Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About robertlynch2020
robertlynch2020
Influencer
Member since:
11-05-2015
Friday
Community Statistics
| Posts | 627 |
| Solutions | 33 |
| Karma Given | 73 |
| Karma Received | 64 |
| Member Since | 11-05-2015 |
Activity Feed
- Posted Multi-drop-down on the App menu on Splunk Enterprise. 11-29-2024 02:31 AM
- Posted Re: HTML - Style - remove the extra lin eof black on Splunk Search. 11-21-2024 02:05 AM
- Karma Re: HTML - Style - remove the extra lin eof black for ITWhisperer. 11-21-2024 02:05 AM
- Posted Re: HTML - Style - remove the extra lin eof black on Splunk Search. 11-20-2024 11:29 AM
- Posted HTML - Style - remove the extra lin eof black on Splunk Search. 11-20-2024 10:27 AM
- Posted Re: Is there a way to monitor the number of files in the dispatch directory over time? on Splunk Search. 09-30-2024 09:07 AM
- Posted Re: Convert Btool command to rest command to be run on the cloud on Splunk Cloud Platform. 09-30-2024 08:59 AM
- Got Karma for Re: Convert Btool command to rest command to be run on the cloud. 09-30-2024 08:49 AM
- Posted Re: Convert Btool command to rest command to be run on the cloud on Splunk Cloud Platform. 09-30-2024 08:10 AM
- Karma Re: Convert Btool command to rest command to be run on the cloud for isoutamo. 09-30-2024 08:10 AM
- Karma Re: Convert Btool command to rest command to be run on the cloud for richgalloway. 09-30-2024 08:10 AM
- Karma Re: Convert Btool command to rest command to be run on the cloud for richgalloway. 09-30-2024 08:10 AM
- Posted Is there a way to monitor the number of files in the dispatch directory over time? on Splunk Search. 09-30-2024 08:05 AM
- Posted Re: Convert Btool command to rest command to be run on the cloud on Splunk Cloud Platform. 09-27-2024 10:04 AM
- Posted Convert Btool command to rest command to be run on the cloud on Splunk Cloud Platform. 09-27-2024 09:47 AM
- Posted Re: High system load average on Search head box on Splunk Enterprise. 08-22-2024 02:06 AM
- Posted High system load average on Search head box on Splunk Enterprise. 08-21-2024 07:30 AM
- Karma Re: Moving one Index from a Cluster to a single install for test for richgalloway. 06-26-2024 09:22 AM
- Posted Re: Moving one Index from a Cluster to a single install for test on Getting Data In. 06-26-2024 09:21 AM
- Posted Copying one Index from a Cluster to a single install for test on Getting Data In. 06-26-2024 04:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
11-29-2024
02:31 AM
Hi In the App menu. I have a situation where I need to keep installing apps, with different version names. However, when this gets to high numbers it might not look so great (I might be difficult to find the app you need). I have 2 questions - 1st Can I increase the size of the row - When the text wraps around it does not look good (In my image I needed to shorten the name to stop wrapping around) 2nd Can I make a multi-drop-down to the right? Like the image below
... View more
Labels
- Labels:
-
Other
11-21-2024
02:05 AM
wonderful - and thanks. 🙂
... View more
11-20-2024
11:29 AM
Hi @ITWhisperer Below is pannel to pannel - thanks for the help <row>
<panel>
<title>Process Resources</title>
<html depends="$alwaysHideCSSStyle$">
<style>
#tableWithHiddenHeader6 th[data-sort-key=label] {
width: 40% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=value] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=threshold] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=limit] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 td {
text-align: left;
}
#tableWithHiddenHeader7 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader7 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader7 td {
text-align: left;
}
#tableWithHiddenHeader8 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader8 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader8 td {
text-align: left;
}
#tableWithHiddenHeader9 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader9 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader9 td {
text-align: left;
}
#tableWithHiddenHeader10 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader10 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader10 td {
text-align: left;
}
</style>
</html>
<table id="tableWithHiddenHeader6">
<search id="twenty_one">
<done>
<set token="tokStatus20">$result.threshold$</set>
<set token="tokStatus30">$result.limit$</set>
</done>
<query>| mstats max("mx.database.space.usage") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Database space"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>5s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus30$, "$TOKEN_RED$",if(value > $tokStatus20$, "$TOKEN_YELLOW$", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
<table id="tableWithHiddenHeader7">
<search id="twenty_two">
<done>
<set token="tokStatus40">$result.threshold$</set>
<set token="tokStatus50">$result.limit$</set>
</done>
<query>| mstats max("mx.database.statement.top_running.time") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Top Running"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>5s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus50$, "$TOKEN_RED$",if(value > $tokStatus40$, "$TOKEN_YELLOW$", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
<table id="tableWithHiddenHeader8">
<search id="twenty_three">
<done>
<set token="tokStatus60">$result.threshold$</set>
<set token="tokStatus70">$result.limit$</set>
</done>
<query>| mstats max("mx.database.lock.top_blocking.time") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Blocking Locks"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus70$, "$TOKEN_RED$",if(value > $tokStatus60$, "#ffae46", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
<table id="tableWithHiddenHeader9">
<search id="twenty_four">
<done>
<set token="tokStatus80">$result.threshold$</set>
<set token="tokStatus90">$result.limit$</set>
</done>
<query>| mstats max("mx.database.oracle.redo_switch.count") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Redo Switch Count"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus90$, "$TOKEN_RED$",if(value > $tokStatus80$, "$TOKEN_YELLOW$", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
<table id="tableWithHiddenHeader10">
<search id="twenty_five">
<done>
<set token="tokStatus100">$result.threshold$</set>
<set token="tokStatus110">$result.limit$</set>
</done>
<query>| mstats max("mx.database.object.invalid.count") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Database space"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>30s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus110$, "$TOKEN_RED$",if(value > $tokStatus100$, "$TOKEN_YELLOW$", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
</panel>
</row>
... View more
11-20-2024
10:27 AM
Hi I have the below code to produce this table - but does anyone know how to get rid of the part in red (I have added this with paint) - it's just taking up too much real estate on the screen. It is like an extra line of black that I don't want. Thanks so much in advance 🙂 <panel>
<title>Process Resources</title>
<html depends="$alwaysHideCSSStyle$">
<style>
#tableWithHiddenHeader6 th[data-sort-key=label] {
width: 40% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=value] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=threshold] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 th[data-sort-key=limit] {
width: 20% !important;
text-align: left;
}
#tableWithHiddenHeader6 td {
text-align: left;
}
#tableWithHiddenHeader7 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader7 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader7 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader7 td {
text-align: left;
}
#tableWithHiddenHeader8 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader8 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader8 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader8 td {
text-align: left;
}
#tableWithHiddenHeader9 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader9 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader9 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader9 td {
text-align: left;
}
#tableWithHiddenHeader10 thead{
visibility: hidden;
height: min-content;
}
#tableWithHiddenHeader10 th[data-sort-key=label] {
width: 40% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=value] {
width: 20% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=threshold] {
width: 20% !important;
}
#tableWithHiddenHeader10 th[data-sort-key=limit] {
width: 20% !important;
}
#tableWithHiddenHeader10 td {
text-align: left;
}
</style>
</html>
<table id="tableWithHiddenHeader6">
<search id="twenty_one">
<done>
<set token="tokStatus20">$result.threshold$</set>
<set token="tokStatus30">$result.limit$</set>
</done>
<query>| mstats max("mx.database.space.usage") as value WHERE "index"="murex_metrics" AND "mx.env"="*" AND process.pid ="*" span=10s BY degraded.threshold down.threshold process.pid
| rename degraded.threshold as T_CpuPerc
| rename down.threshold as limit
| sort - _time
| head 1
| eval value = round(value,1)
| eval label="Database space"
| eval threshold=T_CpuPerc
| eval limit=limit
| table label value threshold limit
| appendpipe
[ stats count
| eval "label"="No results Found"
| where count=0
| table "label"]</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<sampleRatio>1</sampleRatio>
<refresh>5s</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="value">
<colorPalette type="expression">if(value > $tokStatus30$, "$TOKEN_RED$",if(value > $tokStatus20$, "$TOKEN_YELLOW$", "$TOKEN_GREEN$"))</colorPalette>
</format>
</table>
etc,, for each row of the table
... View more
Labels
- Labels:
-
Other
09-30-2024
09:07 AM
Hi https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-monitor-the-number-of-files-in-the-dispatch/m-p/48389 This gives me the current dispatch count - I am looking to make a time chart. Using rest _time does not come back so I can't make a time chart. I am thinking if I run the command each minute in a saved search and output to a .csv with a timestamp that might work!
... View more
09-30-2024
08:59 AM
yes - Sorry - i thought i did - cheers for help 🙂
... View more
09-30-2024
08:10 AM
1 Karma
This worked well and thanks.
... View more
09-30-2024
08:05 AM
Hi I am looking to monitor the dispatch directory over time. I know I can get the current results by using this | rest /services/search/jobs | stats count But I am looking to run the test over 1 minute and have a breakdown per minute of the increase in dispatch over time. Rob
... View more
Labels
- Labels:
-
stats
09-27-2024
10:04 AM
Hi Thanks for the help, i have installed it, but am I missing something.
... View more
09-27-2024
09:47 AM
Hi It is possible to convert enterprise command line bin/splunk btool limits list --app=MX.3_MONITORING_v3 --debug To a rest command to be run from SPL in the cloud, please? Thanks in advance
... View more
Labels
- Labels:
-
using Splunk Cloud
08-22-2024
02:06 AM
To add - the only way back was rebooting the machine - then it all works fine
... View more
08-21-2024
07:30 AM
Hi
Now and again we get an extremely high system load average on the Search Head.
I cant figure out why it is happening and I have to do a kill -9 -1 and restart to fix it.
This means we can't log into the Splunk GUI.
I kill Splunk and I see a lot of processes.
After it is dead, I can still Splunkd process on the box and the load time is still high.
Regards
Robert
... View more
Labels
- Labels:
-
administration
06-26-2024
09:21 AM
Hi Thanks for this. I have the following on 3 indexers. In the DB folder, the hot buckets have the same name on some indexes, so I don't think I can copy these. Perhaps I should not copy them over and go for the other ones. I also see the data in the datamodel_summary section, but I have no data models on this data. Perhaps I don't need to copy these as well? Cheers Rob
... View more
06-26-2024
04:03 AM
HI I have a cluster(3 indexers) with data and I want to copy one index "logs_Test" data to a single install for testing. Can I copy it from the back end on all 3 and bring them together, I feel this won't work. Can I export it from the Search head to a new index and then move that? Any ideas would be great Thanks in advance Robbie
... View more
Labels
- Labels:
-
Linux
06-21-2024
07:34 AM
Hi Thanks for the feedback. We can have a lot of row, I will have a look at the other app cheers Rob
... View more
06-18-2024
02:43 AM
Hi I am using this app https://splunkbase.splunk.com/app/3120 Is it possible to keep the X-axis in view when scrolling down? 1St Example we can see the X-Axis 2nd After moving down - it is gone. I know I can hover over time, so like Excel, can we stick the Row. So it moves with the scroll? Thanks in advance Robert
... View more
Labels
- Labels:
-
Other
03-06-2024
03:21 AM
worked for me - but - surely this is something that should not happen- there are no warnings in Splunk it just bang - Splunk is down in production
... View more
02-01-2024
03:28 AM
Hi No these are the default ones. The issue i have many tables I want to set for all the APP Only- not the full Splunk install. I have tried things like below from other answers but i cant get it to work. https://community.splunk.com/t5/Dashboards-Visualizations/Are-there-different-dashboard-colors-since-update-to-9-0-2/m-p/629683
... View more
02-01-2024
03:08 AM
Hi For a table how can I get back to 8.0 colors the 9.0 are very bright.
... View more
Labels
- Labels:
-
panel
02-01-2024
02:38 AM
HI After trying this is does not work sorry - any other ideas? Thanks Robert
... View more
01-31-2024
06:47 AM
HI @SplunkingKnight Not sure what I am doing wrong here. I am setting it in local on my app. But I am getting this on a startup. An the colors are still very bright. I am using this to applay it any help would be great -
... View more
01-02-2024
06:33 AM
1 Karma
HI Is it possible to 1st Export OTEL data to file(or something) 2nd Import that file to a new Splunk install? We have a cluster with 3 INDEXERS and I want to export specific host data out of it and import it to a Test and Development Install. Is this possible? @js15 Regards Robert
... View more
Labels
- Labels:
-
Other
11-20-2023
03:24 AM
HI I agree that is correct and this was an example of 2 SPLs I had, but I had other issues else where the SPLs were different. The UNION command was able to help me out in this case. Thanks Robert
... View more
11-20-2023
02:45 AM
Hi - Is there a way to get 2 nonstream Searches to run in parallel in the same SPL? I am using "appendcols", but I think one is waiting for the other to finish. I can't use multisearch as I don't have stream commands. The issue is displaying the license used by Splunk and I want to run 2 SPL in parallel. However, it's very slow to run if I run 2 in sequence. Thanks in advance for any help index=_internal
[ `set_local_host`] source=*license_usage.log* type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool = "*"
| search idx != "mlc_log_drop"
| timechart span=1d sum(b) AS Live_Data fixedrange=false
| fields - _timediff
| foreach *
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]
| appendcols
[ search index=_internal
[ `set_local_host`] source=*license_usage.log* type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool = "*"
| search idx = "mlc_log_drop"
| timechart span=1d sum(b) AS Log_Drop_Data fixedrange=false
| fields - _timediff
| foreach *
[ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]]
... View more
Labels
- Labels:
-
Other
10-11-2023
05:53 AM
Hi
I am using the same source type on the same file.
One is coming in via forwarder and the other is uploaded via GUI. However, the forwarder is not extracting the fields. This means I have to use "patch" to access the fields, this is a pain.
Below is a file from a forwarder, we can see fields are not extracted.
Below is the same file but upload - in this case, the fields are extracted.
This is the sourcetype
[import_json_2]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = start_time
TZ = Asia/Beirut
category = Structured
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = 1
Any ideas - thanks in advance.
Rob
... View more
Labels
- Labels:
-
configuration
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
Karma given to
