Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About khandelwaly
khandelwaly
Explorer
Member since:
12-26-2019
10-01-2024
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 12-26-2019 |
Activity Feed
- Posted Re: splunk does not show all data for type completed for jenkins_statistics on All Apps and Add-ons. 09-30-2024 08:58 PM
- Posted splunk does not show all data for type completed for jenkins_statistics on All Apps and Add-ons. 09-30-2024 01:23 PM
- Karma Re: How to extract a particular field and value from JSON data in Splunk? for ITWhisperer. 12-12-2020 11:58 AM
- Posted How to extract a particular field and value from JSON data in Splunk? on Splunk Search. 12-12-2020 10:37 AM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 10:11 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 10:09 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 02:46 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 02:44 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 01:54 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 01:52 PM
- Posted Re: how to configure inputs.conf? on Getting Data In. 04-14-2020 01:50 PM
- Posted how to configure inputs.conf? on Getting Data In. 04-14-2020 01:18 PM
- Tagged how to configure inputs.conf? on Getting Data In. 04-14-2020 01:18 PM
- Tagged how to configure inputs.conf? on Getting Data In. 04-14-2020 01:18 PM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:42 AM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:35 AM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:32 AM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:08 AM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:00 AM
- Posted Re: dedup not giving any results. on Splunk Search. 02-06-2020 09:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-30-2024
08:58 PM
Sorry for not providing enough information earlier. We are running 5 jobs daily in our system but we are seeing some jenkins job data are not getting reported back on splunk. Out of 5, splunk shows only 3 jobs if we have the query like index=jenkins_statistics (host=abc.com/*) event_tag=job_event type=completed job_name="*abc/develop*"
| stats count by job_name, type If we remove the type from the above query, we get more data which tells us that some jobs are marking as started but splunk not getting the completed event for the same job, hence data discrepancies are there. So just wanted to check do we have guaranteed delivery for Splunk event from Jenkins to Splunk? As per my understanding, events are sent to an Splunk HTTP Endpoint Collector endpoint and they are sent fire and forget Either some of the events are getting dropped at that level or there is a bug somewhere in the https://plugins.jenkins.io/splunk-devops plugin that is causing events to get missed
... View more
09-30-2024
01:23 PM
we are using splunk forwarder to forward the jenkins data to splunk. Noticed that splunk does not display all the data.
here is the example:
index=jenkins_statistics (host=abc.com/*) event_tag=job_event job_name="*abc/develop*"
| stats count by job_name, type returns completed = 74 and started = 118
Ideally whatever is started should also be completed. so can you help me figuring out what could be the problem?
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
12-12-2020
10:37 AM
We have the below data, out of which I wanted to extract a particular field and value from the json format. PLATFORMINSTRUMENTS {“timestamp”:“1607797705",“instrumentList”:[{“name”:“dbcp.numIdle”,“value”:“100”},{“name”:“entity.versions.total”,“value”:“66137”}{“name”:“http.session.objects”,“value”:“2443”},{“name”:“dbcp.numActive”,“value”:“0”},
{“name”:“http.sessions”,“value”:“544”},
{“name”:“dbcp.maxActive”,“value”:“-1”}]} expected output: dbcp.numActive : 0
... View more
Labels
- Labels:
-
field extraction
04-14-2020
10:11 PM
logs file name is access_log.2020-04-14. No folder with name access_log.
Tried without access_log folder as well but it didnot work
... View more
04-14-2020
02:44 PM
Splunk restart is fine. Only files under the mentioned directory is not shown on Splunk. Need help to configure the inputs.conf
... View more
04-14-2020
01:54 PM
Tried below but still failing
[monitor:///apps/logs/]
index = prdidx
blacklist = \.(gz)$
whitelist = access_log\.*$
sourcetype =ACCESS
_TCP_ROUTING = WEB
... View more
04-14-2020
01:52 PM
I removed the / but still the same thing. I don't want to read all the files in that directory. I want to only read access_log
... View more
04-14-2020
01:18 PM
i have logs like this :
-rw-r----- 1 jira jira 4921534 Apr 13 22:42 catalina.2020-04-13.log
-rw-r----- 1 jira jira 463769261 Apr 14 00:00 access_log.2020-04-13
-rw-r----- 1 jira jira 2840014 Apr 14 13:08 catalina.2020-04-14.log
-rw-r----- 1 jira jira 222675515 Apr 14 13:08 access_log.2020-04-14
How to configure inputs.conf for the access_log
I tried below but it didnot work
[monitor:////apps/logs/access_log]
index = prdidx
blacklist = .(gz)$
sourcetype = ACCESS
_TCP_ROUTING = WEB
... View more
02-06-2020
09:08 AM
yes replacing x.x.x.x with actual ip
i figured out referer value is coming empty, it means "https://google.com/6492" is not getting picked if i try to add the results in table
... View more
02-06-2020
09:00 AM
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
x.x.x.x sadfkanfadskf lsds [06/Feb/2020:08:13:23 -0800] "GET https://tests.com/generate HTTP/1.1" - - - "https://tests.com/34490" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0" "el1z6d"
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
... View more
02-06-2020
09:00 AM
like this
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
x.x.x.x sadfkanfadskf lsds [06/Feb/2020:08:13:23 -0800] "GET https://tests.com/generate HTTP/1.1" - - - "https://tests.com/34490" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0" "el1z6d"
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
... View more
02-06-2020
08:37 AM
splunk query
index=prdidx sourcetype="OUTPUT" source="http-access.log" NOT "ELB-HealthChecker/2" | rex "(?<ipaddr>((\d+).(\d+).(\d+).(\d+))) (?P<req_id>[^ ]+) (?P<user_name>[^ ]+) [(?P<timestamp>[^]]+)] \"(?P<req_url>[^\"]+)\" (?<http_status_code>\d+) (?<resp_size>\d+) (?<req_time>\d+) \"(?P<referer>[^\"]+)\" \"(?P<req_agent>[^\"]+)\" \"(?P<session_id>[^\"]+)\"" | search NOT user_name=- |search NOT user_name=test_monitor |dedup session_id
... View more
02-06-2020
08:33 AM
splunk query
index=prdidx sourcetype="OUTPUT" source="http-access.log" NOT "ELB-HealthChecker/2" | rex "(?<ipaddr>((\d+)\.(\d+)\.(\d+)\.(\d+))) (?P<req_id>[^ ]+) (?P<user_name>[^ ]+) \[(?P<timestamp>[^\]]+)\] \"(?P<req_url>[^\"]+)\" (?<http_status_code>\d+) (?<resp_size>\d+) (?<req_time>\d+) \"(?P<referer>[^\"]+)\" \"(?P<req_agent>[^\"]+)\" \"(?P<session_id>[^\"]+)\"" | search NOT user_name=- |search NOT user_name=test_monitor |dedup session_id
... View more
02-06-2020
08:33 AM
index=prdidx sourcetype="OUTPUT" source="http-access.log" NOT "ELB-HealthChecker/2" | rex "(?<ipaddr>((\d+)\.(\d+)\.(\d+)\.(\d+))) (?P<req_id>[^ ]+) (?P<user_name>[^ ]+) \[(?P<timestamp>[^\]]+)\] \"(?P<req_url>[^\"]+)\" (?<http_status_code>\d+) (?<resp_size>\d+) (?<req_time>\d+) \"(?P<referer>[^\"]+)\" \"(?P<req_agent>[^\"]+)\" \"(?P<session_id>[^\"]+)\"" | search NOT user_name=- |search NOT user_name=test_monitor |dedup session_id
... View more
02-06-2020
08:19 AM
I am not getting any results back using dedup
search query:
index=prdidx sourcetype="OUTPUT" source="http-access.log" NOT "ELB-HealthChecker/2"
| rex "(?((\d+)\.(\d+)\.(\d+)\.(\d+))) (?P[^ ]+) (?P[^ ]+) \[(?P[^\]]+)\] \"(?P[^\"]+)\" (?\d+) (?\d+) (?\d+) \"(?P[^\"]+)\" \"(?P[^\"]+)\" \"(?P[^\"]+)\""
| search NOT user_name=- |search NOT user_name=test|dedup session_id
search data:
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
x.x.x.x sadfkanfadskf lsds [06/Feb/2020:08:13:23 -0800] "GET https://tests.com/generate HTTP/1.1" - - - "https://tests.com/34490" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0" "el1z6d"
x.x.x.x estsdfasf dsfads [06/Feb/2020:08:13:23 -0800] "GET https://google.com HTTP/1.1" 200 5925 0.0200 "https://google.com/6492" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134" "gbhaxl"
... View more
12-26-2019
02:56 AM
Hi Team,
I want to show comparison graph of jenkins pipeline steps between two jenkins build. How can i get it?
i am able to get the table with all duration, stage name with following queries.
index="jenkins_statistics" (host=jenkins.com/test) event_tag=job_event type=completed "stages{}.name"="" "stages{}.children{}.exec_node"="" |rename stages{}.duration as stageduration | rename stages{}.name as stageName | rename "stages{}.children{}.exec_node" as pipeline_nodes| eval exec_nodes=mvdedup(pipeline_nodes)
| eval build_on_node=coalesce(exec_nodes, node) | table build_on_node, job_name, stageName, stageduration
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2024
12:41 AM
|
