×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- About sarge338
sarge338
Path Finder
Member since:
09-28-2017
12-30-2024
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 5 |
| Karma Received | 1 |
| Member Since | 09-28-2017 |
Activity Feed
- Posted Re: DBConnect Query Failing After Upgrade on Splunk Enterprise. 12-30-2024 02:47 PM
- Posted DBConnect Query Failing After Upgrade on Splunk Enterprise. 12-30-2024 08:40 AM
- Posted Re: How to find field value, based on where condition, and assign to variable? on Splunk Search. 11-03-2023 11:55 AM
- Posted Re: How to find field value, based on where condition, and assign to variable? on Splunk Search. 09-27-2023 10:02 AM
- Posted How to find field value, based on where condition, and assign to variable? on Splunk Search. 09-27-2023 09:25 AM
- Posted Re: SPL data input to SQL search? on Splunk Search. 03-22-2021 04:25 PM
- Posted SPL data input to SQL search? on Splunk Search. 03-22-2021 10:23 AM
- Tagged SPL data input to SQL search? on Splunk Search. 03-22-2021 10:23 AM
- Tagged SPL data input to SQL search? on Splunk Search. 03-22-2021 10:23 AM
- Tagged SPL data input to SQL search? on Splunk Search. 03-22-2021 10:23 AM
- Tagged SPL data input to SQL search? on Splunk Search. 03-22-2021 10:23 AM
- Posted Re: Find records between dates entered in text boxes on Splunk Search. 03-18-2021 01:51 PM
- Karma Re: Find records between dates entered in text boxes for scelikok. 03-18-2021 01:45 PM
- Karma Re: Adding timerangepicker to Dashboard of Report Panels?? for scelikok. 03-17-2021 06:27 PM
- Posted Find records between dates entered in text boxes on Splunk Search. 03-17-2021 06:26 PM
- Tagged Find records between dates entered in text boxes on Splunk Search. 03-17-2021 06:26 PM
- Tagged Find records between dates entered in text boxes on Splunk Search. 03-17-2021 06:26 PM
- Posted Adding timerangepicker to Dashboard of Report Panels?? on Splunk Search. 03-16-2021 06:26 AM
- Tagged Adding timerangepicker to Dashboard of Report Panels?? on Splunk Search. 03-16-2021 06:26 AM
- Tagged Adding timerangepicker to Dashboard of Report Panels?? on Splunk Search. 03-16-2021 06:26 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-30-2024
02:47 PM
Some additional information that was somehow omitted from my original post.... If I change date range part of the query from "(7 * 8)" to just "7". The query runs fine. If I change "(7 * 8)" to "(7 * 1)", the query runs fine. If I change "(7 * 8)" to "(7 * 2)"... or any number greater than 2... the query fails with the same error as mentioned in the original post.
... View more
12-30-2024
08:40 AM
I have a DBConnect query that runs to populate the panel of a dashboard every week. We upgraded both the database which houses the data AND Splunk a couple of weeks ago. The new database is Postgres 14 and Spunk is not at 9.2.3. I have run this query directly on the Postgres box, so it appears that Postgres doesn't suddenly have an issue with it.
Other panels/queries in this dashboard use the same DBConnect connection, so the path, structure, and data all appear to be good. The issue seems to lie with the "math" in the time range, but I cannot put my finger on why. Basically, we are trying to pull a trend of data going back 8 weeks, starting from last week.
query=" SELECT datekey, policydisposition, count(guid) as events
FROM event_cdr
WHERE datekey >= CURRENT_DATE - CAST(EXTRACT(DOW FROM CURRENT_DATE) as int) - (7*8) AND
datekey < CURRENT_DATE - CAST(EXTRACT(DOW FROM CURRENT_DATE) as int) AND
direction_flag = 1 AND
policydisposition = 1
GROUP BY
datekey, policydisposition
ORDER BY
datekey, policydisposition
When I try to execute this query, I consistently get the following error: "Error in 'dbxquery' command: External search command exited unexpectedly.
The search job has failed due to an error. You may be able view the job in the Job Inspector"
Some of the search.log file is here:
"12-30-2024 16:00:27.142 INFO PreviewExecutor [3835565 StatusEnforcerThread] - Preview Enforcing initialization done 12-30-2024 16:00:28.144 INFO ReducePhaseExecutor [3835565 StatusEnforcerThread] - ReducePhaseExecutor=1 action=PREVIEW 12-30-2024 16:02:27.196 ERROR ChunkedExternProcessor [3835572 phase_1] - EOF while attempting to read transport header read_size=0 12-30-2024 16:02:27.197 ERROR ChunkedExternProcessor [3835572 phase_1] - Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.197 WARN ReducePhaseExecutor [3835572 phase_1] - Not downloading remote search.log and telemetry files. Reason: No remote_event_providers.csv file. 12-30-2024 16:02:27.197 INFO ReducePhaseExecutor [3835572 phase_1] - Ending phase_1 12-30-2024 16:02:27.197 INFO UserManager [3835572 phase_1] - Unwound user context: User338 -> NULL 12-30-2024 16:02:27.197 ERROR SearchOrchestrator [3835544 searchOrchestrator] - Phase_1 failed due to : Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.197 INFO ReducePhaseExecutor [3835565 StatusEnforcerThread] - ReducePhaseExecutor=1 action=QUIT 12-30-2024 16:02:27.197 INFO DispatchExecutor [3835565 StatusEnforcerThread] - Search applied action=QUIT while status=GROUND 12-30-2024 16:02:27.197 INFO SearchStatusEnforcer [3835565 StatusEnforcerThread] - sid=1735574426.75524, newState=FAILED, message=Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.197 ERROR SearchStatusEnforcer [3835565 StatusEnforcerThread] - SearchMessage orig_component=SearchStatusEnforcer sid=1735574426.75524 message_key= message=Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.197 INFO SearchStatusEnforcer [3835565 StatusEnforcerThread] - State changed to FAILED: Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.201 INFO UserManager [3835565 StatusEnforcerThread] - Unwound user context: User338 -> NULL 12-30-2024 16:02:27.202 INFO DispatchManager [3835544 searchOrchestrator] - DispatchManager::dispatchHasFinished(id='1735574426.75524', username='User338') 12-30-2024 16:02:27.202 INFO UserManager [3835544 searchOrchestrator] - Unwound user context: User338 -> NULL 12-30-2024 16:02:27.202 INFO SearchOrchestrator [3835541 RunDispatch] - SearchOrchestrator is destructed. sid=1735574426.75524, eval_only=0 12-30-2024 16:02:27.203 INFO SearchStatusEnforcer [3835541 RunDispatch] - SearchStatusEnforcer is already terminated 12-30-2024 16:02:27.203 INFO UserManager [3835541 RunDispatch] - Unwound user context: User338 -> NULL 12-30-2024 16:02:27.203 INFO LookupDataProvider [3835541 RunDispatch] - Clearing out lookup shared provider map 12-30-2024 16:02:27.206 ERROR dispatchRunner [600422 MainThread] - RunDispatch has failed: sid=1735574426.75524, exit=-1, error=Error in 'dbxquery' command: External search command exited unexpectedly. 12-30-2024 16:02:27.213 INFO UserManagerPro [600422 MainThread] - Load authentication: forcing roles="db_connect_admin, db_connect_user, slc_user, user""
... View more
Labels
- Labels:
-
troubleshooting
11-03-2023
11:55 AM
@gcusello Thank you for all of your help! I apologize for the lag in responding to you. I have been very busy on another project. Your suggestion was spot-on, though, so I wanted to be sure to thank you for your assistance.
... View more
09-27-2023
10:02 AM
Hello @gcusello , The data is already being ingested into Splunk, and if I look at events from the last 10 minutes (index="my-index" earliest=-10m@m latest=@m), the syslog messages from ALL machines are showing up as a single event timestamp. So, I need to compare the sync-time field, which is is epoch, rather than the _time value assigned by Splunk. Thank you for your assistance.
... View more
09-27-2023
09:25 AM
Good Morning! I rarely get to dabble in SPL, and as such, some (probably simple) things stump me. That is what brought me here today. I have a scenario in which I need to pull SYSLOG events from a series of machines that all report the field names. One of those machines is the authoritative source of values, which all of the other systems should have. As an example, I have 3 machines... M1, M2, M3, and each machine reports three field/value pairs... sync-timestamp, version-number, machine-name. I need to compare the sync-timestamp of M1 with the sync-timestamp of the other two machines. My idea is to assign the "sync-timestamp value WHERE computer-name=M1" to a variable by which to compare the other two machines' values. I intend to use this report to ultimately create an alert, so we know if machines are not syncing properly. I just cannot figure out the syntax to make this happen. Can anyone provide some guidance on this? Thank you in advance!
... View more
Labels
- Labels:
-
field extraction
03-22-2021
04:25 PM
My "any other use of inputlookup" has been exclusively in SPL. I am trying to figure out how to get that data into the SQL query as input... for the WHERE clause. Since I really don't know how to use it, I'll show you how I would like for it to work. I just think, if it's possible, that there is some kind of SPL voodoo that I need to do for it to work. | dbxquery
connection="my-remote-data"
timeout=1800 query="
SELECT *
FROM phonecalls
WHERE dateStamp >= to_timestamp('2021-03-08 00:00:00.00','YYYY-MM-DD HH24:MI:SS.MS')
AND dateStamp < to_timestamp('2021-03-15 00:00:00.00','YYYY-MM-DD HH24:MI:SS.MS')
AND destinationnumber IN (MY_INPUT_LOOKUP_FILE)
AND direction = 'INBOUND'
" shortnames=t
| table * Thanks!
... View more
03-22-2021
10:23 AM
Hello All, I have a situation in which I need to use local lookup file as input in another search, however, the secondary search will happen on an external database, using DB_connect. So the question is, how would I read-in the inputlookup file as input (WHERE clause) into a SQL query vs a SPL search? I have done the opposite, in the past... use a lookup file to compare against the results of a SQL query. If it has any bearing on the answer, the lookup file will be a CSV with multiple values for a single field. Thank you.
... View more
03-18-2021
01:51 PM
@scelikok That's a great idea! The person responsible for pulling that data into Splunk is going to do that very thing. I'm just the newbie report guy who is trying to figure out how to get what I need from Splunk. 😉 Once the data is indexed based on the eventTime, I should be good to go. Thanks for the suggestion.
... View more
03-17-2021
06:26 PM
Good Evening, I have, what appears to be, a unique situation. I have tried every means that I could find even vaguely related to my problem. The Scenario Data, which each record having it's own epoch-based timestamp, is being imported into Splunk weekly. As a result, indexed timestamps are nowhere near the actual record timestamp. My dashboard has two text boxes in which the user can input a date range (with formatting guidance) for the records' timestamps which fall between those dates. The Problem No matter how I try to format string inputs, I cannot retrieve the records within those dates. What's worse is, when I include my WHERE statement, I don't get ANY records returned. I have been working on this for hours, but I am no closer now than when I began. The Code My input tokens for the text boxes are "date_start" and "date_stop". The field "eventTime" is the record's timestamp in epoch time. <query>index=customer sourcetype=json_no_timestamp custApiKey=d8lwmc9qjd778ksmfy
| eval _start=strptime($date_start$, "%Y-%m-%d")
| eval _start=strftime(_start, "%s")
| eval _stop=strptime($date_stop$, "%Y-%m-%d")
| eval _stop=strftime(_stop, "%s")
| where (_start >= eventTime) AND (_stop < eventTime)
</query> Any help would be GREATLY appreciated!
... View more
03-16-2021
06:26 AM
Hello Everyone, This may be an odd question, but I am wondering how (if possible) to add a useful timerangepicker to a dashboard in which all panels are from existing reports. In the past, the dashboard has just been run for "Last 7 Days", which all of the reports are set up for. Recently, a feature has been desired to allow the user to select the time range for which the data will be presented. Obviously I can add the timerangepicker and submit button pretty easily, but how do I tie the chosen time range to the reports in the panels without recreating everything? Thank you for your time and assistance!
... View more
05-06-2019
06:37 AM
That worked beautifully! Now my entire dashboard can populate without straining the database.
Thanks!!
... View more
04-03-2019
12:06 PM
@niketnilay that looks JUST like what I'm looking for! I'll give that a shot, and let you know how it goes!
Thanks!!
... View more
04-03-2019
11:08 AM
Hello
I have a regular report that I have to provide to a customer, and we are utilizing Splunk as the mechanism to retrieve the data from the source. The dataset is too large to pull down and process locally, so I have several different look-ups written to pull specific data views for the report. However, since we are connecting to an external database to pull the data, I would like to limit the "hit" that database takes at one time.
With that said, is there a way to "control" how Splunk executes panel look ups? For instance, panel 1 executes immediately. After panel one contains data, panel 2 executes. After panel 2 contains data, panel 3 executes. And so on...
I have seen one strategy that basically has sub-searches off of one master search's data, but again, that data set would be so big, I don't know that a master search would even complete. Hence, I am looking for other options. Otherwise, I will continue to have to run individual look ups manually, which is not efficient.
Thank you.
... View more
11-22-2017
06:51 AM
1 Karma
Thank you, cmerriman. This was the easiest answer/solution to implement. I greatly appreciate the assistance.
... View more
11-16-2017
05:28 AM
Hello cmerriman,
Yes, they are text. The code is below...
<input type="text" token="startTime_token">
<label>Start Date (YYYY-MM-DD HH:MI:SS)</label>
</input>
<input type="text" token="endTime_token">
<label>End Date (YYYY-MM-DD HH:MI:SS)</label>
</input>
... View more
11-15-2017
01:29 PM
I have a dashboard in which the customer can enter a start date/time, end date/time, and a string. I then use the information entered to query two different (not Splunk) databases to find/present records which contain the string entered which occur between the data/time entries.
The issue I am having is that the two databases store the timestamps in different formats. So, regardless of what format I have the user enter the date/time, it does not agree with one of the two systems.
So, how can I a date/timestamp that is valid for one system (2017-11-15 16:22:30), and convert it to a new token that is valid for the second system (11-15-17 16:22:30)?
I attempted to use the following, but it appears I have no idea where "eval" can be used. 🙂
<eval token='$conv_startTime_token$'>strptime($startTime_token$,%m-%d-%y %h:%M:%S)"</eval>
Thank you!
... View more
11-15-2017
01:14 PM
Sukisen1981,
Thank you for the sample code. I had to manipulate it a little, but it was close enough to get me where I needed to be.
The assistance is much appreciated.
... View more
09-28-2017
01:39 PM
Sukisen1981,
Thank you for the quick response!!
I'll work on figuring out how to "extract" the area code and prefix (234-567) from the query results for this purpose. I appreciate the links! I'm so new, I'm not even sure what I'm searching for sometimes. 🙂
... View more
09-28-2017
12:20 PM
Hello,
I am VERY new to Splunk. I have built some basic dashboards using DB queries, because the data is not (yet) being put directly into the Splunk database. With that said, I would like to enhance my current dashboard with some additional data defined in a CSV file. To be more specific my dashboard contains phone numbers. My CSV file contains the location data of North American Numbering Plan area codes and prefixes (NPA-NXX). I would like to lookup the location of the caller, based on the NPA-NXX, and include that in my dashboard.
Given my limited knowledge/skill set with Splunk, I have a few questions:
1) Is this even possible in Splunk?
2) Does Splunk support data/format manipulation within the search string, such as using RegEx, or can you define a substring to look for?
3) Are there any existing tutorials around these areas that could help guide me to a solution?
Any help would be greatly appreciated!!
EXAMPLE (dots added for spacing purposes)
[Query Results]
Phone Number .......... Call Count
+12345678901........... 12
[CSV Entry]
NPA-NXX .................. Location
234-567 .................... Anytown, USA
Desired Output
Phone Number .............. Location .................................. Call Count
+12345678901............... Anytown, USA ......................... 12
... View more
