About tsukasa

tsukasa · ‎03-04-2021

Nope, still an open issue. No one from support will address it either. Guessing I'll have to talk to an account manager to get any traction on the problem.

tsukasa · ‎01-20-2021

I've installed the v8.2.0 Splunk App for Unix and Linux on my search head per the instructions in the documentation. However, restarting Splunk throws an error of: Bad regex value: '(?::){0}*', of param: props.conf / [(?::){0}*]; why: this regex is likely to apply to all data and may break summary indexing, among other Splunk features. This appears to be coming from the {%appdir%}\default\props.conf file: ## Dropdowns [(?::){0}*] LOOKUP-dropdowns = dropdownsLookup host OUTPUT unix_category unix_group As a result, the Metrics page in the app is non-functional. Is anyone else having this issue? What did you do resolve it?

tsukasa · ‎05-16-2011

Hi All~ I am trying to build a query to generate a list/table that shows me devices that have not sent in a specific message to be indexed by Splunk in the last 30 hours. I believe I will need to create a subsearch to identify all devices that have communicated with any message in the last 30 days. [ host="Jetstream" earliest=-30d@d | dedup EventId | fields LogicalDeviceId ] The LogicalDeviceId is the unique name for each device being indexed. I want to use that field as the basis for the main search. host="Jetstream" and sourcetype="ObjectEvent" earliest=-30h@h [ subsearch here ] | fields LogicalDeviceId, EventTime For reference, an ObjectEvent looks like: <Jetstream xmlns="http://Jetstream.TersoSolutions.com/v1.0/ObjectEvent"><Header EventId="02d42360-d0df-48f4-aa85-dc5cede9cc4a" EventTime="2011-05-16T05:53:31Z" LogicalDeviceId="10000092" ReceivedTime="2011-05-16T05:57:10Z" /><ObjectEvent><DeviceExtensionList /></ObjectEvent></Jetstream> The resulting list would be those LogicalDeviceIds that have not sent in an ObjectEvent in the last 30 hours. I'm seeing a couple problems. One is obviously speed on the subsearch. Any suggestions how to speed it up? I'm guessing there's a way to do unique on the LogicalDeviceId... The second is I'm not getting any results back. Thanks for the help!

tsukasa · ‎05-10-2011

That did the trick. However, there seems to be some strangeness when working with other panel types. For example, I have a table with <searchPostProcess>fields EventTime, sourcetype, LogEntryType, Message, TemperatureA, TemperatureB, EventId</searchPostProcess> and it pulls out some fields. That's what was confusing me. Thanks again for the help!

tsukasa · ‎05-10-2011

Any idea why the chart is displayed when the full search is used in and does not when split up with and ? This is for a 'View' with a form submit. Split it looks like: <searchTemplate>host="Jetstream" AND LogicalDeviceId="$logicaldeviceid$" | dedup EventId</searchTemplate> and <searchPostProcess>search sourcetype="SensorReadingEvent" | fields EventTime, TemperatureA, TemperatureB | stats first(TemperatureA) as TemperatureA, first(TemperatureB) as TemperatureB by EventTime</searchPostProcess>

tsukasa · ‎05-09-2011

You have the correct line of thinking. There is a custom field extraction, TemperatureA , that exists for when there are multiple <Reading> nodes. If it helps, the search criteria I have created already is: host="Jetstream" AND sourcetype="SensorReadingEvent" AND LogicalDeviceId="10000452" | dedup EventId | <rest of search> When I add in your first suggestion, it gives me the results in a Results Table. However, instead of the _time factor just being say hourly, it is broken up into 30 minute intervals. This leaves gaps in the resulting max(temp) column. For me the ideal would be a time column based on the ReadingTime key/value and a second column for TemperatureA . It would be a one for one listing and not a summary. However, I'm not sure the charting allows for direct input like that. Hopefully that makes sense. As for the data source, its more for system monitoring of devices. I'm attempting to create a Device-centric view/dashboard for quick assimilation of data the device is reporting.

tsukasa · ‎05-09-2011

Hi All~ Have a question about charting. I have a simple XML message being sent in from my devices that I am having Splunk parse. One of the messages coming in indicates temperature that the device sensor read when the message was generated. The message looks like: <Jetstream><Header EventId="f0189627-3d41-4d94-9338-20d8c3627d8e" EventTime="2011-05-09T17:05:54Z" LogicalDeviceId="10000452" ReceivedTime="2011-05-09T17:06:08Z" /><SensorReadingEvent><ReadingList><Reading Name="TemperatureA" Value="-21" ReadingTime="2011-05-09T17:05:54Z" /></ReadingList></SensorReadingEvent></Jetstream> All I want to do is create a simple line graph for the last 24 hours for 'Temperature A' with time on X and temperature value on Y. I've tried timechart and chart with various options but haven't been able to figure out the correct syntax to get the graph I'm looking for. Any suggestions? Thanks!

Posts	7
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-06-2011

Online Status	Offline
Date Last Visited	‎03-04-2021 04:02 PM

Splunk App for Unix and Linux Bad Regex

Search for non-indexed message

Single Value Over Time Graph

Re: Splunk App for Unix and Linux Bad Regex

Splunk App for Unix and Linux Bad Regex

Search for non-indexed message

Re: Single Value Over Time Graph

Re: Single Value Over Time Graph

Re: Single Value Over Time Graph

Single Value Over Time Graph