About sarahnazzar

ITWhisperer · ‎02-16-2023

If you have no control over the editing process, how are you going to determine who did what and when?

ITWhisperer · ‎11-05-2022

@Yulworm Please can you open a new providing more detail on your usecase?

sarahnazzar · ‎08-02-2022

Hello Splunkers! Receiving the below error under splunkd.log for the UFs 08-02-2022 12:41:53.695 +0200 ERROR TailReader [8108 tailreader0] - Ignoring path="D:\xx\yy\filename" due to: Bug: tried to check/configure STData processing but have no pending metadata. Checked in splunk community answers(https://community.splunk.com/t5/Getting-Data-In/TailingProcessor-Ignoring-path-quot-path-to-xyz-quot-due-to-Bug/m-p/198762) and found that setting CHARSET for the related source/source type in related props.conf stanza to CHARSET = AUTO in UF works fine and it did work fine for some time but can any one help me out on why this ERROR is occurring in the UF? as I'm receiving this error intermittently, at times frequently for few logs. The fix provided is the answers works for some time only again that particular UF is throwing the same error, can anyone please help me on this! Thanks in Advance! Sarah

sarahnazzar · ‎06-24-2022

Thanks for the response! @isoutamo 🙂

sarahnazzar · ‎05-18-2022

Hello Splunkers!! Can anyone please help me on whether the below Solaris version is compatible with Splunk UF version as I can see only Solaris 11 Sparc and Solaris 10,11 64-bit Version UF package is there. Is there any other way to monitor from this Solaris server? Checked in https://docs.splunk.com/Documentation/Splunk/8.2.6/Installation/Systemrequirements#Supported_Operating_Systems as well. Solaris Version: SunOS 5.10 Generic_150400-49 sun4u sparc SUNW,SPARC-Enterprise Many thanks! Sarah

sarahnazzar · ‎05-06-2022

@richgalloway Many thanks that worked!! 😊

sarahnazzar · ‎04-21-2022

Many thanks @smurf this worked!! 🙂

isoutamo · ‎02-01-2022

If I recall right, there could be something special with DB/2 on AS400/iSeries/OS400? There seems to be some instructions how to use/connect with jdbc on net. You should just use google to find those. r. Ismo

aasabatini · ‎04-16-2021

Hi @sarahnazzar what browser do you use? Splunk is on premise or Cloud?

richgalloway · ‎05-27-2020

NOT is allowed in that use case, but must be accompanied by AND or OR . For example, |eval Result=case(searchmatch("Issue-1111"), "Desc 1", searchmatch("Issue-1122"), "Desc 2", searchmatch("Failure-1212"), "Desc 3", searchmatch("Failure-1111"), "Desc 4", (searchmatch("Failure-") AND NOT searchmatch("Failure-1111") AND NOT searchmatch("Failure-1212") , "All Failures Excluding Desc3&4"))

shivanshu1593 · ‎05-12-2020

Agreed. Thank you for the correction @jkat54 . I answer via my phone, and auto correct must have changed it.

to4kawa · ‎05-04-2020

| rex mode=sed "s/(?m)(\w\w)\s?/%\1/g" your HEX is multivalue or contains \n

wmyersas · ‎12-09-2019

If you have a good deployment strategy, the simplest thing to do is nuke-pave-reinstall the "misbehaving" cluster members

sarahnazzar · ‎05-06-2019

Thanks for the reply! Tried this but I'm getting the below error while selecting custom time.. This one is not working for custom time input. Invalid latest_time: latest_time must be after earliest_time.

sarahnazzar · ‎02-18-2019

Thanks for the help! It's working fine..

sarahnazzar · ‎11-02-2018

Thanks a lot!! The above solution is working fine.

poete · ‎06-08-2018

Hi. Can you be lease ive more details? In case you use the color by value configuration, do you want to keep the color and change the ranges, or keep the ranges and changes the colors, or both?

sarahnazzar · ‎05-06-2020

Hello @shivarpith You can have a look at this, may be this helps. https://answers.splunk.com/answers/339920/where-should-i-check-for-pythonlog-error-messages.html Cheers!

jkat54 · ‎05-06-2020

As long as you've properly setup internal log forwarding as per best practices... this search will show the python logs. index=_internal sourcetype=splunk_python

sarahnazzar · ‎05-06-2020

Hello @arber You can have a look at this, may be this helps. https://answers.splunk.com/answers/339920/where-should-i-check-for-pythonlog-error-messages.html Cheers!

Posts	47
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎04-13-2017

Online Status	Offline
Date Last Visited	3 weeks ago

How to take a backup of lookup file?

Ignoring path="x" due to: Bug: tried to check/conf...

Can we monitor .accdb file in Splunk?

Is Splunk UF compatible with Solaris 5.10 32-bit V...

How to monitor logs from Different Time Zones?

How to write inputs.conf to Monitor files in a dir...

AS400 and Splunk Integration

Service Unavailable while trying to Preview PDF of...

Can't we use NOT in searchmatch function

Suggestions to write an alert if event B occurs wi...

Re: Take a backup of lookup file

Re: Alert if event B occurs without event A

Ignoring path="x" due to: Bug: tried to check/conf...

Re: Can we monitor .accdb file in Splunk ?

Is Splunk UF compatible with Solaris 5.10 32-bit V...

Re: Monitor logs from Different Time Zones

Re: Monitor files in a directory which is dynamic

Re: AS400 and Splunk Integration

Re: Service Unavailable while trying to Preview PD...

Re: Can't we use NOT in searchmatch function

Re: Search query to fetch the list of servers

Re: Convert HEX data to Text via search query

Re: How to clean up a search head in a search head...

Re: How to have dynamic time range selection for d...

Re: Splunk Alert

Re: How do you Increment the date by using a date ...

Re: How to change the color series dynamically in ...

Re: error occurred while generating PDF in search ...

Re: Where to find the python.log for details on an...

Re: Error while gen3erating a pdf report

Join the Conversation