About Nanuk

Nanuk · ‎11-07-2023

Hello do these steps hold true for a https://www.splunk.com/ account?

Nanuk · ‎03-30-2020

Figured it out. Seems I wasn't given a raw log file, but an extracted table of a sourcetype from and index. So it included the fields that Splunk generates on ingestion. Once I went through the log and deleted those fields it solved my problem. Thanks @woodcock for your take regarding this, it tipped me in the right direction.

Nanuk · ‎03-29-2020

Thanks! I've been looking for this fix!!

Nanuk · ‎03-29-2020

So I'm working on a project where i'm ingesting csv files. These file's time stamp can't be read until I pass the: Timestamp format = %Y-%m-%dT%H:%M:%S.%z Timestamp fields = time (which isn't in the csv, but shows up in the "Set Source Type" page of "Add Data" ) Without it I get the errors: - Could not use strptime to parse timestamp from "2020 february tuesday 11 3 2 local 18 2020-02-18T11:03:02.000-0600". - Could not use regex to parse timestamp from "11 3 2 local 18 2020-02-18T1". my problem is that after ingestion i get double fields of every time related field. i.e. date_year = 2020 date_year = 2020 date_month = february date_month = february date_wday = tuesday date_wday = tuesday date_mday = 18 date_mday = 18 date_hour = 11 date_hour = 11 date_minute = 3 date_minute = 3 date_second = 6 date_second = 6 date_zone = local date_zone = local It still shows up in the fields sidebar as just single fields, but when I add them as an interesting field they double in the events page or when I list them using a table command. I've tried also setting Extraction to current time in "Set Source Type" page of "Add Data", but I still get double. *sample of when I table the date fields *sample of what the field dates look like in events

Nanuk · ‎12-03-2019

Hi so I've been teaching myself Splunk and I don't really have the HDD space to run VM on my WIndows 10 desktop or laptop, and the thought to dual booting CentOS on both scares me since I don't have anywhere to backup my data atm. I've actually looked for an answer to this here and on google and have not found an answer to this question. Some people have asked questions similar to this and the answer is usually to run an elevated command prompt as admin. This doesn't work for me. I've installed Splunk Enterprise Trial 8 on my laptop and install the new WIndows 10 OpenSSH server. I've installed putty and super putty (i know not really relevant, but I want to be thorough.) on my desktop. I can connect to the laptop from the desktop using putty and Splunk will display the results of the command "splunk status" in putty, but any other command like "splunk btool inputs.conf list" or "splunk show web-port" doesn't return any results in putty. I'm assuming that the laptop still running the command but not returning the results in putty. i.e. a command prompt window is very quickly opening and displaying the results and just as quickly closing before i can even notice it. I'm assuming this because after i press enter for those commands on putty, there is a pause before putty shows command prompt/next line again. please help.

Nanuk · ‎01-12-2017

I was able to figure out my mistake I'll post the correct code below. 'Declaring Constants Const ForReading = 1, ForWriting = 2, ForAppending = 3 'Declaring Variables dim fso, strDirectory, strOutPut, fLocation, fNewName, objWorkbook, local local = true Set objExcel = CreateObject("Excel.Application") Set fso = CreateObject("Scripting.FileSystemObject") objExcel.Application.DisplayAlerts = False objExcel.Application.Visible = False 'Open Text Files for use Set strDirectory = fso.OpenTextFile("D:\_Work\_Splunk\_TestBed\DATFileLocations.txt", ForReading, TristateFalse) Set strFileName = fso.OpenTextFile("D:\_Work\_Splunk\_TestBed\csvFileNames.txt", ForReading, TristateFalse) Do Until strDirectory.AtEndOfStream fLocation = strDirectory.ReadLine 'Get the location of the DAT file fNewName = strFileName.ReadLine 'Get the name of the target csv file Set objWorkbook = objExcel.Workbooks.Open(fLocation) 'Open the DAT file objExcel.ActiveWorkbook.SaveAs fNewName, 6 'Save the DAT file as a csv objExcel.ActiveWorkbook.Close Loop 'Close the text files' strDirectory.Close strFileName.Close 'Set strDirectory = Nothing 'Set strFileName = Nothing

Nanuk · ‎01-10-2017

Hello, I'm kind of new to this, so please bear with me. I have been trying to make a shell script that can do the following: convert a FoxBase v3.0 .DAT file into a comma delimited .csv file. I decided to go with a VBScript and this the code that I have so far. So far what I've come up with is a corrupt .csv file. When I add it to Splunk! it reads as corrupted and not a (comma delimited) csv file. I was hoping to get some pointers. Set objExcel = CreateObject("Excel.Application") Set objWorkbook = objExcel.Workbooks.Open("D:\_Work\_Splunk\Villarica\LC8.DAT") objExcel.Application.DisplayAlerts = False objExcel.Application.Visible = True objExcel.ActiveWorkbook.SaveAs "D:\_Work\_Splunk\Villarica\LC8.CSV" objExcel.ActiveWorkbook.Close objExcel.Application.Quit WScript.Echo "Finished." WScript.Quit Even if you don't have an answer thanks for taking a look.

Posts	7
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎10-18-2015

Online Status	Offline
Date Last Visited	‎03-13-2024 12:14 PM

How do I keep date fields from doubling at ingesti...

Why doesn't Splunk Enterprise 8 display the result...

shell script for converting a foxbase .DAT file to...

Re: Change My Email Account

Re: How do I keep date fields from doubling at ing...

Re: Geostat remove "OTHER"

How do I keep date fields from doubling at ingesti...

Why doesn't Splunk Enterprise 8 display the result...

Re: shell script for converting a foxbase .DAT fil...

shell script for converting a foxbase .DAT file to...