About gliptak

gliptak · ‎03-17-2021

I have a number of events searchable by: index=main sourcetype="myevents" All of them show foo field with value bar When adding that as a filter to my query: index=main sourcetype="myevents" foo=bar no results are returned. If I update above to index=main sourcetype="myevents" foo="bar*" I do get results. Any pointers on how to see the real value of foo? PS I couldn't print foo as list of characters. The closest I got was | rex field=foo mode=sed "s/(.)/\1+/g" which printed b+a+r+ note the last character seems to 'r'

gliptak · ‎03-02-2021

Is there a way to validate default date parsing against ISO8601 ( 2012-11-02'T'14:34:02,781-07:00 ) date/time? I tried | makeresults | eval _raw="2012-11-02'T'14:34:02,781-07:00 foo=bar" and the timestamp is not being parsed. I also tried with no success setting sourcetype=log4j Any pointers for the syntax to work this? There are a number of threads without complete approaches around this https://community.splunk.com/t5/forums/searchpage/tab/message?advanced=false&allow_punctuation=false&filter=location&location=forum-board:getting-data-in&q=ISO8601

gliptak · ‎11-13-2020

The gets me part way there. Shift-Enter works for newline. Would you also have a pointer for inserting Tab?

gliptak · ‎11-12-2020

Running | makeresults | eval s="foo\nbar" displays foo\nbar and it is unclear if the variable has a newline or just contains "\n" Is this the right syntax to insert newline (tab)?

gliptak · ‎11-05-2020

sourcetype wasn't configured while above event was indexed Configuring the sourcetype with SHOULD_LINEMERGE = false might not work well as events have multi-line fields

gliptak · ‎11-05-2020

While using print() to emit events from Python input, sometimes the events from separate print statements get merged. An example (edited) below: 2020-11-05T20:23:21.988802+00:00, application="application1" 2020-11-05T20:23:21.993878+00:00, application="application2" I'm unclear why these particular ones got merged (there were other records print() -ed at 2020-11-05T20:23:21, and all events had increasing/unique timestamp) Any pointers on how to prevent this? Thanks

gliptak · ‎04-21-2020

You could start with index=_internal sourcetype="splunk_web_access" sideview_utils

Posts	7
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎04-21-2020

Online Status	Offline
Date Last Visited	‎04-27-2021 05:21 PM

field values with "invisible" characters?

validate default date parsing support for ISO8601

inserting newline, tab into eval-ed field

events print()-ed from Python input merged

field values with "invisible" characters?

validate default date parsing support for ISO8601

Re: inserting newline, tab into eval-ed field

inserting newline, tab into eval-ed field

Re: events print()-ed from Python input merged

events print()-ed from Python input merged

Re: Is there a search or CLI command to determine ...