About JagsP

JagsP · ‎02-12-2025

I am setting up Cloud360 45c version in my dev environment which is standalone server. I have configured all the files and look ups but when i am trying to run the main.py script it is giving me below error: splunk@s-9ee55895 scripts]$ /opt/splunk/bin/splunk cmd python3 main.py METRIC Traceback (most recent call last): File "/opt/splunk/etc/apps/acn_cloud360-aws_edc_rhel_7.x_tenant01/bin/scripts/../../lib/pandas/core/indexes/base.py", line 3361, in get_loc return self._engine.get_loc(casted_key) File "pandas/_libs/index.pyx", line 76, in pandas._libs.index.IndexEngine.get_loc File "pandas/_libs/index.pyx", line 108, in pandas._libs.index.IndexEngine.get_loc File "pandas/_libs/hashtable_class_helper.pxi", line 5198, in pandas._libs.hashtable.PyObjectHashTable.get_item File "pandas/_libs/hashtable_class_helper.pxi", line 5206, in pandas._libs.hashtable.PyObjectHashTable.get_item KeyError: 'enabled' The above exception was the direct cause of the following exception: Traceback (most recent call last): File "main.py", line 12, in <module> from aws_manager import Cloud360_AWS_Manager File "/opt/splunk/etc/apps/acn_cloud360-aws_edc_rhel_7.x_tenant01/bin/scripts/aws_manager.py", line 10, in <module> import aws_detail_structure_processor as DetailStructureProcessor File "/opt/splunk/etc/apps/acn_cloud360-aws_edc_rhel_7.x_tenant01/bin/scripts/aws_detail_structure_processor.py", line 50, in <module> raw_metric_catalog_df = raw_metric_catalog_df[raw_metric_catalog_df['enabled'] == 0] File "/opt/splunk/etc/apps/acn_cloud360-aws_edc_rhel_7.x_tenant01/bin/scripts/../../lib/pandas/core/frame.py", line 3458, in __getitem__ indexer = self.columns.get_loc(key) File "/opt/splunk/etc/apps/acn_cloud360-aws_edc_rhel_7.x_tenant01/bin/scripts/../../lib/pandas/core/indexes/base.py", line 3363, in get_loc raise KeyError(key) from err KeyError: 'enabled' Can anyone help me what i am missing here ?

JagsP · ‎10-23-2024

props.conf : [sap_failure] TRANSFORMS-filter = setnull,stanza transform.conf : [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [stanza] REGEX = "successful, returned exit code '0'" DEST_KEY = queue FORMAT = indexQueue Content: [16/Sep/2024:02:00:36 -05:00] INFO : [PID:0185317:Backup:360] [1] successful, returned exit code '0' [16/Sep/2024:02:00:36 -05:00] DEBUG: [PID:0185317:SAPHANA:648] SQLSTRING: 'BACKUP DATA FOR FULL SYSTEM CLOSE SNAPSHOT BACKUP_ID 1726470003540 SUCCESSFUL 'hana_data_FHL__2024-09-16T070003-1779190Z'' Here in content if you see i have other events which is not having the desired text string . I need to filter all other events . has context menu

JagsP · ‎10-23-2024

Is there any issue with the below settings ? Also is the Regex wrong here ? [sourcetype] TRANSFORMS-filter = setnull,stanza transforms: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [stanza] REGEX = "Snapshot created successfully" DEST_KEY = queue FORMAT = indexQueue A

JagsP · ‎10-22-2024

Yes , Heavy forwarders are being used but how it will impact the data filtration ?

JagsP · ‎10-22-2024

This is my error string " successful, returned exit code '0'" but apart from this error , other events are also getting returned. Please help in creating the regex for this as i am new to Regex and also how can we create or take help from where to create regex?

JagsP · ‎10-08-2024

It did not work 😞 It is still giving all the events other than the expected one.

JagsP · ‎08-26-2024

@ITWhisperer Now tried this but still no luck 😞 index=atn*infra*tier3* | bin span=6m@m metric_value as 6_min_data | stats count(eval(metric_value=0)) as uptime count(eval(metric_value=1)) as downtime by 6_min_data, source_host | eval total_uptime = uptime*360 | eval total_dowtime = downtime*360 | eval total_uptime = if(isnull(total_uptime),0,total_uptime) | eval total_downtime = if(isnull(total_dowtime),0, total_dowtime) | eval avg_uptime_perc = round((total_uptime/(total_uptime+total_downtime))*100 ,2) | eval avg_downtim_perc = round((total_downtime/(total_uptime+total_downtime))*100,2) | eval total_uptime = tostring(total_uptime, "duration") | eval total_downtime = tostring(total_downtime, "duration") | lookup atn_common_lookup_topology-technical-detail_001.csv key as source_host | rename "total_uptime" as "Total Uptime", "total_downtime" as "Total Downtime", avg_uptime_perc as "Average uptime in %", avg_downtim_perc as "Average Downtime in %" source_host as "Source Host" | table "type" system "Source Host" "Total Uptime" "Total Downtime" "Average uptime in %" "Average Downtime in %"

JagsP · ‎08-26-2024

@ITWhisperer This is my final query but still fields are not coming from look up file . Source_host and key field in look up file is same . index=*infra* metric_label ="Host : Reporting no data" | bin span=6m@m metric_value as 6_min_data | stats count(eval(metric_value=0)) as uptime count(eval(metric_value=1)) as downtime by 6_min_data, source_host | eval total_uptime = uptime*360 | eval total_dowtime = downtime*360 | eval total_uptime = if(isnull(total_uptime),0,total_uptime) | eval total_downtime = if(isnull(total_dowtime),0, total_dowtime) | eval avg_uptime_perc = round((total_uptime/(total_uptime+total_downtime))*100 ,2) | eval avg_downtim_perc = round((total_downtime/(total_uptime+total_downtime))*100,2) | eval total_uptime = tostring(total_uptime, "duration") | eval total_downtime = tostring(total_downtime, "duration") | rename "total_uptime" as "Total Uptime", "total_downtime" as "Total Downtime", avg_uptime_perc as "Average uptime in %", avg_downtim_perc as "Average Downtime in %" source_host as "Source Host" | lookup *_common_lookup_topology-technical-detail_001.csv key as source_host | table key type system "Source Host" "Total Uptime" "Total Downtime" "Average uptime in %" "Average Downtime in %"

JagsP · ‎08-26-2024

Hi @ITWhisperer , The look up file contains the data like server OS and server environment (production or non -prod) which i will be needing in the search results along with the data coming for the mentioned index hence i have to fetch data from lookup file as well. I hope i cleared your doubt.

JagsP · ‎08-26-2024

Hello everyone , I have the below query which is fetching data for a particular index but i also want few fields from a look up file say ABC.csv and columns are 'Salary' and 'Date' from that . I am trying to fetch it but the data is coming as blank . Please help : index=*infra* metric_label ="Host : Reporting no data" | bin span=6m@m metric_value as 6_min_data | stats count(eval(metric_value=0)) as uptime count(eval(metric_value=1)) as downtime by 6_min_data, source_host | eval total_uptime = uptime*360 | eval total_dowtime = downtime*360 | eval total_uptime = if(isnull(total_uptime),0,total_uptime) | eval total_downtime = if(isnull(total_dowtime),0, total_dowtime) | eval avg_uptime_perc = round((total_uptime/(total_uptime+total_downtime))*100 ,2) | eval avg_downtim_perc = round((total_downtime/(total_uptime+total_downtime))*100,2) | eval total_uptime = tostring(total_uptime, "duration") | eval total_downtime = tostring(total_downtime, "duration") | rename "total_uptime" as "Total Uptime", "total_downtime" as "Total Downtime", avg_uptime_perc as "Average uptime in %", avg_downtim_perc as "Average Downtime in %" source_host as "Source Host" | table "Source Host" "Total Uptime" "Total Downtime" "Average uptime in %" "Average Downtime in %"

JagsP · ‎08-26-2024

I am trying out this . I will let you know whether it worked ! Thanks .

JagsP · ‎08-21-2024

Hello everyone , I want to filter data for a specific keyword "Snapshot created successfully " from a log file but i am getting other events also along with the searched keywords. My entries in props.conf and transform.conf is as below : props.conf [sourcetype] TRANSFORMS-filter = stanza transforms.conf [stanza] REGEX = "Snapshot created successfully" DEST_KEY = queue FORMAT = indexqueue Is there any issue here ?

JagsP · ‎08-19-2024

Thanks @richgalloway The solution worked .

JagsP · ‎08-12-2024

Thanks @richgalloway Trying it out now. will let you know if it works.

JagsP · ‎08-12-2024

Hello everyone, Please check the below data : ERROR 2024-08-09 14:19:22,707 email-slack-notification-impl-flow.BLOCKING @3372f96f] [processor: email-slack-notification-impl-flow/processors/2/route/0/processors/0; event: 5-03aca501-42b3-11ef-ad89-0a2944cc61cb] error.notification.details: { "correlationId" : "5-03aca501-42b3-11ef-ad89-0a2944cc61cb", "message" : "Error Details", "tracePoint" : "FLOW", "priority" : "ERROR", } ERROR 2024-08-09 14:19:31,389 email-slack-notification-impl-flow.BLOCKING @22feab4f] [processor: email-slack-notification-impl-flow/processors/2/route/0/processors/0; event: 38de9c30-49eb-11ef-8a9e-02cfc6727565] error.notification.details: { "correlationId" : "38de9c30-49eb-11ef-8a9e-02cfc6727565", "message" : "Error Details", "priority" : "ERROR", } The above 2 blocks of data are coming as one event but I want them to be 2 events each starting from keyword "Error". Below is my props.config entry for same but not working: applog_test] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Custom disabled = false pulldown_type = true BREAK_ONLY_BEFORE = date SHOULD_LINEMERGE = true TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TIME_PREFIX=ERROR\s+ Please help how to fix this. Thanks in advance!

Posts	15
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎08-12-2024

Online Status	Offline
Date Last Visited	‎02-13-2025 06:56 AM

Cloud360 AWS set up

Fetching data from lookup file

Filter data in log files

Event Line Break

Cloud360 AWS set up

Re: Filter data in log files

Re: Filter data in log files

Re: Filter data in log files

Re: Filter data in log files

Re: Filter data in log files

Re: Fetching data from lookup file

Re: Fetching data from lookup file

Re: Fetching data from lookup file

Fetching data from lookup file

Re: Filter data in log files

Filter data in log files

Re: Event Line Break

Re: Event Line Break

Event Line Break

Join the Conversation