About tt1

tt1 · ‎03-02-2014

Hi, I am successfully reading and joining a couple of sources, but am having a trouble adding a 3rd. index=access_logs TTG | rex field=_raw "\"GET\s*.*?xml\?*(?<ttg_request>.*?)\s*HTTP.*?\"" | rex field=ttg_request "c_account_code=(?<ttg_c_account_code>.*?)&" | rex field=ttg_request "c_error_code=(?<ttg_c_error_code>.*?)&" | rex field=ttg_request "c_time_stamp=(?<ttg_c_time_stamp>.*?)&" | rename ttg_c_account_code as addressID | join addressID [search index="tt2_trial_accounts"] | table addressID accountCode ttg_c_error_code ttg_c_time_stamp the 3rd index=json_mi | table accountCode event.type date I want to join like this; index=access_logs OR index=json_mi | but do not know how to handle the above rex fields in this instance. Ideally ending up with something that looks like; table accountCode some_field(ttg_c_error_code or event.type date) date(ttg_c_time_stamp or date) Any help appreciated.

tt1 · ‎02-18-2014

Ledion, many thanks for your help, you reminding me of the search.log helped. After checking that and googling the error in that log, I found an answer suggesting that I had chosen the incorrect version of Hadoop in my provider settings. Selecting the correct version has solved the problem. Thanks again for answering.

tt1 · ‎02-17-2014

Many thanks for answering. I will work through these solutions, but overall I think you are right in that this data is pretty unusual. Splitting the data prior to HDFS might well be the best idea.

tt1 · ‎02-16-2014

Thanks for answering. Yes using the web interface I have set vix.splunk.search.recordreader to com.splunk.mr.input.SimpleCSVRecordReader Also tried com.splunk.mr.input.SimpleCSVRecordReader, com.splunk.mr.input.ValueAvroRecordReader as per this link http://blogs.splunk.com/2013/09/27/hunk-setup-using-hortonworks-hadoop-sandbox/ not a lot out there on this subject.

tt1 · ‎02-16-2014

Hi, I have an input file in the format as follows; 1|{json_data} 1|{more_json_data} 2|aa|bb|cc 3|11|aa|bb|dd The 1's would always be the JSON, and the 2's and 3's would always be the csv (2 format being slightly different to 3). I would probably use the 1's separately from the others. How can you handle different formats? Any thoughts appreciated?

tt1 · ‎02-16-2014

Hi, I have been recommended the SimpleCSVRecordReader to convert CSV to JSON. I have tried to set up a Virtual Index Provider, but taking the default settings, but including the following line; vix.splunk.search.recordreader com.splunk.mr.input.SimpleCSVRecordReader When I try to use this against a file containing csv data it returns no results, yet by reseting the above line to default it returns results. Any help appreciated.

tt1 · ‎02-13-2014

'OR' instead of 'or' makes all the difference ..... that moment when joy is mixed with frustration .... thanks for looking

tt1 · ‎02-12-2014

Hi, I have 2 virtual indexes, both return data, and both return for a specific search. But if I try and join and get no results, and if I try an 'or' I get no results. index=filea ID=201 .. events index=fileb ID=201 .. event index=filea or index=fileb .. no events index=filea or index=fileb | top 20 url .. no events index=filea | join ID[fileb] .. no events on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file. Any thoughts appreciated.

tt1 · ‎02-05-2014

Thanks for looking in, you are right, I was using the wrong port. I tested using an incorrect IP and saw it error, but I didn't think to test the port. I am now in, the tool looks great.

tt1 · ‎02-05-2014

Hi, thanks for taking a look. "All Time" Yes Recurse the directory Yes PasteBin of log http://pastebin.com/igxPPKt1 Thanks.

tt1 · ‎02-05-2014

Hi, thanks for taking a look. "All Time" Yes Recurse the directory Yes PasteBin of log http://pastebin.com/igxPPKt1 Thanks.

tt1 · ‎02-05-2014

Guys, First day using hunk/splunk. I seem to be set up ok but just can not get anything returned form a Virtual Index. The index is pointing to a correct HDFS directory with permissions. Is there anything obvious I may not be doing correctly? Any answers appreciated? Regards.

Posts	12
Solutions	1
Karma Given	3
Karma Received	1
Member Since	‎02-05-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Help using multiple sources

Hunk - Conditional Record Format

Hunk - SimpleCSVRecordReader

Hunk - Join 2 Virtual Indexes

Hadoop Virtual Index - No Results Found

Help using multiple sources

Re: Hunk - SimpleCSVRecordReader

Re: Hunk - Conditional Record Format

Re: Hunk - SimpleCSVRecordReader

Hunk - Conditional Record Format

Hunk - SimpleCSVRecordReader

Re: Hunk - Join 2 Virtual Indexes

Hunk - Join 2 Virtual Indexes

Re: Hadoop Virtual Index - No Results Found

Re: Hadoop Virtual Index - No Results Found

Re: Hadoop Virtual Index - No Results Found

Hadoop Virtual Index - No Results Found