About timrich66

edoardo_vicendo · ‎03-30-2022

Same here, the UF was working fine on a Windows server than suddenly started to not ingest the file anymore. To see the error I had to put in debug mode the universal forwarder. The strange thing is that other files are still monitored and forwarded correctly. I have even added followSymlink=false and CHECK_METHOD=modtime without any luck #inputs.conf [monitor://D:\path\to_*\file-*_*.csv] disabled=0 index=myindex sourcetype=mysourcetype crcSalt = <SOURCE> followSymlink=false #props.conf [source::D:\path\to_*\file-*_*.csv] CHECK_METHOD=modtime

weidertc · ‎02-24-2022

For simple counts, you can get both timelines like this | multisearch [index="asfd" ... earliest=@mon latest=@d | eval Month=0] [index="asfd" ... earliest=@mon-1mon latest=@mon | eval Month=1] ... | timechart count(eval(Month=0)) as "ThisMonth", count(eval(Month=1)) as "LastMonth" As far as percentages, it depends on how you want it, like per interval, up to the latest interval, or as a whole. There are very different solutions for each.

edgkassi · ‎02-01-2022

Thanks, this worked for me! On Win I used this version.

timrich66 · ‎01-04-2022

Thank you. I had started to use the <change> parameter, but your answer gave me all I needed to complete.

inventsekar · ‎01-04-2022

As suggested on the previous reply, | stats list(s) as "s" this will list out all values of "s" and assign it "s"... simply making it the field "s" as a multivalue field. so, run the sort command before doing this stats list operation.

timrich66 · ‎12-13-2021

Hi, I too have a similar issue. Disabling via the _internal call does not work for me. Thanks

timrich66 · ‎11-18-2021

Thanks @PickleRick , I will talk with our infra team and admins to get the UF set up to use an AD account. I'll reply to let you know the result.

timrich66 · ‎09-21-2021

Thanks @PickleRick I have found that querying the master.sys.availability_groups used in the second INNER JOIN returns no results. I have removed all the 'ag' references and the query runs ok. I've passed it back to the DBA to investigate.

timrich66 · ‎09-06-2021

Thanks @PickleRick , I had tried using "eval myId=tonumber(recordId,26)" not realising I had to use base 36 to include 0-9. I am using strftime on the date and combining the date and recordId to give me one SNow ID per day for each record. This gives me the solution I require.

timrich66 · ‎08-02-2021

I also have this issue. Are there any solutions? Thanks

timrich66 · ‎07-30-2021

Hi, I need to track the number of times and duration where the CPU used percent is above a threshold number. The search below shows a server that exceeds the threshold for 3 periods over the last 3 days. What I want to get is a result that shows me the number of times the threshold has been exceeded and for how long. I have tried using 'streamstats' and 'bin' but am not entirely sure how to achieve my goal. Thanks

timrich66 · ‎07-05-2021

To add - This does not happen on any other ingestion. The servers are still phoning home and sending infra metrics to ITSI. I have redeployed inputs.conf to the servers. One is prod, one non-prd.

timrich66 · ‎06-23-2021

You've cracked it! Thank you very much 😃

timrich66 · ‎05-20-2021

Yes, you're right, thanks. It was the 'chart' rather than 'timechart' that made the real difference. All working as planned.

timrich66 · ‎02-22-2021

Hello All, I have an alert that has an Action to create a SNow Incident when a file has not been received by a certain date. The first time the alert ran and the action was triggered, a new Incident was created. Subsequently, the original Incident has been reopened. This is not what I want. I need to have a new Incident for each time the action is triggered. I have tried setting 'state' to 1, which implies New in the documentation here - https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Commandsandscripts state No Number 4 The state of the incident. For example: 1 - New 2 - Active 3 - Awaiting Problem 4 - Awaiting User Info 5 - Awaiting Evidence 6 - Resolved 7 - Closed I have also left the Correlation ID blank so that a new (unique) ID is created. Correlation ID A unique ID to support third-party application integration. It should only consist of alphanumeric characters, underscore (_), and hyphen (-) in its value. Leave blank for the Splunk Add-on for ServiceNow to generate a unique ID for you. Thanks in advance for support

isoutamo · ‎02-11-2021

Now you have one serverclass where you have defined all those files: common, nodeA and nodeB if I understood right. As your log files contains name of nodeA or nodeB you could remove those from common serverclass and create separate classes for those which are installed only to corresponding node. All common files could be in common serverclass which will installed to both. Then there is no need for that nullQfiltering.

timrich66 · ‎01-15-2021

Hello All, FYI - I have found the issue. Deliberate mistake? Maybe not, but it should have been obvious.. Original props.conf - [source::///xxxx/Log/xxxxServer.log] SHOULD_LINEMERGE=true MAX_EVENTS=10000 TIME_PREFIX=\+\+\+\+ \w+ Working props.conf [source::///xxxx/Log/xxxxServer.log] SHOULD_LINEMERGE = true MAX_EVENTS = 10000 TIME_PREFIX = \+\+\+\+ \w+ Yes, it was pesky spaces 🙂 Watch out for them! All now working as planned.

timrich66 · ‎09-24-2020

This issue was caused by the setting 'indexAndForward' in outputs.conf causing events to be dropped when the queues were too busy. The 'indexAndForward' stanza was set to false and the events are now all available via the SH.

timrich66 · ‎09-11-2020

Thanks for the link. It makes interesting reading. I have asked our unix SA to add debugging to the UF so I can get more details. Events from different files on the server in question are being ingested and the same file name on a different server is also providing events.

timrich66 · ‎09-02-2020

The file is tiny. I will look at what other options are available. Thanks

timrich66 · ‎08-18-2020

I appear to have fixed this. I have changed the monitor path to read "*.*.finish" and the source name has remained unchanged since.

timrich66 · ‎07-08-2020

Hi @skalliger , thanks for the reply. Yes, I tried this but only managed to create empty lines in the csv. I have written this search which only returns the entries for 'today'. A work around for now. | inputlookup comment.csv | eval Comment=if(isnull(Comment),New_Note,Comment) | eval Date=if(isnull(Date),Date_new,Date) | eval tdate=strftime(now(),"%d/%m/%Y") | rex field=Date "(?<cdate>\d\d\/\d\d\/\d\d\d\d) " | table Date, Comment, tdate, cdate | where tdate=cdate | table Date, Comment | sort -Date

gcusello · ‎06-03-2020

Hi @timrich66, you have two ways: create a special ServerClass for this server. Send to nullqueue all the events of that sourcetype that arrive from the other servers. I think that the first solution is the most easy and efficient! Ciao. Giuseppe

timrich66 · ‎12-19-2018

I have an issue whereby when importing certain events via DB Connect (v3.1.3), the 'Interesting Fields' are not populated despite all the events having the same format. Here is a sample of the events - 30/11/2018 00:00:00.000 2018-11-30 00:00:00.000, DAYOFMONTH="30/11/2018", COUNT="1", STATUS="W", SOURCE="Call Centre", PRODUCTCODE="Xxxxxx" 30/11/2018 00:00:00.000 2018-11-30 00:00:00.000, DAYOFMONTH="30/11/2018", COUNT="2496", STATUS="Q", SOURCE="System Renewal", PRODUCTCODE="Xxxxxx" 30/11/2018 00:00:00.000 2018-11-30 00:00:00.000, DAYOFMONTH="30/11/2018", COUNT="264", STATUS="Q", SOURCE="Call Centre", PRODUCTCODE="Xxxxxx" 30/11/2018 00:00:00.000 2018-11-30 00:00:00.000, DAYOFMONTH="30/11/2018", COUNT="2012", STATUS="Q", SOURCE="System Renewal", PRODUCTCODE="Xxxxxx" 30/11/2018 00:00:00.000 2018-11-30 00:00:00.000, DAYOFMONTH="30/11/2018", COUNT="199", STATUS="Q", SOURCE="Call Centre", PRODUCTCODE="Xxxxxx" Apologies, I do not have enough Karma points yet to post an image. As can be seen, each event has DAYOFMONTH=, COUNT=, STATUS=, SOURCE= and PRODUCTCODE=, but these fields do not become 'Interesting Fields'. I have searched in Smart and Verbose formats and looked at 'All Fields' and they do not appear. I know I create field extractions or use regex to create the fields (which is what I have done for now). I would like to know why Splunk is not populating the 'Interesting Fields' in this case as there are other db imports which do have 'Interesting Fields' automatically populated. Thanks in anticipation.

niketn · ‎03-07-2018

@timrich66, glad you got it working. Please accept the answer to mark this question as answered.

Posts	59
Solutions	3
Karma Given	6
Karma Received	2
Member Since	‎11-27-2017

Online Status	Offline
Date Last Visited	‎05-30-2022 04:43 AM

How to create dashboard with trend line to show pe...

Why does this search not sort

Run two saved searches from one dropdown

Accessing restricted Windows share

"Inner Join" works in query, not DB Connect

Replace letters with numbers

Calculate time server CPU above alert percentage

The curious case of missing events

Calculate elapsed time from two events

Timechart woes

Re: Skipping itemPath, does not match path....

Re: Trend line to show percentage this month v las...

Re: After installing Splunk Add-on Builder, why do...

Re: Run two saved searches from one dropdown

Re: Why does this search not sort

Re: Splunk DB Connect rest schedule

Re: Accessing restricted Windows share

Re: "Inner Join" works in query, not DB Connect

Re: Replace letters with numbers

Re: sendmodalert - action=risk STDERR - ERROR: [E...

Calculate time server CPU above alert percentage

Re: The curious case of missing events

Re: Calculate elapsed time from two events

Re: Timechart woes

Alert to create NEW ServiceNow Incident

Re: Nullqueue filtering

Line Merge difficulties

Re: Events on Heavy Forwarder not available on Sea...

Re: Why does Splunk 'lose interest' in files that ...

Re: Ingesting Word document

Re: Sourcefile name changes at index time - interm...

Re: 'Empty' a csv on a daily basis

Re: Can ingestion be restricted to only one server...

Interesting Fields Not Populating from DB Connect ...

Re: How to select second date string from email?