Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nekb1958
nekb1958
Path Finder
Member since:
02-21-2012
06-05-2020
Community Statistics
| Posts | 24 |
| Solutions | 2 |
| Karma Given | 9 |
| Karma Received | 6 |
| Member Since | 02-21-2012 |
Activity Feed
- Karma Upgrade to 6.2 fails on windows 7 with "ERROR while running rename-cluster-app migration" in migration.log for jdastmalchi_spl. 06-05-2020 12:47 AM
- Karma documentation of token filter like "|s" (Simple XML) for andreas. 06-05-2020 12:47 AM
- Karma Re: documentation of token filter like "|s" (Simple XML) for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Why am I getting "Splunk Enterprise setup wizard ended prematurely..." trying to upgrade to Splunk 6.2 on Windows 7 64 bit? for Afef. 06-05-2020 12:47 AM
- Karma Re: Splunkd Crash: The user 'splunk-system-user' does not have sufficient search privleges for kfeagans_splunk. 06-05-2020 12:46 AM
- Karma Re: Export limit in 5.x for Ron_Naken. 06-05-2020 12:46 AM
- Karma Re: Bug in convert ctime? for Ayn. 06-05-2020 12:46 AM
- Karma Re: search hunk virtual index and splunk index in one search for Ledion_Bitincka. 06-05-2020 12:46 AM
- Karma Re: search hunk virtual index and splunk index in one search for csharp_splunk. 06-05-2020 12:46 AM
- Got Karma for Re: SA-Eventgen: detect timestamp in replay- vs. sample-mode. 06-05-2020 12:46 AM
- Got Karma for Re: Failed to decode 1 byte. 06-05-2020 12:46 AM
- Got Karma for Re: Chart only plots 500 results. 06-05-2020 12:46 AM
- Got Karma for Re: Chart only plots 500 results. 06-05-2020 12:46 AM
- Got Karma for Re: Chart only plots 500 results. 06-05-2020 12:46 AM
- Got Karma for Re: Renaming splunk HTML view. 06-05-2020 12:46 AM
- Posted Re: Why am I getting "Splunk Enterprise setup wizard ended prematurely..." trying to upgrade to Splunk 6.2 on Windows 7 64 bit? on Getting Data In. 12-17-2014 05:43 AM
- Posted Re: Eval to find current time in another timezone on Getting Data In. 05-13-2014 12:24 AM
- Posted Re: CSV timestamp extraction issue on Getting Data In. 03-10-2014 02:55 AM
- Posted Re: Failed to decode 1 byte on Splunk Search. 03-05-2014 07:33 AM
- Posted Re: search hunk virtual index and splunk index in one search on Knowledge Management. 02-11-2014 11:26 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-17-2014
05:43 AM
yes, now it works for my german installation - after some trouble with my Anaconda3 installation (PYTHONHOME was set to anaconda instead of splunk) - also.
... View more
05-13-2014
12:24 AM
Hi MuS
great search, it inspired me to look a little closer and do it even more general (i wondered first why you eval´ed AKDT and CEST), with only one timeformat string
index=_internal | head 1 | eval foo=relative_time(now(), "-90m@s" ) | eval boo=relative_time(now(), "+21m@s" ) | eval now=now() | convert timeformat="%d.%m.%y %H:%M:%S" ctime(now), ctime(foo), ctime(boo) | t
... View more
03-10-2014
02:55 AM
Hi
short test with "your" data in data preview mode
Specify timestamp format (strptime) = %m/%d/%Y
Timestamp is always prefaced by a pattern = ^"
results to the following props.conf
TIME_FORMAT=%m/%d/%Y
TIME_PREFIX=^"
works for me.
... View more
03-05-2014
07:33 AM
1 Karma
yes, I got a similar error message "failed to decode 1 bytes; failed to decode 2 bytes". what´s wrong? after examining the input-file it shows, it is iso8859-1 encoded (first "special" char in line 400). after overwriting the props.conf in data preview
CHARSET=UTF8 (splunks guess)
with
CHARSET=ISO8859-1
removes the error message and splunk interprets (especially views the "special" char) the contents right.
... View more
02-11-2014
11:26 PM
omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...
... View more
02-11-2014
11:26 PM
omg. stupid norbert! thanks!
logical thinking wasn´t my task today. taking virtualindex AND splunkindex means in SPL surely "virtualindex OR splunkindex". i am a little nervous and thats the result 🙂
Thanks, thanks, ...
... View more
02-11-2014
10:51 PM
is there a possiblity to combine a hunk (virtual) index and a normal splunk index (for example a summary index) in one search? when a try it naiv with
index="virtualindex" index="splunkindex"
i got "no result found". the single searches
index="virtualindex"
and
index="splunkindex"
give me records according to the indexes.
Is there any possiblity to combine this???
bye norbert
... View more
02-06-2014
01:11 AM
Oh, sorry. But since i am searching for a SAP Splunk "connection" for a potential customer, your question was very helpful for me, because so i find armadillo 🙂 Thanks.
... View more
02-05-2014
07:15 AM
searching "armadillo splunk" leads to http://telicthoughts.blogspot.de/2013/08/splunking-sap.html among others. so were is the problem?
bye norbert
... View more
01-31-2014
05:58 AM
is your path splunk/etc/master-apps/_cluster/local
or appname instead of _cluster?
or is the _cluster (or appname) part really missing: you wrote Splunk/etc/master-apps/local
... View more
01-22-2014
02:26 AM
Hi
I do not really understand your question. looking at the syntax of the lookup command
http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Lookup
lookup [local=<bool>] [update=<bool>] <lookup-table-name> (<lookup-field> [AS <local-field>] ) ( OUTPUT | OUTPUTNEW <lookup-destfield> [AS <local-destfield>] )
so for me, your lookup looks like:
lookup keyvaluepairs keyfield OUTPUT value
... View more
01-22-2014
02:15 AM
Are the data for the dashboard stored in a summary index?
if so, you can use the "backfill script" have look at
http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Managesummaryindexgapsandoverlaps
if not, why?
bye norbert
... View more
01-16-2014
08:20 AM
1 Karma
do you mean the name shown in dashboards-menu in the (search)app?
this is the filename of the view/dashboard.
depending on the local-dir in which your view reside rename it and refresh "data/ui/views" of your splunk
http://localhost:8000/en-GB/debug/refresh?entity=data/ui/views
... View more
10-24-2013
04:11 AM
NOT
eval test=7200 | convert timeformat="%H:%M:%S" ctime(test) | table test
that´s what i need
eval test=tostring(7200,"duration") | table test
... View more
10-24-2013
03:59 AM
ouch, yes. Thank you now i see my mistake. It´s not a time span it´s a date! and yes then the timezone is important. thanks!
... View more
10-24-2013
01:31 AM
Hi
the following search
eval test=7200 | convert timeformat="%H:%M:%S" ctime(test) | table test
gives me 03:00:00
but (7200 = 3600 x 2) i expect 02:00:00 ! what goes wrong?
because i get the same result under 4.3.5 and 6.0 i cannot believe on a bug, so where is my mistake???
bye norbert
... View more
09-20-2013
04:58 AM
3 Karma
Oh yes, this is frustrating!
for me the point "Search result truncation" at
http://docs.splunk.com/Documentation/Splunk/5.0.3/Viz/CustomChartingConfig-JSChart
helped to understand the source of this behavior. maybe it helps you too.
bye norbert
... View more
08-22-2013
04:55 AM
Hi
sounds for me similar to my problem to parse the email of my dsl-router with embedded logline entries.
I stored the entries (unique pattern "timestamp followed from 4 spaces") as a multivalue field with a transformation and then splitted it in timestamp-logmessage pairs with
index=mail | mvexpand logevents | table logevents | rex field=logevents "..." | ...
in your case i would try to split the field MessageBody at the end of line characters into a mv-field with makemv
after that "mvexpand MessageBody" maybe with a trailing " | table MessageBody "
and then parse every line (now a single event) with a regex like
rex field=MessageBody "(? [^-]+)-(? [^-]+)-(? [^-]+)-"
maybe that helps you to find your solution?
... View more
08-08-2013
05:41 AM
my original timestamp is in epoch, taking token.0.replacement = %s detect the right value, but has a problem to print epoch in replacement.
2013-08-08 14:33:37,548 DEBUG Match '1325372400' Format '%s' result: '2012-01-01 00:00:00'
2013-08-08 14:33:37,548 DEBUG Match '1325372402' Format '%s' result: '2012-01-01 00:00:02'
...
File "C:\Program Files\Splunk\etc\apps\SA-EventGen\lib\eventgensamples.py", line 921, in _getReplacement
replacementTime = replacementTime.strftime(self.replacement)
ValueError: Invalid format string
ok, now i know what works.
norbert
... View more
08-08-2013
05:00 AM
1 Karma
feeling stupid?
reading helps 😞
token.0.replacement = %b %d %H:%M:%S
isn´t (like i thought) the format (strptime) of the replaced timestamp, NO it is the format of the "input". stupid? yes 🙂
bye norbert
... View more
08-08-2013
03:25 AM
when i take my eventgen conf in sample-mode the timestamp is replaced with the actual time in the defined format. when i take the same conf and only change mode to replay, error:
ValueError: Can't find a timestamp (using patterns '['\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}']') in this event: '2012-01-30 23:59:04 QQc-O3J7xve CPUSys 1.046711451335729
what did i miss????
thanks for any help (i´m feeling stupid)
norbert
CONFIG
[short.splunk]
mode = sample
outputMode = file
fileName = e://tmp/meas-all.log
token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}
token.0.replacementType = timestamp
token.0.replacement = %b %d %H:%M:%S
DATA (== short.splunk)
2012-01-30 23:59:04 QQc-O3J7xve CPUUser 2.3843930719158464
2012-01-30 23:59:04 QQc-O3J7xve CPUSys 1.046711451335729
2012-01-30 23:59:04 sIkqmRX7zai CPUUser 0.57221331953932253
2012-01-30 23:59:04 sIkqmRX7zai CPUSys 0.37301278622911521
2012-01-30 23:59:02 QQc-O3J7xve MemFree 4326506496
2012-01-30 23:59:02 sIkqmRX7zai MemFree 3537133568
2012-01-30 23:58:04 sSGBns8SkM7 CPUUser 0.74475287745429919
2012-01-30 23:58:04 sSGBns8SkM7 CPUSys 0.56507473569084943
2012-01-30 23:58:02 sSGBns8SkM7 MemFree 7351476224
... View more
- Tags:
- eventgen
07-02-2013
12:36 PM
no sorry this didn´t fix my problem, but you are right it´s a https problem only. after switching to http i can see the host and product id information and the "request license" button, also. so their is no excuse not to start a trial except, time 🙂
thanks for your response and help. bye norbert
... View more
06-04-2013
10:26 AM
hmm, I can´t try it out cause I get -- after starting the app, and loading 100% -- an error:
Authentication Failed
What which authentication???
Looks like a redirecting problem, error shows at
https://XXX:8000/de-DE/static/app/dataflare/core/index.html
clicking OK (who means an error is ok?) leads to
XXX:8000
and yes that isn´t a valid adress (no https, ...)
that was on my mac. same error on a linux host (except the redirect to
https://XXX/en-US/app/search/dashboard_live is working)
on a windows 7 installation i can request a license. maybe i test it on my windows pc, but the production system is linux 😞
norbert (disappointed)
... View more
- Tags:
- DataFlare
09-05-2012
03:06 PM
Was there any answer from support, i got the same error (without a subsearch) and want to fix it. Thank you.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
