About mawwx3

mawwx3 · ‎07-28-2010

I still get this error when I open the page: This view has a Splunk.Module.HiddenSearch module but it is configured with no child modules to push its changes to. This represents a configuration error.

mawwx3 · ‎07-26-2010

Yes, I get the following when I go to the view: This view has a Splunk.Module.ConvertToIntention module but it is configured with no child modules to push its changes to. This represents a configuration error.

mawwx3 · ‎07-22-2010

I am trying to create a custom view to enable a user to select a category that drives a search to produce results with the ammap feature. The events I am dealing with are with proxy logs and I want to be able to select observed or denied from the dropdown. I attempted to do this with the simplified view codes but couldn't make it work. Here is what I have for the xml view code: <view onunloadCancelJobs="False" autoCancelInterval="100">  <label>Sample search</label> <module name="AccountBar" layoutPanel="appHeader"/> <module name="AppBar" layoutPanel="navigationHeader"/> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="HiddenSearch" layoutPanel="mainSearchControls"> <param name="search"> index="foo" filter="$Filter Result$" | rename foo_ip as "ip"| search ip!=192.168* ip!=0.0.* ip!=10.* | stats count by ip | eval count_label="Event" | eval iterator="ip" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="filtered_data.xml" | eval app="FOOBAR" | lookup geoip clientip as ip | mapit</param> <param name="earliest">-2m</param> <param name="latest">-0m</param> <module name="StaticSelect"> <param name="settingToCreate">Filter Result</param> <param name="label">Filter</param> <param name="staticFieldsToDisplay"> <list> <param name="label">Any</param> <param name="value">*</param> </list> <list> <param name="label">OBSERVED</param> <param name="value">OBSERVED</param> </list> <list> <param name="label">DENIED</param> <param name="value">DENIED</param> </list> </param> <module name="ConvertToIntention"> <param name="settingToConvert">Filter Result</param> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="Filter Result">$Filter Result$</param> </param> </param> </module> </module> <module name="ServerSideInclude" > <param name="src">filtered_map.html</param> </module> </module> </view> I have tried to make this work, but I am still learning how to apply the advanced xml code. Any help would be appreciated.

mawwx3 · ‎06-28-2010

I have used the SEDCMD to take out an excess time that was added to the beginning of my logs so that the timestamp would use the second time (now the only time) showing in the event. The timestamp however still does not correspond to the time in the event. Here is my props.conf: [dns_data] SEDCMD-dns = s/^\S+\s+\S+\s+\S+\s+// Here is an event I am looking at (after the SEDCMD has taken affect): foo.bar.com Mon Jun 28 11:42:02 2010: 123.123.123.12 -> 122.122.122.22: 60053 NOERR 'some.thing.com.' A IN (a#2) (n#6) (x#3) ANS some.thing.com. A IN 123.123.123.23 The timestamp however shows: 6/28/10 11:44:11.000 AM Which does not correlate to the time in the event. What can I do to fix this? Thanks.

mawwx3 · ‎06-28-2010

How would one go about setting up a search-time field extraction to offset or ignore the first field?

mawwx3 · ‎06-28-2010

I have splunk indexing a local file that is being continuously written to and I need the first word in each event to not be indexed so that bluecoat will extract the proper fields. Here is an example log: Something 2010-06-25 22:09:45 194 123.123.123.123 - - - OBSERVED "none" 0 TUNNELED unknown - ssl 122.122.122.122 443 - - 123.12.12.123 8676 833 - none - - medium *.fubar.com "Sweet Deals" I need the "Something" to not be indexed or not show up because it is offsetting the field extractions for the bluecoat app. Any comments are appreciated. Thanks,

mawwx3 · ‎06-25-2010

I entered in the suggested code for props.conf and it still does not extract the correct time. I really don't know why it will not take it. It acts like it doesn't even read the [dns_data] stanza. Would there be any other reason why it would not read it or act upon it?

mawwx3 · ‎06-23-2010

My events have two different times in them, one from when the dns server processed them, and then another is added to the beginning of the events from what I assume is splunk. I want splunk to treat the second time as the events timestamp. I have manually assigned the sourcetype for the port as dns_data. Here is part of my props.conf file from $SPLUNK_HOME/etc/sys/local: props.conf-- [sourcetype::dns_data] TIME_PREFIX = \w+ \d+ \d\d:\d\d:\d\d foo\.bar\.com TIME_FORMAT = %b %d %H:%M:%S %Y Here are some events: Jun 23 16:29:19 foo.bar.com Wed Jun 23 16:27:15 2010: 123.123.123.123 -> 321.321.321.321: 52826 NOERR 'something.somewhere.com.' A IN (n#5) (x#9) Jun 23 16:29:19 foo.bar.com Wed Jun 23 16:27:15 2010: 123.123.231.321 -> 25.321.321.31: 1572 NOERR 'something.somewhere.com.' AAAA IN (x#1) Jun 23 16:29:19 foo.bar.com Wed Jun 23 16:27:15 2010: 213.213.21.231 -> 123.123.123.123: 25373 NOERR 'something.somewhere.com.' A IN (a#1) (n#6) (x#11) ANS 'something.somewhere.com. A IN 21.231.231.21 Any help would be appreciated. Thanks.

mawwx3 · ‎06-14-2010

I have my sourcetype set to manual for the port I have listening for this data. Can I just use [manual] then in props.conf or should I change the sourcetype?

mawwx3 · ‎06-14-2010

The only other stanzas I have in my props.conf file are eventtype stanzas that relate to creating custom fields with the same host. I have stanzas in eventtypes.conf and transforms.conf accordingly for the eventtype stanzas. I am still trying to get the props.conf file down, so how do I use[sourcetype] in the props.conf file as you say?

mawwx3 · ‎06-14-2010

I followed the directions for configuring custom timestamps for events with multiple timestamps but I am not getting the result I am looking for. Here is my props.conf in my $Splunk_home$/etc/system/local/ folder: [host::foo.bar.com] TIME_PREFIX = \w+ \d+ \d\d:\d\d:\d\d foo.bar.com\s+ TIME_FORMAT = %b %d %H:%M:%S %Y Here are a couple of entries that I am dealing with: Jun 14 08:18:20 foo.bar.com Mon Jun 14 08:16:25 2010: 123.123.123.12 -> 231.231.231.23: 43645 NOERR 'a.b.cdf.net.' AAAA IN (x#1) Jun 14 08:18:20 foo.bar.com Mon Jun 14 08:16:25 2010: 124.124.124.12 -> 232.232.2.232: 14267 NOERR 'b.somestuff.net.' A IN (a#1) (n#4) (x#4) ANS abc.somestuff.net. A IN 213.12.213.123 I would like the timestamp to correspond to the time given after foo.bar.com but the timestamp is shown as the time at the beginning of each entry before foo.bar.com. Any help would be appreciated.

Posts	11
Solutions	0
Karma Given	1
Karma Received	3
Member Since	‎06-14-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Building an Advanced View with Dropdown Menus

Timestamp Issues

Editing logs at index time

Multiple Timestamps

How to Configure timestamps for events with multip...

Re: Building an Advanced View with Dropdown Menus