About remy06

remy06 · ‎05-09-2012

I did that.I'm able to view only certain words appearing now but part of the events are still distorted and the same error message.

remy06 · ‎05-08-2012

I've just configured splunk to index a file that contains events for the last 30 days. Within these events I want to search for all events that fall between 8pm and 8am only. The format of events are such: 4/30/2012 6:48:32 PM,"xxxxx\xxxxxx","xxxxx",........." 4/30/2012 8:50:30 PM,"xxxxx\xxxxxx","xxxxx",........." .... Splunk has automatically extracted this field "Date_time" > "4/30/2012 6:48:32 PM" Any idea?

remy06 · ‎05-07-2012

I've got our AS400 admin to extract a sample AS400 events to file(AS400) for splunk to index using the script that comes with the app. I'm configuring data inputs to monitor the file now but the data preview gives an error: Failed to decode 1003 bytes: source::/opt/input/AS400 The events give these unreadable characters: \xD0\xCF\x11\x1A\xE1\x00\x00\x00\..... \x00\x00\x1\x00\x00\x00\x00\......... Other than that,we also tried extracting the file to a .txt format. The events showed up but some of the values isn't at the correct fields. They are being truncated and moved to incorrect fields.

remy06 · ‎04-19-2012

I've scheduled a number of PDF reports to be emailed out. Most I've received are fine except for one. This PDF report does not have results,ie.the timeline is blank and the table results are being greyed out by a blank box. I'm able to do a search in splunk fine.Any advise?

remy06 · ‎03-28-2012

I seem to be collecting some pan_system logs after place the config.However the host field isn't reflecting the actual pan device ip.How should I amend it?

remy06 · ‎03-28-2012

Theres no data shown in the app. Do I configure the inputs.conf at /opt/splunk/etc/apps/SplunkforPaloAltoNetworks/local or /opt/splunk/etc/system/local ? I'm currently taking in the logs already and sourcetype as syslog. Here's my config for inputs.conf [udp://5555] connection_host = ip1|ip2 sourcetype = pan_log no_appending_timestamp = true Anything I've missed?

remy06 · ‎01-31-2012

any status?

remy06 · ‎01-10-2012

Here's the output search [app_log] system ANNOTATE_PUNCT = True system BREAK_ONLY_BEFORE = system BREAK_ONLY_BEFORE_DATE = True system CHARSET = UTF-8 system DATETIME_CONFIG = /etc/datetime.xml search EXTRACT-Time = (?i)^[^"]*"(?P<Time>[^ ]*)(?= ) system HEADER_MODE = system LEARN_SOURCETYPE = true system LINE_BREAKER_LOOKBEHIND = 100 system MAX_DAYS_AGO = 2000 system MAX_DAYS_HENCE = 2 system MAX_DIFF_SECS_AGO = 3600 system MAX_DIFF_SECS_HENCE = 604800 system MAX_EVENTS = 256 system MAX_TIMESTAMP_LOOKAHEAD = 128 system MUST_BREAK_AFTER = system MUST_NOT_BREAK_AFTER = system MUST_NOT_BREAK_BEFORE = system SEGMENTATION = indexing system SEGMENTATION-all = full system SEGMENTATION-inner = inner system SEGMENTATION-outer = outer system SEGMENTATION-raw = none system SEGMENTATION-standard = standard system SHOULD_LINEMERGE = True system TRANSFORMS = system TRANSFORMS-null = setnull system TRUNCATE = 10000 system maxDist = 100

remy06 · ‎01-10-2012

Hi MuS, I've checked that [app_log] is the sourcetype.The sourcetype I've defined for application logs is app_log.Is there anything else I've missed?

remy06 · ‎01-09-2012

I've recently upgraded the forwarder to a universal forwarder on our app server.I'm collecting windows event logs as well as app logs on this server where previously parsing was done on it. On the forwarder I've input for windows event logs and have configured to monitor the app log file. These are sent over to the indexer.Here's the configuration: After the upgrade,I've moved the configuration to the indexer and it doesn't seem to work now. app_log is the sourcetype for all logs collected from all app servers.I wish to filter the ip off on all app servers. appserverA is the server that I wish to filter off eventcode 123,456,789,while the rest remain. props.conf: [app_log] TRANSFORMS-null = setnull [host::appserverA] TRANSFORMS-null = setnullappserverA transforms.conf: [setnull] REGEX = (192\.168\.1\.10|192\.168\.1\.18) DEST_KEY = queue FORMAT = nullQueue [setnullappserverA] REGEX = EventCode=(123|456|789) DEST_KEY = queue FORMAT = nullQueue An example of the event: 192.168.1.10 - - [09/Jan/2012:17:46:54] "message" 192.168.1.18 - - [09/Jan/2012:17:46:55] "message" Filtering for the eventcode is successful,but not for the IP.Can anyone advise if I've missed something?

remy06 · ‎01-08-2012

I've set splunk to monitor a log file via data inputs and it has been going on fine till recently. When I noticed splunk had stopped receiving events since last week,I checked the actual log file but the log file is still being updated with events from today.Also didn't notice any issues in splunkd log..The log file is being updated but splunk seems to have stop indexing the events.. Any idea?

remy06 · ‎12-29-2011

Some updates,linux aside,I just did an upgrade for one of our old splunk forwarder(to universal forwarder 4.2.4) on windows server.I've noticed the following: 1) By searching the _internal index method,if the forwarder is shutdown,the indexer will not receive the shutdown event until the forwarder has restarted.(This way we probably will not be alerted when its down?) 2)By monitoring the windows system event log for forwarder shutdown events,when the service is shut down an event will be logged to windows event but the forwarder will not send this event to indexer.Even if the forwarder service has been restarted,the duration when the forwarder is down will not be captured at indexer.(I'm not sure why but seems that the older version of splunk able to do so)

remy06 · ‎12-08-2011

I've been using your suggestions and it works fine,so far if splunk was shut down using .../splunk start/stop on linux. However on linux the privileged user can also execute the "kill" command to stop the service.Wondering what other workarounds you guys have? I've been trying to add a rule in auditd to do the work but it doesn't seem to work yet

remy06 · ‎12-02-2011

we've tried that but doesn't work. found that some of the fields extractions used in the search query have been left private.After changing the permissions for the fields the problem is resolved.Thanks.

remy06 · ‎12-01-2011

I'm not sure if this has been asked. I've a saved search generating reports on a weekly basis.I've just ran the search manually on my pc and browser and I'm able to see the flash timeline as well as the results table. I've tried using firefox 8 and IE7. However,on another user's pc,after running the same saved search,the flash timeline is displayed but the results table is blank.I've tried switching to event table and event list there are data displayed except for the results table. Can anyone advice?

remy06 · ‎09-30-2011

it works..thanks 🙂

remy06 · ‎09-30-2011

thanks!gona test it soon

remy06 · ‎09-30-2011

thanks..I've also updated the example event hopefully its much clearer

remy06 · ‎09-30-2011

there are set of characters in other parts of the event. I've updated the sample.Usually if I specify in transforms.conf the " " becomes the extracted field name. In your example how do I specify the field name?

remy06 · ‎09-30-2011

I'm trying to extract these values into a field called Data. from sample 1: CMD(XYZ) Val(*12A) In props.conf [log] REPORT-mydata = mydata In transforms.conf [mydata] REGEX = (?i).*CMD\((?<Data>\S+)\) but it can only capture the values XYZ after CMD.I wana include the entire string like CMD(XYZ) Val(*12A). How do I specify in the regex to include the entire string? sample 1: Sep 29 13:13:25 10.138.20.37 Sep 29 13:07:25 serverA A command (CMD) was run.|3|src=1.2.3.4 dst=0.0.0.0 msg=TYPE:JRN CLS:AUD JJOB:123 JUSER:user JNBR:123 PGM:abc OBJECT: LIBRARY: MEMBER: DETAIL:C CMD SYS CMD N SYS/CMD LIB(ABCD) DEV(*SA) SAVF(temp) OPTION(*NA) MBROPT(*ALL) OBJ(*ALL) FR(*SYSVAL) **CMD(XYZ) Val(*12A)* Sep 29 13:13:25 10.138.20.37 Sep 29 13:07:25 serverA A command (CMD) was run.|3|src=1.2.3.4 dst=0.0.0.0 msg=TYPE:JRN CLS:AUD JJOB:123 JUSER:user JNBR:123 PGM:abc OBJECT: LIBRARY: MEMBER: DETAIL:C CMD SYS CMD N SYS/CMD LIB(ABCD) DEV(*SA) SAVF(temp) OPTION(*NA) MBROPT(*ALL) OBJ(*ALL) JJJ(*NA) **CMD(XYZ) Val(*12A)*

remy06 · ‎09-18-2011

So...anyone knows where to locate outputs.conf that comes with universal forwarder...

remy06 · ‎09-13-2011

I've re-checked the documentation and followed the syntax. In inputs.conf [monitor:///path.../myfile] host = 1.2.3.4 sourcetype = linux:log outputs.conf [tcpout-server://3.4.5.6:3333] compressed=false Understood that outputs.conf is provided with universal forwarder in the search app.I can't find it, and if were to create it manually should it be placed at opt/splunk/etc/../search/default ?

remy06 · ‎09-07-2011

the file that i'm monitoring is still being updated with events however splunk is not able to index the new events.

remy06 · ‎09-07-2011

The search is source="/path/file.log" on all time.

remy06 · ‎09-07-2011

I've installed universal forwarder on linux system and have configured the forwarder to forward linux log to indexer ip 3.4.5.6: inputs.conf [monitor://path.../myfile] host = 1.2.3.4 sourcetype = linux:log output.conf [tcpout] server = 3.4.5.6 Still unable to receive any logs from the forwarder yet. Anything I've missed?

Posts	123
Solutions	10
Karma Given	0
Karma Received	32
Member Since	‎05-05-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

extract events for specific time period

splunk for AS400 data input configuration issues

Received PDF Report but no result shown

configuring data for splunk palo alto

Filtering events not working

File monitoring issues

Results table no display on user's browser

regex field extraction question

data input & forwarding on universal forwarders

How to detect splunkd shutdown for forwarders?

Re: splunk for AS400 data input configuration issu...

extract events for specific time period

splunk for AS400 data input configuration issues

Received PDF Report but no result shown

Re: configuring data for splunk palo alto

configuring data for splunk palo alto

Re: Filtering events not working

Re: Filtering events not working

Re: Filtering events not working

Filtering events not working

File monitoring issues

Re: detecting splunkd shutdown for forwarders?

Re: detecting splunkd shutdown for forwarders?

Re: Results table no display on user's browser

Results table no display on user's browser

Re: regex field extraction question

Re: regex field extraction question

Re: regex field extraction question

Re: regex field extraction question

regex field extraction question

Re: data input & forwarding on universal forwarder...

Re: data input & forwarding on universal forwarder...

Re: File monitoring not working after re-enabling

Re: File monitoring not working after re-enabling

data input & forwarding on universal forwarders