About cpuppet

cpuppet · ‎08-12-2024

i will give a try thanks for the helps

cpuppet · ‎08-09-2024

I guess that might be the only way thanks a lot

cpuppet · ‎08-09-2024

thank you so much for the help but when I tried the link it doesn't have solaris version in them

cpuppet · ‎09-03-2019

Does anyone has idea how to setup MySQL connection using SSL and certs? I've read the answer below and imported my ca.pem into the keystore, but still not working? Connect Splunk DB Connect to MariaDB with SSL and cert 1 answer https://answers.splunk.com/answers/611126/connect-splunk-db-connect-to-mariadb-with-ssl-and.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev I've also search the web regarding jdbc connections using ssl certs, but still unable to see which or how am I suppose to load these certs into the app so I can connect to my database and the db_connections.conf.spec.example from README folder included in the app doesn't have MySQL usage in it I have ssl-ca=ca.pem ssl-cert=server-cert.pem ssl-key=server-key.pem which of these should I import into keystore/truststore?

cpuppet · ‎12-22-2016

My Splunk DB Connect seems to have some data lost issue connecting to a MSSQL server where the DB is used as customer service loggings. Has anyone face the same problem while tailing a datetime column and missing a few rows comparing data in Splunk and database?

cpuppet · ‎06-21-2012

There are actually 2 parts in my question i want to do an field extraction based on my existing field i have read some of the questions on the answers, and found some possible solutions to my problem but was still unable to the it working correctly i tried with n-level transforms.conf and props.conf way using delims as i think it should be an easy way to separate my field since the data is not fixed with the number of different sections it might have another way my also be using rex but i also found out that i was not able to point out exactly where i want to extract my category i listed out both of my source and my props.conf/transforms.conf example here example.log date,number,/我愛你/你愛他,last,xx12345 date,number,/我愛你/你愛他/他愛他,last,xx12345 date,number,/我愛你/你愛他/他愛他/他愛我,last,xx12345 props.conf [example.log] REPORT-sourcefields = source-fields REPORT-sourcefield3 = source-field3 transforms.conf [source-fields] DELIMS = "," FIELDS = field1,field2,field3,field4,field5 [source-field3] SOURCE_KEY = field3 DELIMS = "/" FIELDS = Category1,Category2,Category3,Category4,Category5,Category6 when using sourcetye="example.log" | rex field=field3 (? ^/{1}\w+) in my search command, i found that it will not recognize my Chinese characters when i use \w+ but it works well in my regex tool anyone has answers to this problem? maybe my regex isn't correct, but i am really exhausted these days...unable to think straight at the moment

cpuppet · ‎02-29-2012

Ayn thanks alot i think i got where i had it worng in the first place your | search [|inputlookup xxx] saved my trouble what i really need...might be this to complete what we are looking for sourcetype ="web_log" | transaction SID XID | search [|inputlookup xid_lookup.csv | fields XID] by this i will be able to filter out the different transactions of SIDs that are included with the particular XID in my table which will also run faster when i add the maxspan for the transaction

cpuppet · ‎02-29-2012

i think i am stuck on this certain for some reason that my head isn't working right when thinking about this problem i have a bunch of web logs that i need to sort out with a certain field (lets say XID) that is only inserted in 1 or 2 lines out of the xxx lines in a complete web transaction this web transaction can be defined with an SID for our transaction command however, i need to find all the transactions that includes n numbers of XID that i have created in a list of XID lookup table my original search sourcetype="web_log" [inputlookup xid_lookup.csv | fields XID] | transaction SID the problem of this search is that it will only given the result of the lines that has the XID in my lookup table but what i really want to do is to list out all the lines in transaction by the SID that includes XID in my lookup table only is it possible to do so?

cpuppet · ‎01-16-2012

it was an example, but i think i found the problem. thanks a lot for the info shared

cpuppet · ‎01-12-2012

I know many people had asked this questions, but I still can't seem to find a good way to solve this problem I have setup my splunk to monitor several folders this my inputs.conf sample [monitor:///opt/splunk/etc/apps/app_name/logs/folder/logfile*] index = myindex sourcetype = my.log I even put crcSalt = to try but it is still not indexing my logs correctly and when i look at the data inputs monitoring page http://localhost:8000/en-US/manager/app_name/data/inputs/monitor I found that the number of file counts are incorrect anyone!!! please enlighten me

cpuppet · ‎01-12-2012

has anyone ever work with polling system information using snmpget and write it into files or using a scripted data input to poll them using snmpget? this is critical for my client who can only offer snmp as the only way to get data from the devices

cpuppet · ‎12-06-2011

try sideview util, it has a detail example and description of how to use html instead of single value module

cpuppet · ‎11-21-2011

i believe it can be done some way with some modification in the background...but not sure which and how... definitely not from OTB function they provided... thanks anyways... cheers

cpuppet · ‎11-21-2011

hi...thank you for the explanation, i will see if i can figure it out before you post the example here

cpuppet · ‎11-14-2011

thanks for the confirmation, though i thought it was impossible, still worth a try if any developers had thought of a brilliant way to make it work...however...my concern also lies with the complexity it would be if having so many segments in such a small chart...

cpuppet · ‎11-14-2011

is there any ways to display different static picture on dashboard depends on different search result. this is sort of like an if-then scenario, which can be crucial to my live dashboard the single event icon color can be changed, so i m wondering if it is possible to display different picture for conditional results. Such as, critical should display pic01 in the my dashboard, low should display pic02 in my dashboard, so on...

cpuppet · ‎10-26-2011

is there anyways to show a whole month of graph with a time span of 5 min window splunk has reduce the chart to 4 days instead of showing the whole month (i would think its to reduce the complexity when showing every little bit in the graph) but just for the heck of wanting to show everything on it... possible?

cpuppet · ‎08-25-2011

Dear Bob, thank you so much, the SEDCMD does work! yes, like twkan said, the regex given had an extra \ before the [ for replacement.

cpuppet · ‎08-25-2011

thanks james, but having an aug at the end of the event logs will still cause me some minor probs, but thank you for the help given.

cpuppet · ‎08-23-2011

Aug 3 23:35:01 192.168.11.11 Forwarded from 192.168.11.30: ash: [Wed Aug 03 23:35:01 2011] [error] [client 114.24.189.86] File does not exist: /WEB/roomi/public_html/img, referer: http://www.roomi.com.tw/web/album/index.php?PA=album_photo&photo_id=3997548 Aug 3 23:35:00 192.168.11.11 Forwarded from 192.168.11.44: root: [Wed Aug 03 23:35:00 2011] [error] [client 118.169.76.35] File does not exist: /WEB/roomi/public_html/img, referer: http://www.roomi.com.tw/web/album/index.php?PA=album_photo&photo_id=4018842 Aug 3 23:35:12 192.168.11.11 Forwarded from 192.168.11.36: ash: [Wed Aug 03 23:35:12 2011] [error] [client 113.61.193.153] Directory index forbidden by Options directive: /WEB/roomi/public_html/upload/family/, referer: http://www.roomi.com.tw/obj/swf/avatar/avatar_buchafarm.swf?ver=2.0.0 Aug 3 23:35:12 192.168.11.11 Forwarded from 192.168.11.57: root: [Wed Aug 03 23:35:12 2011] [error] [client 118.171.233.64] File does not exist: /WEB/roomi/public_html/img, referer: http://www.roomi.com.tw/web/album/index.php?PA=album_photo&photo_id=4004079 with the above example logs, I want to filter out the unnecessary log in bold so that it will not show up in my search results or to be clear on this question is that result must showed up as [Wed Aug 03 23:35:01 2011] [error] [client 114.24.189.76] File does not exist: /WEB/roomi/public*html/img, referer: http://www.roomi.com.tw/web/album/index.php?PA=album*photo&photo_id=3997548 how am i suppose to filter out those unwanted logs? I would try using nullFilter on this, is there any other ways to do it?

Posts	20
Solutions	0
Karma Given	2
Karma Received	3
Member Since	‎04-18-2011

Online Status	Offline
Date Last Visited	‎09-05-2024 11:41 AM

Splunk DB Connect to MySQL with SSL and cert

Splunk DB Connect: Why is data being lost when con...

field extraction on Chinese characters

problem with transaction and inputlookup

file and folder monitoring NOT indexing

snmpget with splunk

conditional event to display different static pict...

a month time of x axis with span of 5 min window?

event log filter/chunk out at index time

Re: Need Splunk Universal Forwarder 7.x

Re: Need Splunk Universal Forwarder 7.x

Re: Need Splunk Universal Forwarder 7.x

Splunk DB Connect to MySQL with SSL and cert

Splunk DB Connect: Why is data being lost when con...

field extraction on Chinese characters

Re: problem with transaction and inputlookup

problem with transaction and inputlookup

Re: file and folder monitoring NOT indexing

file and folder monitoring NOT indexing

snmpget with splunk

Re: How to use single value in HTML on a dashboard...

Re: conditional event to display different static ...

Re: conditional event to display different static ...

Re: a month time of x axis with span of 5 min wind...

conditional event to display different static pict...

a month time of x axis with span of 5 min window?

Re: event log filter/chunk out at index time

Re: event log filter/chunk out at index time

event log filter/chunk out at index time