About uagraw01

uagraw01

As per below screen shot i created toggle tabs and when i used the in by below panel results are not poplutating. Please let me know what i am doing wrong ?

uagraw01

ls l grep 'TIME_FORM*' props.conf | awk '{print $0}' | sed 's/TIME_FORMAT=/ /g'

uagraw01

Hello Guys, I want one as shell script in which i want to extract only sourcetype name and TIME_FORMAT attribute from the props.conf. I tried to extract but some how it is not exactly extracting the results. ls l grep 'TIME_FORM*' props.conf | awk '{print $0}' | sed 's/E_FORMAT=/ / I tried for timeformat but i want sourcetype ne and its respective timeformat.Can anyone suggest this.

uagraw01

@manjunathmeti They suggested, use the add-on which they created and i am able to use Add-on directly in my environment. Is there any other approach to break the lines . SHOULD_LINEMERGE=false LINE_BREAKER=^[*]+\n[A-Za-z]+\s[A-Za-z]+\s[A-Za-z]+\s[A-Za-z]+\nStart\stime\:\s\d{14} CHARSET=UTF-8 TIME_FORMAT=%Y%m%d%H%M%S Still it is not breaking

uagraw01

@manjunathmeti Below are my raw data Windows PowerShell transcript end End time: 20210223060514 ********************** ********************** Windows PowerShell transcript start Start time: 20210209051406

uagraw01

@manjunathmeti No luck for this as well

uagraw01

@manjunathmeti It is still not breaking from the second event start from ********************* Windows PowerShell transcript start Start time:

uagraw01

Hello Guys, Below is my initial event and i want to break each from the staring of this event. As i tried various attributes in props.conf but no luck to break the event from this line. I used as of now: LINE_BREAKER = ^\*{22}\n\w+\s\w+\s\w+\sstart\n\Start\stime\:\s\d{14} TIME_PREFIX = ^\*{22}\n\w+\s\w+\s\w+\sstart\n\Start\stime\:\s TIME_FORMAT= %Y%m%d%H%M%S ********************** Windows PowerShell transcript start Start time: 20210223060505 Please suggest me what i did wrong in above props.

uagraw01 · ‎02-19-2021

I want to add one panel in my dashboard which shows only bulletin message ... How should i proceed with this .. Is this is possible with xml or do i need js ? Please suggest

uagraw01 · ‎01-29-2021

@gcusello Why you use _%S here ? Is this the typo error or you will suggest the other one. Y-%m-%dT%H:%M_%S%:z

uagraw01 · ‎01-29-2021

Hello members, Can you help me out to find out , what will be exact timeformat for this time below and timeprefix as well. [2021-01-29T08:05:10-05:00] Thanks in advance.

uagraw01 · ‎01-07-2021

I want to exclude this event "values='{CARD}hfgjllanabbflvh=='} from the server. Please suggest me regex for this and suggest me the props and transforms for this. Below the sample event: ' weblogic.server values='{CARD}hfgjllanabbflvh=='} [Sourcetype] SHOULD_LINEMERGE = false TRANSFORMS-mask = one [one] REGEX = FORMAT = DEST_KEY =

uagraw01 · ‎12-28-2020

@richgalloway Our application is on Heavy forwarder. And i can see skipped event on HF as showned below and we are using splunk cloud. So please suggest me how can verify exactly with the event . And how can i maintain my infrastructure HF. If any documents please share with me. Because i need to create an alert when the event count is less in HF then that alert will trigger.

uagraw01 · ‎12-28-2020

Hello Members, I need some suggestions and help. As per my screenshot we can see my events is skipped from 7:17 pm to 8:17 pm. So because of that user complaint for not getting any alerts during that period. Please suggest me how can i further troubleshoot this issue and find out the reason.

uagraw01 · ‎12-10-2020

@to4kawa For multiple Not condition how match will work. Match command only work for true value. Please suggest when condition is not matched as suggested below.

uagraw01 · ‎12-10-2020

@nickhills Yes i am agree, because multiple NOT condition in case statement are causing issue and all the not condition are consider only !=ONLINE condition value and create only single value. Let me try your suggested SPL, i will let you know if this work.

uagraw01 · ‎12-10-2020

For below requirement i am use the case statement with ! Condition. Please assist.

uagraw01 · ‎12-10-2020

How can i use multiple NOT condition in my second eval function. My attribute is there state_desc!="ONLINE" OR state_desc!="OFFLINE" In above condition i always returned only first value not for the second one. Is need to use LIKE , match or any other command because result is in string .please suggest

uagraw01 · ‎12-08-2020

Hello Splunkers, Can you please guide me, my assignment_group column is not populating. Any issues i have done while creating the case statement. Please correct with that part.

uagraw01 · ‎11-20-2020

Hello , I am not getting any result while executing below query. Can you please help me to know what i am doing wrong with the eval command with if condition below.

Posts	89
Solutions	0
Karma Given	20
Karma Received	2
Member Since	‎06-03-2020

Online Status	Offline
Date Last Visited	2 weeks ago

Dashboard

Script

Linebreak

Dashboard

Timeformat

Regex

Alert

SPL

Spl

SPL

Dashboard

Re: Script

Script

Re: Linebreak

Re: Linebreak

Re: Linebreak

Re: Linebreak

Linebreak

Dashboard

Re: Timeformat

Timeformat

Regex

Re: Alert

Alert

Re: SPL

Re: SPL

Re: SPL

SPL

Spl

SPL