About Sriram

Sriram · ‎05-10-2017

I have sporadic issues where not all the logs from application logs are getting forwarded to Splunk. I see gaps in logs when i search in Splunk. (a) Is Splunk slow catching up with high log volume generated by application? If so, how can i prevent this? (b) Could long XML or binary data in the logs cause some of these issues? Appreciate your feed back.

Sriram · ‎08-20-2015

Hello, I am trying to use this app to perform an e-directory ldap lookup based on user id. If I want to connect to ldap using anonymous bind, how do I do that? LDAP.conf file has no such provision. Any help is appreciated.

Sriram · ‎05-22-2015

Thank you all for quick response. As acharlieh correctly pointed out that The issue appears to be subsearch result limit causing the numbers to go awry. I set a limit of 60000 (it is still ugly, but it seems to be working) and also changed the 'fields ThreadId' to 'table ThreadId' as per richgalloway suggestion. index=datasummary1 ThreadId = "*" NOT [search index=datasummary2 | dedup ThreadId | table ThreadId | format maxresults=60000] | table ThreadId,EventDate,EventTime,status i will explore the other suggestions mentioned in the post as my subsearch limit will definitely be more 60000 at some point. Thanks again. You guys are awesome !

Sriram · ‎05-21-2015

I have a query like this to llist thread from datasummary1 which does'nt exist in datasummary2. (something like this below). I am not getting accurate results. Any ideas where the issue is ? if i run individual queries datasummary1 ==> 220000 datasummary2 ==> 40000 the below query give me somewhere around 210000, where i am expecting 180000. index=datasummary1 NOT [search index=datasummary2 | dedup ThreadId | fields ThreadId] | table ThreadId

Sriram · ‎11-17-2014

i have the same problem in windows version of splunk of 6.1 and 6.2 with trial version. I know there is additional space in that folder. I even uninstalled and reinstalled splunk to same as well as different folders. I changed the system settings limit. Nothing works. Any help.

Sriram · ‎11-11-2014

Does this work for prefix wild card as well ? We have source types like UIT1_XXX_APPLICATION, UIT2_XXX_APPLICATION etc. The above command does'nt seem to be working.

Sriram · ‎05-22-2014

filter works ! Awesome ! thanks for your help.

Sriram · ‎05-22-2014

I have a splunk query to combine 2 different results. index=applogs sourcetype=appsource "performance metrics" | search "AvgRespTime" > 6| eval "Statistics" = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics" | eval "Statistics" = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Sriram · ‎03-19-2014

main INFO TxnSummaryLogWriter - LOGTYPE=COMPRESSED, JSON_TXN_SUMMARIES H4sIAAAAAAAAANWbW4vaQBiG/8tcZyEzE 3O63Cil..../veCqx1ATmg4KJlgB5AT3rsDT2P+LFI2qwuOHP4C9fIIkZIyAAA= main INFO TxnSummaryLogWriter - LOGTYPE=UNCOMPRESSED, JSON_TXN_SUMMARIES {"txnsummaries":[{"el":82,"cpu":15, "startTime":"2014-03-12T16:31:02","metadata":{"dummyParam":"foo0","DCN":"143"},"integrations":[{"cat":"JDBC","id":"fooDataSource","cnt":2,"el":17}

Sriram · ‎03-19-2014

Thank You. The problem is the logs are not coming as zip file type. It will be in application.log which has both compressed and uncompressed data mixed together. Here is an example from the application.log. Based on the LOGTYPE=COMPRESSED, I can identify what type of data this event is. At the Index time, I want to be able to uncompress the data and index it. (I have added the rest of the details below.

Sriram · ‎03-18-2014

I have few application which sends application logs in both compressed and uncompressed format. There is a log attribute which identifies what the format of the log data is, so I can create 2 different source types. At the indexing time, i need to uncompress the data(compress) and feed to splunk for further analysis. Is it possible to uncompress the data at index time ? What is the recommended approach to do this ?

Sriram · ‎01-13-2014

Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again. index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"

Sriram · ‎01-09-2014

I have the following query. index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck.

Sriram · ‎01-08-2014

which process is locking the state.xml and manifest file. It appears to be sporadic as well. I have the same issue. Unable to delete or modify the file to reset the state. I ended up cloning the db input and disable the old one. Appreciate your help.

Sriram · ‎01-06-2014

Thanks. I tried that and was not successful. I am guessing it is because of the invalid timestamp format in the rising_column. will give it a shot. Also, If I want to start pulling the data only after a certain date. Can I specify the SQL like this ? SELECT * FROM CLM_EVNT {{WHERE EVNT_TS > "12-09-2013.00.00.00.0000" AND $EVNT_TS$ > ?}} ORDER BY EVNT_TS Where EVNT_TS is the rising_column.

Posts	55
Solutions	1
Karma Given	14
Karma Received	13
Member Since	‎11-17-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why are not all application logs getting forwarded...

Using the Add-on for LDAP to perform an e-director...

Search using NOT

Splunk sub search

How to uncompress and index the compressed log dat...

Transaction using timestamp

Splunk DB Connect - DB2 - DBMON TAIL

SPLUNK DB CONNECT - DB2

Parsing JSON data

alert notification

Why are not all application logs getting forwarded...

Using the Add-on for LDAP to perform an e-director...

Re: Search using NOT

Search using NOT

Re: Minimum free disk space (1000MB) reached for /...

Re: Is it possible to use wildcards in sourcetype ...

Re: Splunk sub search

Splunk sub search

Re: How to uncompress and index the compressed log...

Re: How to uncompress and index the compressed log...

How to uncompress and index the compressed log dat...

Re: Transaction using timestamp

Transaction using timestamp

Re: Splunk DB Connect - How to reset tail.rising s...

Re: Splunk DB Connect - DB2 - DBMON TAIL