About Sriram

Sriram · ‎05-10-2017

I have sporadic issues where not all the logs from application logs are getting forwarded to Splunk. I see gaps in logs when i search in Splunk. (a) Is Splunk slow catching up with high log volume generated by application? If so, how can i prevent this? (b) Could long XML or binary data in the logs cause some of these issues? Appreciate your feed back.

Sriram · ‎08-20-2015

Hello, I am trying to use this app to perform an e-directory ldap lookup based on user id. If I want to connect to ldap using anonymous bind, how do I do that? LDAP.conf file has no such provision. Any help is appreciated.

Sriram · ‎05-22-2015

Thank you all for quick response. As acharlieh correctly pointed out that The issue appears to be subsearch result limit causing the numbers to go awry. I set a limit of 60000 (it is still ugly, but it seems to be working) and also changed the 'fields ThreadId' to 'table ThreadId' as per richgalloway suggestion. index=datasummary1 ThreadId = "*" NOT [search index=datasummary2 | dedup ThreadId | table ThreadId | format maxresults=60000] | table ThreadId,EventDate,EventTime,status i will explore the other suggestions mentioned in the post as my subsearch limit will definitely be more 60000 at some point. Thanks again. You guys are awesome !

Sriram · ‎05-21-2015

I have a query like this to llist thread from datasummary1 which does'nt exist in datasummary2. (something like this below). I am not getting accurate results. Any ideas where the issue is ? if i run individual queries datasummary1 ==> 220000 datasummary2 ==> 40000 the below query give me somewhere around 210000, where i am expecting 180000. index=datasummary1 NOT [search index=datasummary2 | dedup ThreadId | fields ThreadId] | table ThreadId

Sriram · ‎11-17-2014

i have the same problem in windows version of splunk of 6.1 and 6.2 with trial version. I know there is additional space in that folder. I even uninstalled and reinstalled splunk to same as well as different folders. I changed the system settings limit. Nothing works. Any help.

Sriram · ‎11-11-2014

Does this work for prefix wild card as well ? We have source types like UIT1_XXX_APPLICATION, UIT2_XXX_APPLICATION etc. The above command does'nt seem to be working.

Sriram · ‎05-22-2014

filter works ! Awesome ! thanks for your help.

Sriram · ‎05-22-2014

I have a splunk query to combine 2 different results. index=applogs sourcetype=appsource "performance metrics" | search "AvgRespTime" > 6| eval "Statistics" = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics" | eval "Statistics" = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Sriram · ‎03-19-2014

main INFO TxnSummaryLogWriter - LOGTYPE=COMPRESSED, JSON_TXN_SUMMARIES H4sIAAAAAAAAANWbW4vaQBiG/8tcZyEzE 3O63Cil..../veCqx1ATmg4KJlgB5AT3rsDT2P+LFI2qwuOHP4C9fIIkZIyAAA= main INFO TxnSummaryLogWriter - LOGTYPE=UNCOMPRESSED, JSON_TXN_SUMMARIES {"txnsummaries":[{"el":82,"cpu":15, "startTime":"2014-03-12T16:31:02","metadata":{"dummyParam":"foo0","DCN":"143"},"integrations":[{"cat":"JDBC","id":"fooDataSource","cnt":2,"el":17}

Sriram · ‎03-19-2014

Thank You. The problem is the logs are not coming as zip file type. It will be in application.log which has both compressed and uncompressed data mixed together. Here is an example from the application.log. Based on the LOGTYPE=COMPRESSED, I can identify what type of data this event is. At the Index time, I want to be able to uncompress the data and index it. (I have added the rest of the details below.

Sriram · ‎03-18-2014

I have few application which sends application logs in both compressed and uncompressed format. There is a log attribute which identifies what the format of the log data is, so I can create 2 different source types. At the indexing time, i need to uncompress the data(compress) and feed to splunk for further analysis. Is it possible to uncompress the data at index time ? What is the recommended approach to do this ?

Sriram · ‎01-13-2014

Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again. index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"

Sriram · ‎01-09-2014

I have the following query. index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck.

Sriram · ‎01-08-2014

which process is locking the state.xml and manifest file. It appears to be sporadic as well. I have the same issue. Unable to delete or modify the file to reset the state. I ended up cloning the db input and disable the old one. Appreciate your help.

Sriram · ‎01-06-2014

Thanks. I tried that and was not successful. I am guessing it is because of the invalid timestamp format in the rising_column. will give it a shot. Also, If I want to start pulling the data only after a certain date. Can I specify the SQL like this ? SELECT * FROM CLM_EVNT {{WHERE EVNT_TS > "12-09-2013.00.00.00.0000" AND $EVNT_TS$ > ?}} ORDER BY EVNT_TS Where EVNT_TS is the rising_column.

Sriram · ‎01-06-2014

Hello Araitz, I already created a support case on this. Thanks

Sriram · ‎01-03-2014

I am trying to setup a dbmon tail from a table running in DB2 ZOS and unsuccessful in getting it work. After enabling debug and looking at the dbx.log, it appears the query the application generates doesn't have schema name. Absence of schema will force the query to use the userid which makes the query. I either need to set the default schema (SET SCHEMA XXXXX and then fire the query) OR the query has to qualify the table name with the schema name. Incidentally looking at the dbquery command string, I see the query is passed with schema name and I could pull the data. I tried to qualify the table name with schema when setting up Database Inputs (table name field) as DBCDB02.CLM_EVNT. Looking at the logs below, it looks the correct schema is parsed properly, however the query constructed by TailDatabaseMonitor doesn't have the schema. 2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Split table identifier=DBCDB02.CLM_EVNT to schema=DBCDB02 table=CLM_EVNT 2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Constructed SQL query from table name: "SELECT * FROM CLM_EVNT WHERE EVNT_TS > ? ORDER BY EVNT_TS" Here is the snippet from the dbx.log (U12345 is the userid which is defined to connect to the db) 2014-01-03 17:15:12.984 dbx9210:DEBUG:Scheduler - Scheduling initial execution for input=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT] 2014-01-03 17:15:12.984 dbx9210:DEBUG:ExecutionSchedule - State transition from=PENDING to=WAITING 2014-01-03 17:15:12.984 dbx9210:DEBUG:ExecutionContext - Destroying execution context... 2014-01-03 17:15:12.984 dbx9210:INFO:ExecutionContext - Execution finished in duration=94 ms 2014-01-03 17:15:17.984 main:DEBUG:Scheduler - Timer for input=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT] nextExecution=5000 state=WAITING expired. Executing it now... 2014-01-03 17:15:17.984 main:DEBUG:ExecutionSchedule - State transition from=WAITING to=QUEUED 2014-01-03 17:15:17.984 dbx562:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx562 2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Running database monitor in own thread. 2014-01-03 17:15:17.984 dbx562:DEBUG:ExecutionSchedule - State transition from=QUEUED to=RUNNING 2014-01-03 17:15:17.984 dbx562:INFO:TailDatabaseMonitor - Executing database monitor=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT] 2014-01-03 17:15:17.984 dbx562:DEBUG:XStreamStore - Initialized XStreamStore at C:\Program Files\Splunk\var\lib\splunk\persistentstorage\dbx\dfe3933a37ec54ded02fb7bcf7226e39\state.xml 2014-01-03 17:15:17.984 dbx562:DEBUG:XStreamStore - Loading state from XML file... **2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Split table identifier=DBCDB02.CLM_EVNT to schema=DBCDB02 table=CLM_EVNT 2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Constructed SQL query from table name: "SELECT * FROM CLM_EVNT WHERE EVNT_TS > ? ORDER BY EVNT_TS"** 2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Fetching connection from factory... 2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Fetching connection from pool... 2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Activating database connection com.ibm.db2.jcc.b.b@1aecc3a for database=DBCDB02 2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Setting transaction isolation... 2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Validating database connection for database=DBCDB02 2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Executing database connection specific test query: SELECT CURRENT SQLID FROM SYSIBM.SYSDUMMY1 2014-01-03 17:15:18.046 dbx562:INFO:TailDatabaseMonitor - Applying latest tail.rising.column value=2013-12-18 06:11:30.996225 2014-01-03 17:15:18.093 dbx562:ERROR:TailDatabaseMonitor - Error while executing database monitor: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -204, SQLSTATE: 42704, SQLERRMC: U12345.CLM_EVNT com.ibm.db2.jcc.c.SqlException: DB2 SQL error: **SQLCODE: -204, SQLSTATE: 42704, SQLERRMC: U12345.CLM_EVNT** at com.ibm.db2.jcc.c.tf.e(tf.java:1680) ........ at com.ibm.db2.jcc.c.uf.executeQuery(uf.java:491) at com.splunk.dbx.sql.Database.query(Database.java:257) at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.performMonitoring(TailDatabaseMonitor.java:113)

Sriram · ‎01-03-2014

Thank you for providing alternate solution. zOS DB2 doesn't like that "VALUES 1" query. For now I am not doing validation. Also after manually adding default.schema = XXXXX in local - database.conf, I am able to get past the issue and able to pull the tables. I will open up the case to document the issue, so it can be fixed in next release.

Sriram · ‎01-02-2014

Here is overall log. 2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Validating database connection... 2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Executing test query: VALUES 1 2014-01-02 17:09:06.843 dbx1240:ERROR:Database - Database validation failed for database Database{name='database', databaseType=com.splunk.dbx.sql.type.impl.DB2@a23610, host='xxxx', port=xxxx, username='xxx', database='xxxx'}: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -142, SQLSTATE: 42612, SQLERRMC: null .......... com.splunk.dbx.sql.Database.validateConnection(Database.java:479)

Sriram · ‎01-02-2014

I am giving the correct database info. After enabling the logs to debug level. dbx.log shows the following. During validation, it is trying to execute a testquery and sending an invalid query. I tried to override the database.conf file with this sample testquery "testQuery = SELECT CURRENT SQLID FROM SYSIBM.SYSDUMMY1". It is not taking it. I wonder where this "VALUES 1" query is coming from ? Has anyone successfully tried and tested DB2 connectivity for this app ? 2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Executing test query: VALUES 1

Sriram · ‎01-02-2014

I am trying to setup a DB Connection to DB2 which is running in zos. The connection seem to be successful. However I see the following exception when i try to save the settings. Any Idea what the issue is ? I am able to connect to this database using other db client tools like db2 connect, squirrel etc. Encountered the following error while trying to save: In handler 'databases': Error validating database: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -142, SQLSTATE: 42612, SQLERRMC: null

Sriram · ‎03-15-2013

I need to build a dashboard to parse the json data and show it more like Tree Structure.What is the best way, I can build a data structure to be able to run custom queries. I tries use basic spath command as well as using jsontutils jsonkvrecursive command with limited success. Appreciate any help. Here is a sample json data. { "timings": { "cat": "ROOT", "el": 597086853, "cpu": 256429000, "subtimings": { "find": { "cat": "CODE", "el": 500467225, "cpu": 218036000, "subtimings": { "Find - buildMapperObjects": { "cat": "CODE", "el": 6585459, "cpu": 3989000 }, "findBySubscriber": { "cat": "CODE", "el": 488985754, "cpu": 211558000, "subtimings": { "findResponseObjects": { "cat": "CODE", "el": 515299, "cpu": 328000 }, "findSubSqlParamSrc": { "cat": "CODE", "el": 1483307, "cpu": 930000 }, "executeSPCall": { "cat": "CODE", "el": 152860617, "cpu": 36395000, "aggregates": { "dataSourceCall": { "cnt": 2, "el": 22312142 } } } } } } } } } }

Sriram · ‎11-05-2012

I have a saved search which triggers an alert every hour on certain events. This works fine. However the "Link to results" shows incorrect url, It shows "http://myhostname:8000...." whereas the correct link to the results is "http://myhostname/en-US/...". Based on several posts, I tried to update the "link hostname" under "email alert settings" thru splunk UI without success. Can I manually update the alert_actions.conf - hostname to "http://myhostname/en-US", so the email content shows correct URL ? Any help would be appreciated.

Sriram · ‎06-11-2012

Thanks. This helps. However I need to restore the button back once the search is done. Can you tell me whether it is feasible and how much work it is.

Sriram · ‎06-11-2012

Have you done any exercise to make it better in IE8 ? Asking the user base to go any of the other browsers might take a while. Is splunk recommendation is to move on to IE9 or other browsers ? I see the mainly on rendering part. Can turning off any IE8 settings will make any difference.

Posts	55
Solutions	1
Karma Given	14
Karma Received	13
Member Since	‎11-17-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why are not all application logs getting forwarded...

Using the Add-on for LDAP to perform an e-director...

Search using NOT

Splunk sub search

How to uncompress and index the compressed log dat...

Transaction using timestamp

Splunk DB Connect - DB2 - DBMON TAIL

SPLUNK DB CONNECT - DB2

Parsing JSON data

alert notification

Why are not all application logs getting forwarded...

Using the Add-on for LDAP to perform an e-director...

Re: Search using NOT

Search using NOT

Re: Minimum free disk space (1000MB) reached for /...

Re: Is it possible to use wildcards in sourcetype ...

Re: Splunk sub search

Splunk sub search

Re: How to uncompress and index the compressed log...

Re: How to uncompress and index the compressed log...

How to uncompress and index the compressed log dat...

Re: Transaction using timestamp

Transaction using timestamp

Re: Splunk DB Connect - How to reset tail.rising s...

Re: Splunk DB Connect - DB2 - DBMON TAIL

Re: Splunk DB Connect - DB2 - DBMON TAIL

Splunk DB Connect - DB2 - DBMON TAIL

Re: SPLUNK DB CONNECT - DB2

Re: SPLUNK DB CONNECT - DB2

Re: SPLUNK DB CONNECT - DB2

SPLUNK DB CONNECT - DB2

Parsing JSON data

alert notification

Re: submit button greys out during search, possibl...

Re: Browser - Performance issues