Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nls7010
nls7010
Path Finder
Member since:
01-10-2014
02-28-2022
Community Statistics
| Posts | 111 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-10-2014 |
Activity Feed
- Posted How to pick up files in a whitelist that have a different extension on Getting Data In. 02-25-2022 10:39 AM
- Posted I am trying to bring in windows logs from a clients server, but nothing is showing. I created a new application. on Getting Data In. 11-09-2021 07:23 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-23-2021 04:28 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 11:31 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 11:12 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 10:03 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 08:39 AM
- Posted Re: Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 08:07 AM
- Posted Need search assist for a query that is not bringing back the expected result on Splunk Search. 09-16-2021 07:26 AM
- Posted Getting the following error when trying to start a forwarder on a linux system on All Apps and Add-ons. 08-12-2021 10:41 AM
- Posted sendemail function is not working on Alerting. 05-04-2021 09:14 AM
- Tagged sendemail function is not working on Alerting. 05-04-2021 09:14 AM
- Posted send email function does not seem to be working after upgrading to version 8.1.2 on Alerting. 04-30-2021 05:45 AM
- Posted Monitoring console showing all forwarders as missing on Getting Data In. 03-04-2021 10:54 AM
- Posted How to ingest files with multiple dots in them on Getting Data In. 02-19-2021 05:40 AM
- Posted We just loaded an AIX server with a forwarder and we're getting can't write file "/.splunk/authToken_#####_8089: on Getting Data In. 12-11-2020 10:25 AM
- Posted Trying to load the Event Timeline Visualization in a clustered environment, need assistance on All Apps and Add-ons. 12-03-2020 05:14 AM
- Posted I need to bring back a zero value if my search does not bring anything back. on Splunk Search. 08-12-2020 12:06 PM
- Posted Re: Heavy forwarder - HttpClientRequest on Deployment Architecture. 08-10-2020 09:54 AM
- Posted Deployment server not deploying apps to cluster master--get does not exist on Deployment Architecture. 08-07-2020 06:51 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-25-2022
10:39 AM
I want to pick up logs from the same directory that have *.out and *.log in them, is there a way to create one monitor statement with a whitelist that would pick up *.log or *.out or can I use a selection at the end of the monitor like http://xxx/*.log/*.out?
... View more
Labels
- Labels:
-
inputs.conf
-
source
-
whitelist
11-09-2021
07:23 AM
This is the inputs from the app I created for the windows logs: [WinEventLog://Application] index = replicate3 disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=0 [WinEventLog://Security] index = replicate3 disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=0 [WinEventLog://System] index = replicate3 disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=0 I created a special index for it, but it is not getting any results. I also have sent over the splunk TA for windows logs, but still nothing is coming in. The index was created successfully and the apps show on the client. What else am I missing.
... View more
Labels
- Labels:
-
index
-
inputs.conf
-
universal forwarder
-
Windows
09-23-2021
04:28 AM
This is an update from my client: To make sure I understand, you are asking if developer_app can be different values in a unique combination of hits per mydate+developer_app combinations, right (i.e. if I look in the event, can I have two developer apps in the event details)? They cannot be; for a single request, there can only be 1 developer app. I’m trying to get to a result set where I can say: I have 50 total calls to a service. 25 were from CC-R5-SITECORE-App and 25 were from CC-R5-IMP-SUPERUSER-App If I add developer_app as a group by parameter, I was thinking I would see the result above where I get a unique number of hits per combination of date+developer+app
... View more
09-16-2021
11:31 AM
sure, here is the raw data of one of the events: {"proxy_basepath":"/v1/customer/profile","responsecache_l1_count":null,"x-apigee.edge.execution.stats.request_flow_endtimestamp":1631811648373,"responsecache_executed":null,"apiproxy":"cc-cust-profile-01-v1","x-apigee.edge.is_policy_error":0,"client_id":"RfmkbZ3EI161T1MHfGaIlHKvDsgeXJZ2","responsecache_name":null,"client_sent_start_timestamp":1631811649200,"target_sent_start_timestamp":1631811648374,"x-apigee.edge.is_target_error":0,"client_received_start_timestamp":1631811648364,"x-apigee.intelligence.client_ip_postal":null,"target_sent_end_timestamp":1631811648374,"client_ip":"139.46.106.177","is_error":false,"x-apigee.edge.stats.steps":"{\"qtAPIQuota.0\":3,\"o2VerifyAccessToken.0\":2,\"repRegExProtect.0\":0}","id":"fq51wz403hod2kqjww3lqd0y","request_size":235,"developer_app":"CC-R5-SITECORE-App","x-apigee.intelligence.client_ip_header":"104.209.233.38","target_response_code":201,"apigee.edge.execution.fault_code":null,"apigee_sdk_client_sessionid":null,"virtual_host":"secure","x-apigee.edge.mp_host":"lcltcust1edgp06.duke-energy.com","apigee_sdk_client_requestid":null,"x-apigee.edge.execution.fault_flow_name":null,"sla":false,"responsecache_key":null,"x-apigee.intelligence.service":"{}","target_received_end_timestamp":1631811649199,"client_sent_end_timestamp":1631811649200,"target_host":"sapisugw-prd.duke-energy.com","request_uri":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","access_token":"okA4MFkAIEcVPaE4091YYvQEeRGX","proxy":"ProfilesProxyEndpoint","x-apigee.intelligence.client_ip_subdivision":null,"target_received_start_timestamp":1631811649198,"api_product":"CC-R5-BE-SC-Services-PROD","proxy_client_ip":"xxxxxxxxxxxx,"x-apigee.edge.dn.region":"dc-1","apigee_sdk_client_appname":null,"apigee_sdk_client_deviceid":null,"apigee.edge.execution.is_apigee_fault":0,"x-apigee.edge.target.latency.stats":"{\"targetList\":[{\"targetId\"😕"target://sapisugw-prd.duke-energy.com\",\"responseStatus\":201,\"latency\":824,\"isTLS\":true}]}","x-apigee.edge.stats.policy.execution":null,"target_url":null,"x-apigee.edge.execution.fault_flow_state":null,"useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36","proxy_pathsuffix":"/email/bp/retrieve","x-apigee.intelligence.client_ip_asn":null,"x-apigee.edge.execution.stats.request_flow_start_timestamp":1631811648371,"x_forwarded_for_ip":null,"response_size":1045,"cache_hit":null,"x-apigee.edge.execution.sense.action":null,"developer_email":"CC_APIGEE_REPORTING@duke-energy.com","x-apigee.edge.execution.fault_policy_name":null,"responsecache_source":null,"response_status_code":201,"request_verb":"POST","x-apigee.edge.true_client_ip":"104.209.233.38","apigee_sdk_client_orgname":null,"x-apigee.edge.execution.stats.response_flow_end_timestamp":1631811649199,"gateway_source":"message_processor","target":"Retrieve Primary BP from Email TargetEndpoint","x-apigee.intelligence.client_ip_country":null,"environment":"prod","client_received_end_timestamp":1631811648364,"target_ip":"xxxxxxxxx","organization":"cust","x-apigee.edge.execution.stats.response_flow_start_timestamp":1631811649199,"request_path":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","developer":"cust@@@BJeQzJGwIGzHXAop","target_basepath":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","flow_resource":null,"x-apigee.intelligence.client_ip_city":null,"gateway_flow_id":"lcltcust1edgp06-123559-840635-44","apiproxy_revision":"12"}
... View more
09-16-2021
11:12 AM
There does not appear to be a specific field, so I'm thinking he is making this field at search:
... View more
09-16-2021
08:39 AM
This is what the customer responded: To make sure I understand, you are asking if developer_app can be different values in a unique combination of hits per mydate+developer_app combinations, right (i.e. if I look in the event, can I have two developer apps in the event details)? They cannot be; for a single request, there can only be 1 developer app. I’m trying to get to a result set where I can say: I have 50 total calls to a service. 25 were from CC-R5-SITECORE-App and 25 were from CC-R5-IMP-SUPERUSER-App If I add developer_app as a group by parameter, I was thinking I would see the result above where I get a unique number of hits per combination of date+developer+app
... View more
09-16-2021
08:07 AM
I will ask the client what he set up.
... View more
09-16-2021
07:26 AM
A client of mine is asking: I’m hoping you can help me with something. I am trying to analyze the volume to a particular Apigee endpoint so I have wrote the following query where I am grouping the stats by my calculated date value to see a day-wise view for a service that hit a particular backend. index="apigee-prod-cne" sourcetype="apigee_metrics" (apiproxy="cc-cust-profile-01-v1") target_host = "sapisugw-prd.duke-energy.com" proxy_pathsuffix = "/email/bp/retrieve" environment="prod" | dedup gateway_flow_id | spath request_verb | search request_verb != "OPTIONS"| eval yourdate = strftime(_time,"%D")| eval yourhour = strftime(_time, "%H")| eval yourmin=strftime(_time,"%M") | stats count(x-apigee.edge.execution.stats.request_flow_start_timestamp) as hits by yourdate What I’m not understanding is that when I add an additional parameter to group by (and changing none of my other conditions) that I suddenly see a spike in calls rather than a segmented number from the total? Can you help me to understand what I may be missing to properly evaluate traffic through our proxies?
... View more
08-12-2021
10:41 AM
I am getting an error after loading Splunk forwarder on a Linux server (this same load is on other Linux servers with no issues): 6a257470b sp:7ffeb4a673a0 error:0 in liboneagentproc.so[7fd6a2560000+84000] Aug 12 12:04:18 ladcivrnvpt03 kernel: traps: splunkd[66184] trap invalid opcode ip:7fd6a257470b sp:7ffeb4a673a0 error:0 in liboneagentproc.so[7fd6a2560000+84000] I run the ./splunk start --accept-license and it appears to start, but if you ps -eaf | grep splunk, nothing is started. No log files are generated in .../splunkforwarder/var/log/splunk for the splunkd process either.
... View more
Labels
- Labels:
-
installation
05-04-2021
09:14 AM
Our sendemail function seems to have stopped working or is only working sporadically as it might send email the next day for an issue that occurred the day before or it may not send anything at all. Has anyone seen this before? We did in the past and edited the sendemail.py for that one, but this issue is brand new and we're seeing it in our 7.2.6 environment and in our 8.1.2 environment. We are a clustered environment.
... View more
- Tags:
- sendemail
Labels
- Labels:
-
alert action
-
email
04-30-2021
05:45 AM
We recently upgraded to version 8.1.2 Splunk and now our email alerts don't appear to be working. I had this issue in version 6.6.3, but had not seen it since then (we did upgrade to 7.2.6 before moving to 8.1.2--did not see the issue then either). I have looked at older logs that said to remove a few lines in the sendemail.py file and I found similar lines in the new sendemail and marked them out with a # sign, but it did not fix the issue. We are delaying our upgrade of the Production system until we solve this email issue. Any ass
... View more
Labels
- Labels:
-
email
03-04-2021
10:54 AM
When I go to the monitoring console and take a look at the forwarders, the console shows them as all missing yet our environment is receiving logs from many of them. I tried to rebuild it in the monitoring console, but it fails. Not sure how to get this fixed.
... View more
Labels
- Labels:
-
Linux
-
monitor
-
other
-
universal forwarder
02-19-2021
05:40 AM
I am trying to upload documents from a user who's log files has multiple dots in the naming convention: The logs have a *.0.1.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20210218.000023-5644-5716.0.log in its file extension, would it be possible to use *.*.*.*.log instead? The logs have a *-20201218.105324-11260-11240.0.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20210209.145105-16220-11864.0.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20201218.105324-25876-14744.0.log in its file extension, would it be possible to use *.*.*.log instead? Is there a way to get all of these from .log to .*.*.*.log into Splunk using one monitoring stanza?
... View more
12-11-2020
10:25 AM
We just loaded an AIX server with a forwarder and we're getting can't write file "/.splunk/authToken_#####_8089: Permission denied We have loaded a number of servers with the splunkforwarder, but just started getting this message. We have a particular user to run the process and it has worked on other servers, but not these new ones. This is using Universal Forwarder 8.0.5. The process actually starts, but when you do ./splunk list monitor is when you get the can't write file. We have several more servers to load and would really like an assist here.
... View more
Labels
- Labels:
-
universal forwarder
12-03-2020
05:14 AM
I have just acquired the Event Timeline Visualization application and loaded it on my Deployer and pushed it out to my search heads. Unfortunately not all the function is showing. Do I need to load this individually on all the search heads? I'm at a loss on how to get this out to them via the normal push from the Deployer to the search head cluster.
... View more
- Tags:
- timeline
Labels
- Labels:
-
configuration
-
installation
08-12-2020
12:06 PM
index=xxxx source="/esbplogsdir/prod/Enable/LOG_Maximo_LSI_Work/Maximo/LSI_IN_msg_prod.log" OR source="/esbplogsdir/prod/WS/LOG_Maximo_SmallWorld_IPICustomerInfo/Maximo/SmallWorld_IN_msg_prod.log" | rex "(?i).*? \\- (?P<FIELDNAME>[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+)(?= )" | rex "(?i):.*? \\- (?P<FIELDNAME>\\d+\\.\\d+)(?= )" | search "[ERROR]" OR "failed" |stats dc(FIELDNAME) as ERROR_TRANSACTION_COUNT by source | rename source as SOURCE This is the search, but if one or both sources have a 0 return, I want a line that lists the log file and a 0 to show in my table. How can I do this?
... View more
08-10-2020
09:54 AM
Where did you increase the open file size? Was it on the cluster master or on the client?
... View more
08-07-2020
06:51 PM
I am getting an error when trying to push my application from the Deployment server to the Cluster Master. This is the same for all the different apps that are listed in the deployment-apps directory. This has worked many times, but just started this issue. It was once fixed with the _internal being put in the _cluster/local/indexes.conf, but that is still there an I still get the issue. Failed to load app. Application=duke_nix_forwarder_inputs cannot be loaded, as path=/web/splunk/etc/deployment-apps/duke_nix_forwarder_inputs does not exist
... View more
- Tags:
- indexes
Labels
07-24-2020
07:51 AM
I have been able to find searches for roles mapped to AD Groups, but I need to get the indexes those roles are allowed to use. I'm creating a search to assist in upgrading to a new system. This mapping will give me the relationships. I have used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but it only gives me the role and searchIndexes. I need to map it to AD groups too. Also, when I went to download that searches content, it did not download all the data. I also used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but what I really need is all three values: Role mapped to AD Group and role mapped to indexes in the same search.
... View more
Labels
- Labels:
-
other
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-28-2022
01:22 PM
|
