About victorcorrea

victorcorrea · ‎11-04-2024

We have been able to validate that the issue was with the TIBCO File Watcher process locking the file until it completed writing it to the disk and, therefore, the Splunk UF could not open/read the file to ingest it. I wanted to check with the TIBCO people if there was a way to change the permissions with which the File Watcher process opened the file (ensure it had the FILE_SHARE_READ) but they suggested a simpler and just-as-effective solution. TIBCO will create the files, initially, as ".tmp" files, so they won't match the name pattern on the monitor stanza. When the process of writing to disk has completed, TIBCO will drop the ".tmp" so the files match the monitor stanza. That way, Splunk will only try to ingest the files that have been written into the disk and, therefore, are not locked.

victorcorrea · ‎10-30-2024

Looks like the issue was with "LINE_MERGE=TRUE" in the props.conf file. Thank you @PickleRick and @yuanliu for chiming in.

victorcorrea · ‎10-16-2024

Hi all, I need to create an alert that will be triggered when a latency threshold is breached for sustained 30 minutes. I am doing my research on how to incorporate streamstats into my query, and so far I have come up with this: index="x" source="y" EndtoEnd | rex (?<e2e_p>\d+)ms \\Extracts the numerical value from the e2e_p field. | where isnotnull(e2e_p) | streamstats avg(e2e_p) window=1800 current=t time_window=30m as avg_e2e_p | where avg_e2e_p > 500 The condition doesn't happen often, but I'll work with the team that supports the app to simulate the condition once the query is finalized. I have never used streamstats before, but that's what has come up in my search for a means to incoporate a sliding window into a SPL query. Thank you in advance for taking the time to help with this.

victorcorrea · ‎05-23-2024

Beautiful. Many thanks, @ITWhisperer !

victorcorrea · ‎03-14-2024

Right now I am creating the alerts in our DEV environment and the lag is negligible, but that will definitely be something I'll keep in mind once we're promoting it to PAT and PROD. Ultimately, the goal of the alert is to catch a trend in 5-minute intervals for a specific error code. If there are occasional spikes that are not sustained (say, in the first 5 minutes the count is 6 but in the second and third the count is 1 or 0) we don't want the alert to be triggered. But I'll be running some tests with the application folks by injecting the signatures into the logs at various rates, so I'll be able to determine if I'll have to shift the time windows. Thanks again, Bowesmana. You've been very helpful and I appreciate you sharing your knowledge.

Posts	14
Solutions	2
Karma Given	9
Karma Received	0
Member Since	‎03-14-2024

Online Status	Offline
Date Last Visited	‎11-04-2024 01:34 PM

Ingesting Log Files in Windows - Some Logs Being I...

Logs truncated in Splunk despite line being under ...

Splunk Alert - Threshold Breach Sustained For 30 M...

Splunk Query To Evaluate Absence Of A Signature In...

Create a Splunk Alert that Evaluates Two Condition...

Re: Ingesting Log Files in Windows - Some Logs Bei...

Re: Logs truncated in Splunk despite line being un...

Splunk Alert - Threshold Breach Sustained For 30 M...

Re: Splunk Query To Evaluate Absence Of A Signatur...

Re: Create a Splunk Alert that Evaluates Two Condi...