cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
dharanpdeepak
Explorer
Member since: ‎11-07-2013
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎11-07-2013
Activity Feed
View All

How to get two universal forwarders running from o...

by in Getting Data In
‎07-30-2014 08:05 PM
‎07-30-2014 08:05 PM
Hello, Please could anyone advice me, how I can get two instance of Universal forwarders run from one Linux Box? I am aware that we can use a single forwarder to forward to multiple indexes; however in my case I am not allowed to touch or alter the existing forwarder as it is mission critical; however I am tasked to do a POC to confirm the forwarding will work to a sandbox machine where we are testing some new Splunk server configurations. Please can someone help me resolve this problem ? Thanks. ... View more

Re: Why does Splunk truncate logs with xml content...

by in Dashboards & Visualizations
‎07-01-2014 06:25 AM
‎07-01-2014 06:25 AM
Thanks Martin, this is very useful; we don't have anything older than 1998 (the sample I have above is a dummy sample).. I will now have to look further if this is the case.. I will update my findings here. I tried indexing the same data with splunk 6 in a sandbox; and it works seamlessly without this issue; I guess it might be that splunk team might have fixed this in the latest versions of splunk! ... View more

Re: Why does Splunk truncate logs with xml content...

by in Dashboards & Visualizations
‎07-01-2014 04:59 AM
‎07-01-2014 04:59 AM
Thanks Martin for your quick response; we do not have an entry against this source-type in our props.conf. One more quick question? how did you calculate that splunk would identify id="93993493" as 1972 ? ... View more

Why does Splunk truncate logs with xml content?

by in Dashboards & Visualizations
‎07-01-2014 04:01 AM
‎07-01-2014 04:01 AM
Hello, I am trying to log events like the one below (with the xml content) however 2014-06-30 19:10:35,637 INFO [RnApp] (pool-11-thread-6 - ajp-0.0.0.0-12209-2 E9944F6B7A094983782B7D2CF1FA2050.node1876 POST /sahok/randor.jsp 5623432387 L CA_EN) DEBUG response XML = <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <message> <payload> <placeOrderResponse requestId="23434-ou234-983483-p234i34o" id="93993493"> <order merchantOrderId="299209344" FKOrderId="E4X2309098340338"> <frDisposition>Orange</frDisposition> </order> </placeOrderResponse> <payload> <message> For some reason my splunk randomly ignores anything after the opening <payload> tag, eg: 2014-06-30 19:10:35,637 INFO [RandomApp] (pool-11-thread-6 - ajp-0.0.0.0-12209-2 E9944F6B7A094983782B7D2CF1FA2050.node1876 POST /sahok/randor.jsp 5623432387 L CA_EN) DEBUG response XML = <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <message> <payload> Please could someone help me resolve this issue? the source file also contains other types of events; however they are parsed without any issues by splunk. We are using Splunk 4.2.3 version. Thanks ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma given to
View All