About jerrin

pgoldweic · ‎06-30-2021

I seem to be experiencing the same issue as reported here with a very small/simple csv file that suggests to me that only csv columns which have *at least* one non-empty value in them are being imported. Could somebody please confirm whether this is expected behavior (hopefully not) or some sort of bug?.

jerrin · ‎03-02-2020

I am a newbie and I have understood basics on how to use the props.conf. But I dont find any doc on ingesting events from AWS SQS then how do I config the props.conf file to include event_timestamp as _time. Definition says in props.conf is always based on source | sourcetype | host ; correct me here if I am wrong. But in case of AWS SQS, all the 3 values are same for more than 1 index. I want this change only for 1 specific index. Appreciate some insight sourcetype: aws:s3:accesslogs source: "s3://jjacob-stats/prod/*.gz" host: ip-10-0-0-255

richgalloway · ‎02-06-2020

First, you should know about the Inherited Deployments manual (https://docs.splunk.com/Documentation/Splunk/8.0.1/InheritedDeployment/Introduction). It contains a lot of good guidance on how to figure out what you have. Obviously, something changed a few weeks ago. Finding it will be the challenge. Start by verifying the forwarder is running. Verify it can connect to the indexer ("enterprise"). If it can't, check the firewalls on each server as well as the AWS security groups on each end.

jerrin · ‎02-28-2020

Thanks for the above solution. As a newbie it really helped me to explore more. But I am trying to fig out how to define the props.conf if the source is ingested from the AWS SQS. Right now its indexed on index time. I have a field that is created_timestamp and prefer the events to be indexed on that TS. my sourcetype sourcetype="aws:s3:accesslogs" if I search like this index=* sourcetype="aws:s3:accesslogs" I get 4 indexes but I want this to impact on just 1 index and set my timestamp. Please help me!

Posts	5
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎12-13-2019

Online Status	Offline
Date Last Visited	‎10-14-2020 01:41 PM

Ingest events from AWS SQS but how to config times...

Why am I not receiving events into Splunk enterpri...

Columns missing while using the Add Data to upload...

Re: Columns missing while using the Add Data to up...

Ingest events from AWS SQS but how to config times...

Re: Why am I not receiving events into Splunk ente...

Re: Why is Splunk index evaluation of _time incons...