About riposans

riposans · ‎09-26-2024

hello all can help me for this? i get data like this abc=1|productName= SHAMPTS JODAC RL MTV 36X(4X60G);ABC MANIS RL 12X720G;SO KLIN ROSE FRESH LIQ 24X200ML|field23=tip i want to extract productName but can't extract because value productName not using " " so I'm confused to extract it, I've tried it using the spl command | makemv delim=";" productName but the only result is SHAMPTS JODAC RL MTV 36X(4X60G). the rest doesn't appear. and also using regex with the command | makemv tokenizer="(([[:alnum:]]+ )+([[:word:]]+))" productName but the result is still the same. so is there any suggestion so that the value after ; can be extracted?

riposans · ‎06-20-2024

Dear Everyone can help me for this, i have log from syslog but cannot break event by lines. {"@timestamp":"2000-01-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-01-21 00:58:39|ABC1=ABC2|ABC12=ABC23|ABC34=ABC35|ABC45=ABC46"}{"@timestamp":"2000-02-21T00:58:39.372418529Z","event":{},"@version":"1","type":"prod","filtered_message":"[ABC]|Type=ABC|logDate=2000-02-21 00:58:39|ABC1=ABC5|ABC13=ABC24|ABC35=ABC36|ABC46=ABC47"} i need break this log from props.conf, i already used this: [ABC] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false but not works, please tell me how to extract event log by lines

riposans · ‎03-20-2024

Hello everyone, i need solution for this. my data : userID=text123 , login_time="2024-03-21 08:04:42.201000", ip_addr=12.3.3.21 userID=text123, login_time="2024-03-21 08:00:00.001000", ip_addr=12.3.3.45 userID=text123, login_time="2024-03-21 08:02:12.201000", ip_addr=12.3.3.21 userID=text123, login_time="2024-03-21 07:02:42.201000", ip_addr=12.3.3.34 i want get data, userID="text123 " AND in the last 5 minutes AND if mutiple ip i used join,map,append but not solved.please help for SPL this

riposans · ‎11-28-2023

hello everyone i check in log maxmind tracker get this error "Could not download MaxMind GeoIP MD5, exiting." how can i solve this ? thankyou

riposans · ‎11-28-2023

i checked error this ERROR io.dropwizard.jersey.errors.LoggingExceptionMapper - Error handling a request: xxxxxxxx java.lang.NoClassDefFoundError: Could not initialize class java.awt.GraphicsEnvironment how i can solve this?

riposans · ‎11-27-2023

im getting this error from connection in DB connect "There was an error processing your request. It has been logged (ID xxxx)" . I've done manually copy query in db_inputs.conf but doesnt worxs. can help me?

riposans · ‎10-31-2023

thankyou so much its works for me

riposans · ‎10-29-2023

I'm confused how to truncate from this log. how do I do it from props.conf or from the SPL command? Can anyone provide a solution to this? <11>1 2021-03-18T15:05:30.501Z abcdefghi-jajaj-b1bc07001-xb0k7.abcdefghi-user - - - [Originator@7776 kubernetes__container_name="abcdefghi-jajaj" docker__container_id="a1bbddc80312d8501f1b1ac015d525722f105a71d6521be0728e8b057066eda1" kubernetes__pod_name="abcdefghi-jajaj-b1bc07001-xb0k7" bosh_index="0" stream="stbcd" kubernetes__namespace_name="abcdefghi-develop" bosh_id="e0700d15-ca5a-1f35-8e01-bd83d3eb705a" bosh_deployment="service-instance_f08cb851-fa53-1206-0a6b-705f3fa0f301" docker_id="a1bbddc80312d" tag="kubernetes.var.log.containers.abcdefghi-user-b1bc07001-xb0k7_abcdefghi-develop_abcdefghi-user-a1bbddc80312d8501f1b1ac015d525722f105a71d6521be0728e8b057066eda1.log" instance_type="werkir"] 2021-03-18 22:05:00.210 INFO [abcdefghi-jajaj,3010acf256f7c7e0,717ea36c0d67f3da,true] 6 --- [nio-0020-exec-1] c.id.bankabcde.common.util.SplunkUtil : [LOGIN_abc]|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|uobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|sessionID=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|appVersion=ABC123|mobilePhone=ABC123|custGroup=ABC123 i want to cut it to something like this: [LOGIN_abc]|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|uobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|sessionID=ABC123|mobilePhone=ABC123|mobilePhone=ABC123|appVersion=ABC123|mobilePhone=ABC123|custGroup=ABC123 THANKYOU

Posts	9
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎10-24-2023

Online Status	Offline
Date Last Visited	‎10-31-2024 11:44 PM

how to extract multiple value in field CEF?

Cannot break event by log from syslog

mutiple search

maxmind cannot updated

There was an error processing your request. It has...

Truncate Log