-reverse | eval chain=coalesce(Mainsys_srcMsgId,srcMsgId) ] | append [ search sourcetype=testsystem-main | eval chain=coalesce(srcMsgId,Mainsys_srcMsgId) ] | transaction maxpause=5m srcMsgId Mainsys_srcMsgId messageId chain | table _time srcMsgId Mainsys_srcMsgId messageId duration eventcount chain | sort chain _time | streamstats current=f window=1 values(_time) as prevTime by subject | eval timeDiff=_time-prevTime | delta _time as timediff And index="main" | eval CONNECTIG_ID=if(len('Mainsys_srcMsgId')==0 OR isnull('Mainsys_srcMsgId'),'srcMsgId','Mainsys_srcMsgId') | stats list(routepointID) as routepoint list(srcMsgId) as srcMsgId list(Mainsys_srcMsgId) as Mainsys_srcMsgId list(eventTime) as eventTime by CONNECTIG_ID

gcusello · ‎09-06-2022

Hi @metylkinandrey, in my opinion also the first option has no sense because there isn't any reason to store critical data outside a DB, I'd protect the DB. Anyway, it's possible to extract data from a DB and to index them in Splunk, this is usually used to enrich other data already present in Splunk with information from a DB (e.g Asset Management). It's possible to extract data from a DB in two main ways: using DB-Connect (https://splunkbase.splunk.com/app/2686/), a free app created and maintained by Splunk that contains a jdbc client to run SQL queries and store results in Splunk, running store procedures in the DB that save results in text files then read by Splunk. Ciao. Giuseppe

gcusello · ‎09-01-2022

HI @metylkinandrey, please try something like this: index="bl_logging" sourcetype="testsystem-2" srcMsgId="rwfsdfsfqwe121432gsgsfgd80" | transaction maxevents=2 srcMsgId Correlation_srcMsgId messageId | where duration>5 | table _time srcMsgId Correlation_srcMsgId messageId duration eventcount Ciao. Giuseppe

isoutamo · ‎08-30-2022

Hi You could use streamstats to calculate duration/range between those events. See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Streamstats If that exceed the N then just alarm. r. Ismo

metylkinandrey · ‎08-30-2022

We decided to change the key: "sourcetype" of the backup system to a unique one. Let the main one have the following value: source="testsystem-2" For the backup: source="testsystem-3" I tried the following queries again, now I understand their logic: index="bl_logging" source="testsystem-2" | transaction SrcMsgId | append [ search index="bl_logging" source="testsystem-2" | transaction SrcMsgId | rename SrcMsgId AS backup_SrcMsgId | rename Mainsys_srcMsgId AS SrcMsgId ] | transaction SrcMsgId Result: No results found. index="bl_logging" source="testsystem-2" | eval backup_SrcMsgId=if(source="testsystem-3",SrcMsgId,""), SrcMsgId=if(source="testsystem-2",SrcMsgId,Mainsys_srcMsgId) | stats values(_raw) AS _raw BY SrcMsgId Result: No results found. I have verified that messages from both systems are written to the same index.

metylkinandrey · ‎08-25-2022

Yes, it works, thanks a lot! ``` index="bl_logging" sourcetype="testsystem-2" | transaction maxpause=5m srcMsgId Correlation_srcMsgId messageId | table _time srcMsgId Correlation_srcMsgId messageId duration eventcount | sort srcMsgId _time | streamstats current=f window=1 values(_time) as prevTime by subject | eval timeDiff=_time-prevTime | delta _time as timediff I added: | delta _time as timediff ``` I checked everything works as it should. Thanks again!

Posts	81
Solutions	0
Karma Given	31
Karma Received	2
Member Since	‎08-24-2022

Online Status	Offline
Date Last Visited	‎11-22-2022 07:21 AM

Receiving strange errors when searching messages b...

Why is Splunk ignoring timestamp in message?

A field is lost in a message sent in raw?

What is the correct time format for "raw" messages...

Add dashboard tab to app?

Is this message format possible for sending to spl...

Suggestions on Minimum message type (json)?

Add field to message using SPL request?

Alert scheduler question- How to run in seconds?

How to determine and compare current time?

Re: Receiving strange errors when searching messag...

Re: Why is Splunk ignoring timestamp in message?

Re: A field is lost in a message sent in raw

Re: Time format for "raw" messages

Re: Add dashboard tab to app

Re: Message Format

Re: Minimum message type (json)

Re: Add field to message using SPL request

Re: Alert scheduler question

Re: Determine and compare current time

Re: Comparison of a field with a digit with a fiel...

Re: Create a new field

Re: How to use substr to extract the first 3 lette...

How to create an alert signaling a violation of th...

Re: Comparison with value: SMEW-403

Re: Search splunk swears on the field with a dot.

Re: Why are alerts constantly getting triggered by...

Re: How to merge two message threads into one?

Re: Storing data in splunk

Re: Heartbeat check

Re: Alert setting, in case of a large interval bet...

Re: How can I display a chain of all ten messages?

Re: Calculate the delta between two time intervals...

Are you a member of the Splunk Community?