Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About nathanlhopkins
nathanlhopkins
Path Finder
Member since:
10-18-2012
06-05-2020
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 10-18-2012 |
Activity Feed
- Got Karma for DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event. 06-05-2020 12:46 AM
- Got Karma for whitelist syntax - inputs.conf. 06-05-2020 12:46 AM
- Got Karma for FIX message protocol with Splunk. 06-05-2020 12:46 AM
- Got Karma for XML Viewer for Splunk - Pretty XML?. 06-05-2020 12:46 AM
- Posted XML Viewer for Splunk - Pretty XML? on Dashboards & Visualizations. 05-22-2013 12:24 PM
- Tagged XML Viewer for Splunk - Pretty XML? on Dashboards & Visualizations. 05-22-2013 12:24 PM
- Tagged XML Viewer for Splunk - Pretty XML? on Dashboards & Visualizations. 05-22-2013 12:24 PM
- Posted Re: DBConnect guide on Splunk Search. 05-22-2013 12:19 PM
- Posted Re: whitelist syntax - inputs.conf on Getting Data In. 05-22-2013 12:19 PM
- Posted Re: FIX message protocol with Splunk on Splunk Search. 05-20-2013 06:46 AM
- Posted Re: FIX message protocol with Splunk on Splunk Search. 05-20-2013 05:56 AM
- Posted Re: FIX message protocol with Splunk on Splunk Search. 05-20-2013 05:56 AM
- Posted Re: What is the best way to check the sourcetype? on Knowledge Management. 05-20-2013 05:46 AM
- Posted Re: What is the best way to check the sourcetype? on Knowledge Management. 05-19-2013 02:43 PM
- Posted FIX message protocol with Splunk on Splunk Search. 05-19-2013 02:39 PM
- Tagged FIX message protocol with Splunk on Splunk Search. 05-19-2013 02:39 PM
- Posted Re: whitelist syntax - inputs.conf on Getting Data In. 05-19-2013 02:35 PM
- Posted Re: whitelist syntax - inputs.conf on Getting Data In. 05-19-2013 02:25 PM
- Posted DBConnect guide on Splunk Search. 05-18-2013 04:06 PM
- Tagged DBConnect guide on Splunk Search. 05-18-2013 04:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
05-22-2013
12:24 PM
1 Karma
Can anyone advise if there is a nice way to display XML message in either a search or a dashboard, ideally something with nice colour coded sections would be great
Or alternatively is it possible to using a .py script to pretty printing
... View more
05-22-2013
12:19 PM
Many thanks - I didn't really need the whitelist as you pointed out
... View more
05-20-2013
06:46 AM
Found the issue with FIX Log Parser: it turned out to be missing values after the stanza in commands.conf;
[translatefix]
filename = translatefix.py
streaming = true
enableheader = false
retainsevents = true
... View more
05-20-2013
05:56 AM
Within seach I believe I should just be able to run:
index=test_index Execution* 10:19:37 826 | translatefix
To convert the above into readable tagged format?
... View more
05-20-2013
05:56 AM
I've installed FIX Log Parsing by Glenn but am not having much joy:
20/05/2013 10:19:37.826 2013-05-20 10:19:37,826 INFO in.GSFUT_FILCRD - <231 ExecutionReport (8=FIX.4.2\x19=330\x135=8\x149=GSFUT\x156=FILCRD\x1142=FUSNYQAC\x157=A396051\x134=231\x152=20130520-09:19:37\x137=FUSNYQAC15120130516\x111=10301529\x141=10301523\x117=F5193780920130520\x120=0\x1150=4\x139=4\x11=C0795408\x163=0\x155=HCK3\x148=HCEIK3\x122=5\x1167=FUT\x1200=201305\x154=1\x138=13\x140=1\x115=HKD\x159=0\x147=A\x132=0\x131=0\x130=XHKF\x1151=0\x114=0\x16=0\x175=20130516\x160=20130520-09:19:37\x1120=HKD\x121=3\x110=255\x1)
... View more
05-20-2013
05:46 AM
Many thanks, how obvious are these? - when I'm doing data preview I can't seem to spot any issues however when I enable the forwarder I see Failed to parse timestamp errors
... View more
05-19-2013
02:43 PM
Many thanks - does the Data preview screen give any indication of potential "Failed to parse timestamp" errors?
... View more
05-19-2013
02:39 PM
1 Karma
Does anyone have any recommendations of how to use Splunk with FIX trading messages logs and in particular is there anything that understand's / translates FIX tags?
... View more
- Tags:
- fix
05-19-2013
02:35 PM
sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*
... View more
05-19-2013
02:25 PM
sorry - something seems to be wrong with pasting into these boxes - i'm after:
ls app*ua1*START_MT*
... View more
05-18-2013
04:06 PM
Can anyone advise where there is a good basic setup guide for DBConnect?
... View more
05-18-2013
04:04 PM
I was unaware of two different tar files - one for forwarder and one for GUI
... View more
05-18-2013
04:01 PM
1 Karma
I'd like to index files in /DIR/autosys/logs as below;
Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*
Please can someone help me correct below:
[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index
... View more
- Tags:
- inputs.conf
- whitelist
05-18-2013
03:37 PM
A found this was due to a lack of understanding of the front end GUI - the data was being consumed as required.
... View more
05-16-2013
07:18 AM
When I use data preview - should I see the issue? Are the green values highlighted the problem or a good match on timestamp?
... View more
05-16-2013
06:23 AM
If I have a file I wish splunk to consume what is the best way to identify it's sourcetype or closest match?
Is data preview able to help?
... View more
05-16-2013
05:04 AM
Many thanks, I've checked and those \'s are already there (paste issue)
Any other suggestions?
... View more
05-15-2013
03:59 PM
As someone new to Splunk would appreciate some guidance - whilst I had some success in that an inputs and outputs have been configured and I can now search data in the GUI - it appears data has stopped being forwarded / consumed, the last event is Wed May 15 13:58:52 2013
However I can see the log files are still being updated and the data is constantly being added too.
Is my configuration in inputs wrong?
[monitor:///crd/ua1/mtusr10/91/serverapps/logs]
whitelist = cr_server.html$
disabled = false
crcSalt =
index = crd_index
[monitor:///crd/ua1/mtusr11/91/serverapps/logs]
whitelist = cr_server.html$
disabled = false
crcSalt =
index = crd_index
[monitor:///crd/ua1/mtusr11/91/serverapps/logs]
whitelist = cr_server.html$
disabled = false
crcSalt =
index = crd_index
Extract from splunkd on forwarder;
05-15-2013 23:22:16.465 +0100 INFO TailingProcessor - Parsing configuration stanza: monitor:///crd/ua1/mtusr11/91/serverapps/logs.
05-15-2013 23:22:16.465 +0100 INFO TailingProcessor - Adding watch on path: /crd/ua1/mtsys10/91/serverapps/logs.
Appreciate any help or guidance on things to check?
... View more
- Tags:
- data
- forwarder-output
05-15-2013
03:50 PM
1 Karma
In my Splunkd log for one of our webspheres I'm finding multiple entries with;
DateParserVerbose - Failed to parse timestamp. Defaulting to timestamp of previous event ...
Please can anyone advise what might be the fix for this?
Do I need to create my own sourcetype? with props.conf?
... View more
04-25-2013
02:37 PM
Many thanks, do I need to set the $SPLUNK_HOME in my linux profile?
... View more
03-27-2013
05:12 AM
Hi, please can you advise how do I install Splunk universal forwarder manually to /opt/splunkforwarder?
It's says: /opt/splunkforwarder is default on page:
http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Deployanixdfmanually
However in the install page it says:
To install Splunk on a Linux system, expand the tarball into an appropriate directory using the tar command:
tar xvzf splunk_package_name.tgz
The default install directory is splunk in the current working directory. To install into /opt/splunk, use the following command:
tar xvzf splunk_package_name.tgz -C /opt
Please can you help / advise?
... View more
- Tags:
- splunkforwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
