Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About payl_chdhry
payl_chdhry
Explorer
Member since:
03-12-2020
03-08-2021
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 03-12-2020 |
Activity Feed
- Karma Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched for gjanders. 03-08-2021 07:58 AM
- Posted Re: Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-26-2021 06:53 AM
- Posted Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
- Tagged Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
- Tagged Does one search uses one CPU core (indexer) by default or does it depend on indexes being searched on Splunk Enterprise. 02-25-2021 10:22 PM
- Tagged Check Persistent queue utilization on Splunk Enterprise. 02-23-2021 10:07 PM
- Tagged Check Persistent queue utilization on Splunk Enterprise. 02-23-2021 10:07 PM
- Tagged Check Persistent queue utilization on Splunk Enterprise. 02-23-2021 10:07 PM
- Posted Check Persistent queue utilization on Splunk Enterprise. 02-22-2021 08:17 PM
- Posted Re: why Searches running on only one Indexer ? on Archive. 11-12-2020 05:19 AM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-19-2020 03:08 AM
- Posted Index time masking maintaining string length (continue) on Getting Data In. 08-19-2020 03:08 AM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-19-2020 01:19 AM
- Karma Re: Index time masking maintaining string length for thambisetty. 08-19-2020 12:46 AM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-19-2020 12:45 AM
- Karma Re: Index time masking maintaining string length for cpetterborg. 08-19-2020 12:38 AM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-19-2020 12:32 AM
- Tagged Re: Index time masking maintaining string length on Getting Data In. 08-19-2020 12:32 AM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-18-2020 09:13 PM
- Posted Re: Index time masking maintaining string length on Getting Data In. 08-18-2020 09:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-26-2021
06:53 AM
Thanks @scelikok for your response. Is there a way we might be able to determine (not necessary accurately) how many CPU cores a search might utilize on indexer (if we know approx bucket size). We are facing performance issue and so I would like to understand and hopefully explain to users regarding their search depending on the indexes they search on.
... View more
02-25-2021
10:22 PM
Hi, I am trying to understand a bit on how searches impact CPU usage on indexers. Does one search uses one CPU core by default or does it depend on indexes being searched Sometimes I have seen high CPU usage when large index is being searched or when users have multiple indexes as default and they do not specify, so multiple indexes are searched. Note: It is single query, no subqueries.
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-22-2021
08:17 PM
We have TCP port open for a particular source. I have added persistent queue for this particular port as users were reporting random data loss. Is there a way to check persistent queue utilization in realtime and its historic values. Even after adding queue, users are still reporting some data loss and have not been able to confirm if this update had any positive impact due to retention period. I would like to see if: 1) persistant queue is beeing utilized 2) IS the queue filling up as well. I need to check this via queries preferably. Appreciate any help that could be provided!!
... View more
Labels
- Labels:
-
troubleshooting
11-12-2020
05:19 AM
Hi ramarcsight, Very old thread but did you manage to resolve this issue. Would be good if you are able to respond with any helpful information.
... View more
08-19-2020
03:08 AM
just did 🙂 https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length-continue/m-p/514890#M87226
... View more
08-19-2020
03:08 AM
Posting a new question similar to my query from post: https://community.splunk.com/t5/Getting-Data-In/Index-time-masking-maintaining-string-length/td-p/514705 I have same requirement but for different format of string. I am trying to customize the rex/sed (SEDCMD=s/(?=[^\|]+\w{4}]$)./#/g) for this format but have not been able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
08-19-2020
01:19 AM
Sorry m new to posting here. How do I upvote a post once I have marked anther post as answer.
... View more
08-19-2020
12:45 AM
@cpetterborg Thank you for this. It worked 🙂 I had one more query in case you might be able to help. I have same requirement but for different format of string. I am trying to customize this rex/sed for this format as well but not able to achieve it yet. 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "00000123456 " 1 240 should give me: 2020-08-19T07:42:38,942 [Engine 9] TRACE MEHSegment WHERE "00" "0000012XXXX " 1 240
... View more
08-19-2020
12:32 AM
@to4kawa that would replace the whole matching string with single #, like below: 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|A454FFDPP01] To: 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|#PP01] My requirement is to replace each character (and not whole string) with X so the count of characters replaced before masking is equal to count of Xs. 2020-08-19T07:28:32,032 [Engine 8] TRACE SegmentLocks V13 added [1|XXXXXXXPP01]
... View more
- Tags:
- @
08-18-2020
09:13 PM
great. Let me try this. @cpetterborg
... View more
08-18-2020
09:11 PM
@thambisetty yes the length would be dynamic. It should be anywhere between say 8 to maybe 20.
... View more
08-18-2020
06:55 AM
Hi, I want to do masking for logs at index time but the replaced value ("X" here) should be same character length as original string. My requirement for masking is that for the value within [] only last 4 characters should be visible. Example for below logs: 2020-08-18T13:17:43,990 [Engine 1] TRACE log data V01 [1|12345678] 2020-08-18T13:17:44,979 [Engine 2] TRACE log data V02 [2|A35453DFDF65] The indexed logs should be: 2020-08-18T13:17:43,990 [Engine 1] TRACE log data V01 [1|XXXX5678] 2020-08-18T13:17:44,979 [Engine 2] TRACE log data V02 [2|XXXXXXXXDF65] Currently I am using SEDCMD command as below but that is taking only static length for X: s/(TRACE\slog\s+data\s+V\d+\s+\[\d\|)(\w+)(\w{4})/\1XXXXXX\3/g Is there a way to replace string at index time with another string maintaining the count of characters.
... View more
Labels
- Labels:
-
heavy forwarder
-
Linux
-
other
-
props.conf
03-12-2020
11:50 PM
found any solution for this? We too as facing issue with tilde as delimiter.
... View more
03-12-2020
09:16 AM
We too are facing this issue and the only solution we have been able to come up change delimiter before upload.
We are using ~ as delimiter in csv file. Using FIELD_NAMES parameter to provide header field names. It is extracting fine but we are not able to search data using extracted field unless we use "*" in search.
Were you able to resolve it.
Adding INDEXED_VALUE = false did not work.
... View more
03-12-2020
09:12 AM
sddfdsfdsfdsfdsfdsfd
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2021
12:54 PM
|
