About MAMAOUI

MAMAOUI · ‎02-01-2021

Hello All, I have Two errors on the search cluster for ANY search in Splunk. Two errors per indexer: ERROR - Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup ERROR - Could not load lookup=LOOKUP-minemeldfeeds_src_lookup Can anyone give me in the right direction for a solution to this errors? Thanks

MAMAOUI · ‎08-10-2018

Hello, Thanks Donald, I added instrumentation script in the suppress stanza “[configuration_check://confcheck_script_errors]” in local and it worked , i don't see message error anymore.

MAMAOUI · ‎07-11-2018

I have the same probleme,I verified the input.conf ... and still getting same message error, did you find any solution?Thanks

MAMAOUI · ‎06-29-2018

ok I will try .thank you

MAMAOUI · ‎06-28-2018

I used KV_MODE=JSON and it works but my probleme is that i have 2 json format in the same data : {"key1":"value1", "key2":"value2", "key3": "{\"key30\":values30,\"key31\":values31........ \"}"} I dont know if there are any way to use spath in props , some thig like Eval-Key3=spath .... Thankyou

MAMAOUI · ‎06-27-2018

Hello , I used spath command to extract field from json data: {"key":"value", "key":"value", "key":"value", "key":"value", "key":"value" ...} and I got the results that I wanted (.. | spath input = json) My question is how can I get the same results in props.conf or transforms.conf? Thank you for answer M&A

MAMAOUI · ‎06-25-2018

Hello I have an index(es) that are beginning to rapidly fill up,how can i determine the reason and solve it?! Thanks M&A

MAMAOUI · ‎06-20-2018

Hi All, Every minute I receive the error: msg="A script exited abnormally" input="./bin/instrumentation.py" stanza="default" status="exited with code 114" I get this error after upgrading to Splunk 7.1.1. Thanks M&A

MAMAOUI · ‎11-15-2017

Hello , Thank you, It works now,I added the \ before the |. Meryem

MAMAOUI · ‎11-15-2017

Hi I have this log format for extracting Sep 01 09:55:11 @ipdest HSL: @ip1:port1 <-> @ip2:port2 | @ip3:port3 <-> @ip4:port4 REGEX = (?\S+\s+\d+ \d+:\d+:\d+) (?\d+.\d+.\d+.\d+)[^[]HSL: (?<@ip1>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip2>\d+.\d+.\d+.\d+):(?\S+) | (?<@ip3>\d+.\d+.\d+.\d+):(?\S+) <-> (?<@ip4>\d+.\d+.\d+.\d+):(?\S+) I would like to extract everything , but in my results, all fields were exctracted except whose after pipe | (@ip3:port3 <-> @ip4:port4). Any help much appreciated. Thankyou.

MAMAOUI · ‎10-17-2017

Hi Giuseppe, So, how can I deploy Apps manually ? Thanks MAMAOUI

MAMAOUI · ‎10-13-2017

Hi All, Is there a way to make deployments from SH without going through CM? and how we can do it? What settings do we have to change or to configure for deploying? Thanks M&A

MAMAOUI · ‎10-02-2017

Hi All I'm looking for informations or methods on integrating RMS (Rights Management service/Office365) into Splunk (Linux). I'm not sure if we can use the APT (powershell) .... I checked online - But not able to find any informations. Thanks

Posts	13
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎08-22-2017

Online Status	Offline
Date Last Visited	‎10-24-2022 04:30 PM

ERROR lookup minemeldfeeds

How to use spath command in props.conf or transfor...

why my indexes are filling up quickly

Error after upgrading to version 7.1.1.

Regex field extraction question

deployment from SH

Can we use the powershell/ APT for integration of ...

ERROR lookup minemeldfeeds

Re: Why i am getting error : msg="A script exited ...

Re: Why i am getting error : msg="A script exited ...

Re: How to use spath command in props.conf or tran...