Hello , I was testing the json extraction for a json data and its missing to index the last loop (Which is highligthed in Bold) starting from the RuntimeTasks.   Please help with the props.conf {     "Variant": "Tidesa",     "File": "hello.hex",      "Testgroup": "Accent",     "Results": [                             {                                   "TestModule": "CustComm_CustIf",                                   "Name": "Customer Output",                                   "TestCases": [                                                                  {                                                                       "ID": 46563,                                                                       "Title": "asfs_Signals",                                                                        "Tested": 1,                                                                         "Result": 1                                                                   },                                                                  {                                                                       "ID": 46564,                                                                       "Title": "af46564_ValueAverage",                                                                       "Tested": 1,                                                                       "Result": 1                                                                   }                                                        ]                                       }                             ],              "RuntimeTasks": null,             "BUILD_NUMBER": "306",             "JOB_BASE_NAME": "testing_PG",             "JOB_URL": "https://is-jvale.de.ats.com/Acp/job/Mks/job/RB_MS_jfaj_fajja_testing/306",              "NODE_NAME": "ast967" } ... View more

How to completely remove/not select the directory path if it "remote" in its folder structure   my regex --- specification|Cu Req|Cu Spec|02 - Regulatory|\\*\\remote|| directory struture  /specification/Cu Req/remote/value --- remove complete path /specification/system/val_remote/cmd/system - remove since its has word as "remote" /specification/system/value/remote--- remove the path /specification /system/value/cmd/sys32 - consider   ... View more

I am looking for an solution for table row expansion and collapse through with button click. if expand button is clicked it should expand all the rows in table and same vice versa for collapsing. How to do it with javascript?. please help me with it. ... View more

we are not sure how data i stored in IBM ALM and what concept of storage it is, now we are looking for an solution to collect and index data to splunk directly from IBM ALM . do anyone have idea or solution implemented how to collect data or idea how to approach it? ... View more

is it possible to append more than 10k records between 2 index?How to overcome this withou modifying conf file and adding any parameter thro SPL ... View more

I am running python script and collecting array of Json data into single events. multiple events are clubbed into single events. i want to spilt each json data into new events. i added below props.conf but its not spiltting the events. @kamlesh_vaghela  {"ErrorCode": 0, "ErrorMessage": null, "Name": "test", "Description": null, "EngineeringUnits": null, "Comment": null, "CollectorName": "BRnjbnTC-Mkjk8_Calculation", "CollectionType": 2} {"ErrorCode": 0, "ErrorMessage": null, "Name": "BR-MSL68.Lmkmnjk26_MIP.P1.ond", "Description": "Lmnnkj26_MlknlkIP..knnlkC01.Second", "EngineeringUnits": null, "Comment": null, "CollectorName": "BRknk-MSLAnk8_OPC_Intelnkjklution_Intkjkellutionkjkjkver", "CollectionType": 2} {"ErrorCode": 0, "ErrorMessage": null, "Name": "BC-MSLA;k;okpoB0168.L26_MnlkjIP.PLC0jnlk1.UDE_SlkjlkIM_TRIlklj;lkGGER", "Description": "L26_Mjklj", "EngineeringUnits": null, "Comment": null, "CollectorName": "BRjkjTC-kljkljlkjik", "CollectionType": 2}     [PsG_SddT_Tags] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=true NO_BINARY_CHECK=true LINE_BREAKER=}(\,){ SEDCMD-break=s/({"ErrorCode": \[)//g SEDCMD-b=s/]}$//g TRUNCATE = 0     ... View more

I have log which has time stamp, tag, and i calculating how many time has been occurred per day. i want to get results if the events has been continuously happened on last 4 days but its returns for last 5 days. As we see below 21st has no data but still it reported as time range selected was last 4 days.   index=* | eval epochtime=strptime(Log_Message_Time, "%m/%d/%Y %H:%M:%S") | eval Event_Date=strftime(epochtime, "%d-%m-%Y") | stats delim="," values(Tag) AS _Tag values(Buffer_Value) AS Buffer_Value values(diff) AS diff count AS Per_Day_Occurance BY Event_Date host | mvexpand Buffer_Value | mvcombine Log_Message_Tag | rename host AS Server | eventstats count AS Days BY Server | search Days>=4 | join type=left Server [|inputlookup pg_ld_production_servers | table Server Site] | table Site Server Event_Date Log_Message_Tag Per_Day_Occurance diff | sort Event_Date | rename Log_Message_Tag AS "Historian Tag" Event_Date AS "Event Date"       host event date tag Occured per day             BELL-MESAPPBC1 20-05-2021 tag1,tag2,tag3 2           2 host 22-05-2021 tag2,tag4,tag5,tag1 3           3 host 23-05-2021 tag1 4           4 host 24-05-2021 tag2,tag3 5                                 ... View more

I have configured collectd but not getting the correct data in splunk. some of the package like system architecture,version,os details are reported but not metrics data.       # systemctl status collectd ● collectd.service - Collectd statistics daemon Loaded: loaded (/usr/lib/systemd/system/collectd.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2021-05-07 09:26:56 EDT; 1min 6s ago Docs: man:collectd(1) man:collectd.conf(5) Main PID: 10493 (collectd) Tasks: 11 Memory: 1.3M CGroup: /system.slice/collectd.service └─10493 /usr/sbin/collectd May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none] May 07 09:27:56 abc109 collectd[10493]: Available write targets: [none]       ... View more

i want to index data with 1st line as header and index data from second row as new line vice versa   CONTAINER ID,IMAGE,COMMAND,CREATED,STATUS,PORTS,NAMES 8c0e092b6815,thomsch98/kafdrop:latest,"/usr/local/bin/mvn-…",3 days ago,Up 3 days,PAServices_kafdrop.1,yen4hgju18kkfgq9bvud7e1w8 35fe9af4efa0,thomsch98/kafdrop:latest,"/usr/local/bin/mvn-…",3 days ago,Exited (137) 3 days ago,PAServices_kafdrop.1,x2r2tuosozdd9uzfnq7ejdi70   ... View more