Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashraf_sj
ashraf_sj
Explorer
Member since:
01-10-2020
04-29-2024
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 01-10-2020 |
Activity Feed
- Posted Re: service status of a service including Disaster Recovery situation on Splunk Search. 04-29-2024 01:10 AM
- Karma Re: service status of a service including Disaster Recovery situation for renjith_nair. 04-29-2024 01:07 AM
- Posted service status of a service including Disaster Recovery situation on Splunk Search. 04-24-2024 07:09 AM
- Posted Re: Why is Splunk is restarting itself? on Splunk Enterprise. 10-03-2023 08:58 AM
- Karma Why is Splunk is restarting itself? for jason0. 10-03-2023 08:57 AM
- Posted timechart success/fail from log on Dashboards & Visualizations. 07-18-2023 01:10 AM
- Posted Re: how to define a generic sourcetype regex for service status on Splunk Search. 12-17-2021 04:30 AM
- Karma Re: how to define a generic sourcetype regex for service status for isoutamo. 12-17-2021 04:30 AM
- Posted how to define a generic sourcetype regex for service status on Splunk Search. 12-17-2021 03:45 AM
- Tagged how to define a generic sourcetype regex for service status on Splunk Search. 12-17-2021 03:45 AM
- Tagged how to define a generic sourcetype regex for service status on Splunk Search. 12-17-2021 03:45 AM
- Posted Re: Extracting fields from _raw in Splunk on Splunk Search. 12-09-2021 05:39 AM
- Karma Re: Extracting fields from _raw in Splunk for gcusello. 12-09-2021 05:37 AM
- Karma Re: Extracting fields from _raw in Splunk for ITWhisperer. 12-09-2021 05:37 AM
- Posted Extracting fields from _raw in Splunk on Splunk Search. 12-09-2021 04:59 AM
- Tagged Extracting fields from _raw in Splunk on Splunk Search. 12-09-2021 04:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-29-2024
01:10 AM
Thanks @renjith_nair , this works, I have used the OverallStatus as condition to alert. Thanks a lot and much appreciated.
... View more
04-24-2024
07:09 AM
Just in a situation where I have 2 servers, where 1 is active and the other is passive. I had to deploy the TA on both the servers and report the service status of a service. So the active server would be reporting the service is "Running" and the passive server would say the service is "stopped" I have tried writing up a SPL but my only worry is if there is a situation when the service stops on the active server how to get it reported. or if there is no data from the active server. There should be atleast 1 server reporting the service is "Running" always. Only during the DR situation the server name would change index=mday source="service_status.ps1" sourcetype=service_status os_service="App_Service" host=*papp01
| stats values(host) AS active_host BY status
| where status=="Running"
| append
[ search index = mday source =service_status.ps1 sourcetype = service_status os_service="App_Service" host=*papp01
| stats latest(status) AS status by host,os_service,service_name ]
| filldown active_host
| where active_host=host AND status!="Running"
| table host,active_host,os_service,service_name,status Any help is much appreciated
... View more
Labels
- Labels:
-
stats
07-18-2023
01:10 AM
I'm trying to find the job that had failure and success, this is being ingested into Splunk as a job log. I have to plot this as a time chart based on hours for that day. eg. Today As there is no criteria to say it ran successfully, I had to capture just the error in the log to say that JOB_NUMBER failed. Sample of success log, 7/18/23 8:40:58 AM INFO Start Date and Time: 7/18/23 8:40:58 AM
7/18/23 8:40:58 AM INFO Job Number: 1000000018011
7/18/23 8:40:58 AM INFO Project Name: PROJECT XXX
7/18/23 8:40:58 AM INFO Submitted By: SSS
7/18/23 8:40:58 AM INFO Submitted From: Scheduler
7/18/23 8:40:58 AM INFO System: SERVER
7/18/23 8:40:58 AM INFO APP NAME
7/18/23 8:40:58 AM INFO Executing project 'XYZ'
7/18/23 8:40:58 AM INFO Project location: /some/where/in/NAS/file.xml
7/18/23 8:40:58 AM INFO Executing module 'Main'
7/18/23 8:40:58 AM INFO Executing task 'sftp 1.0 (Connect to SFTP)'
7/18/23 8:40:58 AM INFO Connecting to 'someserver' at port '22' as user 'XXX'
7/18/23 8:40:58 AM INFO Executing sub-task 'put'
7/18/23 8:40:58 AM INFO Setting the data type to BINARY
7/18/23 8:40:58 AM INFO 0 files were uploaded successfully
7/18/23 8:40:58 AM INFO Finished sub-task 'put'
7/18/23 8:40:58 AM INFO Closed the FTP connection
7/18/23 8:40:58 AM INFO Finished task 'sftp 1.0 (Connect to SFTP)'
7/18/23 8:40:58 AM INFO Executing task 'move 1.0 (Move uploaded files to Archive)'
7/18/23 8:40:58 AM INFO 0 files were moved successfully
7/18/23 8:40:58 AM INFO Finished task 'move 1.0 (Move uploaded files to Archive)'
7/18/23 8:40:58 AM INFO Finished module 'Main'
7/18/23 8:40:58 AM INFO Finished project 'PROJECT XXX'
7/18/23 8:40:58 AM INFO End Date and Time: 7/18/23 8:40:58 AM SPL to get the total jobs and plot to time chart for each hour of the day index=xxx sourcetype=job_sourcetype source=job_log
| rex "Job Number: (?P<JOB_NUMBER>.+)"
| dedup JOB_NUMBER
| rex "Start Date and Time: (?P<START_DATE_TIME>.+)"
| eval DATE_TIME=strftime(START_DATE_TIME,"%d/%m/%Y %H")
| timechart span=1h count AS TOTAL_JOBS BY DATE_TIME Sample log of failed job, 7/18/23 8:15:58 AM INFO Start Date and Time: 7/18/23 8:15:58 AM
7/18/23 8:15:58 AM INFO Job Number: 1000000018003
7/18/23 8:15:58 AM INFO Project Name: XYX PROJECT
7/18/23 8:15:58 AM INFO Submitted By: SOMEONE
7/18/23 8:15:58 AM INFO Submitted From: Scheduler
7/18/23 8:15:58 AM INFO System: SERVER
7/18/23 8:15:58 AM INFO APP NAME
7/18/23 8:15:58 AM INFO Executing project 'SOME PROJECT'
7/18/23 8:15:58 AM INFO Project location: /some/where/in/nas/file.xml
7/18/23 8:15:58 AM INFO Executing module 'Main'
7/18/23 8:15:58 AM INFO Executing task 'timestamp 1.0 (Current date)'
7/18/23 8:15:58 AM INFO Default system date, time, and timestamp variables have been created and/or set to the current date and time '2023-07-18 08:15:58.182'
7/18/23 8:15:58 AM INFO Finished task 'timestamp 1.0 (Current date)'
7/18/23 8:15:58 AM ERROR [1234 - Copy All Files Except Offer Pack Files 'file name/directory' not found. Full stack trace written to '1000000018003_error_1.log'
7/18/23 8:15:58 AM INFO Continuing with the next task or module, if any
7/18/23 8:15:58 AM ERROR [1235 - Copy All Files Except Offer Pack Files 'file name/directory' not found. Full stack trace written to '1000000018003_error_2.log'
7/18/23 8:15:58 AM INFO Continuing with the next task or module, if any
7/18/23 8:15:58 AM INFO Finished module 'Main'
7/18/23 8:15:58 AM INFO Finished project 'SOME PROJECT'
7/18/23 8:15:58 AM INFO End Date and Time: 7/18/23 8:15:58 AM SPL to get the job errors and time chart for hour of the day. index=xxx sourcetype=job_sourcetype source=job_log error
| rex "Job Number: (?P<JOB_NUMBER>.+)"
| dedup JOB_NUMBER
| rex "Submitted From: (?P<SUBMITTED_FROM>.+)"
| rex "Start Date and Time: (?P<START_DATE_TIME>.+)"
| eval DATE_TIME=strftime(START_DATE_TIME,"%d/%m/%Y %H")
| rex max_match=0 "ERROR (?P<ERROR>.*)"
| where SUBMITTED_FROM="Scheduler"
| timechart span=1h count AS JOB_FAILURE BY DATE_TIME Both the sources are from same index, source and sourcetype. I need to plot a chart with both total jobs and failures for that hour as a stacked bar chart. The struggle here is to combine these 2 queries to get a time chart showing both total jobs and failure. I tried showing up success and failure but no luck.
... View more
Labels
- Labels:
-
timechart
12-17-2021
04:30 AM
@isoutamo . true the default line breaker should do the trick. Have removed the pattern and left with the default line breaker now and looks to work perfectly. I did over complicate a simple solution. thanks LINE_BREAKER=([\r\n]+)
... View more
12-17-2021
03:45 AM
Hi, I have a script which can pull the service status for each of the service, I have defined it to be a common sourcetype, LINBREAK - regex pattern ([\r\n]+)\w+\=\"\w+\"\,\w+\=\"\w+\"\,\w+\=\d\,\w+\=\"\w+\" on the script it would output as below sample service_name="XXXX",os_service="jboss",status_value=1,status="Running" It was alright until I started monitoring microservices which breaks the above pattern on the os_service field Sample output, If you see the issue here, the os_service now has "-" in between and it varies for each of the sub services or os_service,. Is there any generic way to capture anything under os_service with a common regex so if we pass any os_service name it would handle both the normal os_service as above in example and also be used for microservices os_service. service_name="Microservices",os_service="xx-xx-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-application-service",status_value=1,status="Running"
service_name="Microservices",os_service="buxx-service",status_value=1,status="Running"
service_name="Microservices",os_service="xx-cuxxxxxx-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxxx-organisation-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxxx-event-service",status_value=1,status="Running"
service_name="Microservices",os_service="coxx-xxx-check-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-bxx-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-pxxx-sanXXXXX-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-core-application-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-core-cuxxxxxx-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-core-organisation-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-core-event-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-core-xxx-check-service",status_value=1,status="Running"
service_name="Microservices",os_service="gateway-service",status_value=1,status="Running"
service_name="Microservices",os_service="xxx-bxx-service",status_value=1,status="Running"
... View more
- Tags:
- regex
- sourcetype
Labels
- Labels:
-
regex
12-09-2021
05:39 AM
Both of the options work, I have accepted the first as an answer, though the second solution also works. . Thanks to @ITWhisperer and @gcusello for a prompt response. much appreciated and kudos for all your works
... View more
12-09-2021
04:59 AM
Hi All, I'm trying to extract 2 fields from _raw but seems to be a bit of struggle I want to extract ERRTEXT and MSGXML, have tried using the option of extraction from Splunk and below are the rex I got, The issue with the below rex for ERRTEXT is that it pulls all the MSGXML content as well. If there could be regex to extract something after ERRTEXT and MSGXML it would be great | rex field=_raw "^(?:[^=\n]*=){7}(?P<ERRTEXT>.+)"
| rex field=_raw "^(?:[^=\n]*=){8}(?P<MSGXML>.+)" Sample of the data that has been ingested in Splunk, this is data is from Splunk DB connect that is getting pushed over to Splunk 2021-12-09 09:56:00.998, FACILITY_DETAILS="/v1/facilities/XXXX/arrears", FACILITY_ID="101010/", TIMESTAMP="2021-12-09 03:41:06.768342", CORRELATION="414d51204d425032514d30322020xxxda4b", ORIGIN="FROMORIGIIN", ERRCODE="code":"400",", ERRTEXT="detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}", MSGXML="{"errors":[{"id":"3a59de59-8b99-4e4a-abfb-XXXXXX","status":"400","code":"400","title":"days_past_due is invalid","detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}" 2021-12-09 09:56:00.998, FACILITY_DETAILS="/v1/facilities/XXXX/arrears", FACILITY_ID="101010/", TIMESTAMP="2021-12-09 03:41:06.768342", CORRELATION="414d51204d425032514d30322020xxxda4b", ORIGIN="FROMORIGIIN", ERRCODE="code":"400",", ERRTEXT="detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}", MSGXML="{"errors":[{"id":"3a59de59-8b99-4e4a-abfb-XXXXXX","status":"400","code":"400","title":"days_past_due is invalid","detail":"must be greater than the previously recorded value of 105 days","source":{"pointer":"/data/days_past_due"}}]}"
... View more
- Tags:
- extraction
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-29-2024
11:52 AM
|
Karma given to
