About gnanaraj_mcc

gnanaraj_mcc · ‎11-05-2019

Hello, while managing centralized license, i have created license pools for different groups. how do i give access to edit/update a specific license pool to a particular group/person

gnanaraj_mcc · ‎07-02-2019

Hi mdsnmss, thanks for your reply. however, this query didn't return any results. i ran this from the license manager GUI. We manage centralized licensing. We create license pool for our internal departments and those departments point their indexers to the license master. These departments want license report by indexers. Do you know how to pull license usage by indexers in this case?

gnanaraj_mcc · ‎07-02-2019

i am looking for the splunk query to run on the license manager to find out the license usage by indexer name. The license usage log dont have the indexer name, it got only the GUID of the indexer in a field called i. license manager is running 7.0.4 version of splunk

gnanaraj_mcc · ‎09-28-2018

How do i compare my raw data volume to the indexed data volume for a specific source type? Can someone help with this query? We have index clustering, a deployment server, and a distributed management console. i want to make sure their same data is not indexed more than one time. (dual, triple indexing of same data)

gnanaraj_mcc · ‎04-23-2018

Hi, For PCF (Pivotal Cloud Foundry). i am using HEC on the heavy forwarder. i have created a new index for these events. while generating the token, Available item(s) for index is showing main, history, summary and default. it is not showing the index which i have created. what is that i am missing. should i leave it default and when PCF connects using the token, it will get updated to the index which i specify in PCF? thank you

gnanaraj_mcc · ‎05-22-2017

Hi we have hosts sending logs to indexer using universal forwarders. The hosts are spread across different time zones. i want to know how the indexer Synchronize different time zones into one. Can you refer any document or something? thank you

gnanaraj_mcc · ‎05-02-2017

Pradipta, you need not take the next attempts in the same day. there will be an expiry date for your test Invitation . you should take all the attempts before this expiry date. I am not sure how many days the invitation is valid. please contact certification@splunk.com to know about the expiry date

gnanaraj_mcc · ‎04-04-2017

Burch, this is in-build log files from the application HP Quality Center software.

gnanaraj_mcc · ‎04-03-2017

<html> <style> h1 { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 18px; font-weight: normal; color: navy;} h2 { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; color: navy;} tr { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000;} td { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000; border: 0 solid dimgray; border-top-width: 1pt; border-right-width: 1pt;vertical-align:text-top;} hr { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: navy;} body { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000;} table { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000; border: 0 solid dimgray;} td.navy {color: navy;} tr.filter { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000;} td.filter { font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; font-weight: normal; color: #000000; border: 0 solid dimgray;} </style> <script type="text/javascript"> </script> <body bgcolor="seashell"> <h2>XXXX Server log</h2><table> <tr><td class ="filter">Log file format version</td><td class ="filter">12.20 [debug]</td></tr> <tr><td class ="filter">Log started at</td><td class ="filter">10:08:43 Mar 28 2017</td></tr> <tr><td class ="filter">DB Time when log started</td><td class ="filter">10:08:43 Mar 28 2017</td></tr> <tr><td class ="filter">Server name</td><td class ="filter">XXX</td></tr> <tr><td class ="filter">Machine name</td><td class ="filter">XXX</td></tr> <tr><td class ="filter">Machine address</td><td class ="filter">XXX</td></tr> <tr><td class ="filter">Build Number</td><td class ="filter">XXX</td></tr> <tr><td class ="filter">Server Node started at</td><td class ="filter">10:08:43 Mar 28 2017</td></tr> </table> <h2>Java Properties</h2> <table cellSpacing="0" style="table-layout:fixed;word-break:break-all;border-width:1pt"> <tr><td width="30%"><b>OS</b></td><td> </td></tr> <tr><td>os.name</td><td>Linux</td></tr> <tr><td>os.version</td><td>2.6.32-642.11.1.el6.x86_64</td></tr> <tr><td>os.arch</td><td>amd64</td></tr> <tr><td>os.home</td><td>null</td></tr> <tr><td width="30%"><b>DB</b></td><td> </td></tr> <tr><td>Oracle.JDBC.version</td><td>5.1.x.000150</td></tr> <tr><td>Mssql.JDBC.version</td><td>5.1.x.000085</td></tr> <tr><td width="30%"><b>User</b></td><td> </td></tr> <tr><td>user.name</td><td>almadm</td></tr> <tr><td>user.home</td><td>/export/home/almadm</td></tr> <tr><td>user.dir</td><td>/qc/app/HP/ALM/server</td></tr> <tr><td>user.language</td><td>en</td></tr> <tr><td width="30%"><b>Java</b></td><td> </td></tr> <tr><td>java.vm.vendor</td><td>Oracle Corporation</td></tr> <tr><td>java.version</td><td>1.7.0_51</td></tr> <tr><td>java.vm.version</td><td>24.51-b03</td></tr> <tr><td>java.home</td><td>/qc/app/HP/java/jre</td></tr> <tr><td>java.class.path</td><td>../wrapper/wrapper.jar:../server/lib/annotations/:../server/lib/ext/:../server/lib/jaspi/:../server/lib/jetty-annotations-9.1.4.v20140401.jar:../server/lib/jetty-client-9.1.4.v20140401.jar:../server/lib/jetty-continuation-9.1.4.v20140401.jar:../server/lib/jetty-deploy-9.1.4.v20140401.jar:../server/lib/jetty-http-9.1.4.v20140401.jar:../server/lib/jetty-io-9.1.4.v20140401.jar:../server/lib/jetty-jaas-9.1.4.v20140401.jar:../server/lib/jetty-jaspi-9.1.4.v20140401.jar:../server/lib/jetty-jmx-9.1.4.v20140401.jar:../server/lib/jetty-jndi-9.1.4.v20140401.jar:../server/lib/jetty-plus-9.1.4.v20140401.jar:../server/lib/jetty-proxy-9.1.4.v20140401.jar:../server/lib/jetty-rewrite-9.1.4.v20140401.jar:../server/lib/jetty-schemas-3.1.jar:../server/lib/jetty-security-9.1.4.v20140401.jar:../server/lib/jetty-server-9.1.4.v20140401.jar:../server/lib/jetty-servlet-9.1.4.v20140401.jar:../server/lib/jetty-servlets-9.1.4.v20140401.jar:../server/lib/jetty-util-9.1.4.v20140401.jar:../server/lib/jetty-webapp-9.1.4.v20140401.jar:../server/lib/jetty-xml-9.1.4.v20140401.jar:../server/lib/jndi/:../server/lib/jsp/:../server/lib/launcher-sources.jar:../server/lib/launcher.jar:../server/lib/monitor/:../server/lib/servlet-api-3.1.jar:../server/lib/setuid/:../server/lib/spdy/:../server/lib/websocket/:../server/lib/annotations/asm-4.1.jar:../server/lib/annotations/asm-commons-4.1.jar:../server/lib/annotations/javax.annotation-api-1.2.jar:../server/lib/jndi/javax.activation-1.1.0.v201105071233.jar:../server/lib/jndi/javax.mail.glassfish-1.4.1.v201005082020.jar:../server/lib/jndi/javax.transaction-api-1.2.jar:../server/lib/jsp/javax.el-3.0.0.jar:../server/lib/jsp/javax.servlet.jsp-2.3.2.jar:../server/lib/jsp/javax.servlet.jsp-api-2.3.1.jar:../server/lib/jsp/javax.servlet.jsp.jstl-1.2.0.v201105211821.jar:../server/lib/jsp/javax.servlet.jsp.jstl-1.2.2.jar:../server/lib/jsp/jetty-jsp-jdt-2.3.3.jar:../server/lib/jsp/org.apache.taglibs.standard.glassfish-1.2.0.v201112081803.jar:../server/lib/jsp/org.eclipse.jdt.core-3.8.2.v20130121.jar:../server/lib/monitor/jetty-monitor-9.1.4.v20140401.jar</td></tr> <tr><td>java.specification.version</td><td>1.7</td></tr> <tr><td>java.specification.vendor</td><td>Oracle Corporation</td></tr> <tr><td>java.specification.name</td><td>Java Platform API Specification</td></tr> <tr><td>java.vendor.url</td><td>http://java.oracle.com/</td></tr> <tr><td>java.vm.specification.version</td><td>1.7</td></tr> <tr><td>java.vm.specification.vendor</td><td>Oracle Corporation</td></tr> <tr><td>java.vm.specification.name</td><td>Java Virtual Machine Specification</td></tr> <tr><td>java.class.version</td><td>51.0</td></tr> <tr><td>java.library.path</td><td>../wrapper</td></tr> <tr><td>java.io.tmpdir</td><td>/tmp</td></tr> <tr><td>java.compiler</td><td>null</td></tr> <tr><td>java.ext.dirs</td><td>/qc/app/HP/java/jre/lib/ext:/usr/java/packages/lib/ext</td></tr> <tr><td width="30%"><b>Other</b></td><td> </td></tr> <tr><td>Total memory</td><td>3960MB</td></tr> <tr><td>Free memory</td><td>3326MB</td></tr> <tr><td>Max memory to be used</td><td>7919MB</td></tr> <tr><td>Available Processors</td><td>4</td></tr> <tr><td>Using config file</td><td>null</td></tr> </table> <form NAME ="filterForm"> <TABLE> <tr class ="filter"></TD><B>Log Filter</B><TD></TR> <TR class ="filter"> <TD class ="filter">Thread:</TD> <TD class ="filter"><INPUT NAME="thread" SIZE=30 TYPE=TEXT VALUE=""> </TD> <TD class ="filter">Request Type: <SELECT NAME="reqType"> <OPTION VALUE="FREC,REST">ALL</OPTION> <OPTION VALUE="FREC">FREC</OPTION> <OPTION VALUE="REST">REST</OPTION> </SELECT> </TD> <TD class ="filter">Level:</TD> <TD class ="filter"><SELECT NAME="level"> <OPTION VALUE="DBG">DBG</OPTION> <OPTION VALUE="FLW">FLW</OPTION> <OPTION VALUE="WRN">WRN</OPTION> <OPTION VALUE="ERR">ERR</OPTION> </SELECT> </TD> </TR> <TR class ="filter"> <TD class ="filter">Login:</TD> <TD class ="filter"><INPUT NAME="Login" SIZE=30 TYPE=TEXT VALUE=""> </TD> </TR> <TR class ="filter"> <TD class ="filter">IP:</TD> <TD class ="filter"><INPUT NAME="IP" SIZE=30 TYPE=TEXT VALUE=""> </TD> </TR> <TR class ="filter"> <TD class ="filter">Method:</TD> <TD class ="filter"><INPUT NAME="Method" SIZE=30 TYPE=TEXT VALUE=""></TD> </TR> <TR class ="filter"> <TD class ="filter">Message:</TD> <TD class ="filter"><INPUT NAME="Message" SIZE=30 TYPE=TEXT VALUE=""></TD> <TD class ="filter"><BUTTON name="filterB" type="button" onClick="filter()" > Filter </BUTTON> <BUTTON name="clearDilterB" type="button" onClick="clearFilter()">Clear Filter</BUTTON> </TD> </TR> </TABLE> </FORM> <table width="100%" cellPadding="4" cellSpacing="0" align="right" style="table-layout:fixed;word-break:break-all;border-width:1pt"> <tr bgcolor="gray"> <td width="7%" style="color: Yellow"><b>DB Date<br/>and Time</b></td> <td width="7%" style="color: Yellow"><b>ALM Node<br/>Date<br/>and Time</b></td> <td width="17%" style="color: Yellow"><b>Thread</b></td> <td width="5%" style="color: Yellow"><b>Request<br/>Type</b></td> <td width="7%" style="color: Yellow"><b>Login</b></td> <td width="7%" style="color: Yellow"><b>IP</b></td> <td width="5%" style="color: Yellow"><b>Level</b></td> <td width="17%" style="color: Yellow"><b>Method</b></td> <td width="28%" style="color: Yellow"><b>Message</b></td> </tr> <tr bgcolor="yellow"><td>Mar 28<br>14:05:07.513</td><td>Mar 28<br>14:05:08.329</td><td>qtp2094206515-455</td><td>N/A</td><td>N/A</td><td>N/A</td><td>WRN</td><td>CAbsServlet.doPost(378)</td><td>Failed setting thread information<p>com.hp.alm.platform.exception.NoSuchSessionException<p>Messages:<br>The session authentication has failed.;<br><p>Stack Trace:<br>com.hp.alm.platform.exception.NoSuchSessionException: The session authentication has failed.<br>at com.hp.alm.platform.connection.authentication.CLoginSessionDirectory.getItem(CLoginSessionDirectory.java:85)<br>at com.hp.alm.platform.connection.authentication.CLoginSessionDirectory.getItem(CLoginSessionDirectory.java:61)<br>at com.hp.alm.platform.server.web.CAbsServlet.setThreadInfo(CAbsServlet.java:1029)<br>at com.hp.alm.platform.server.web.CAbsServlet.doPost(CAbsServlet.java:376)<br>at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)<br>at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)<br>at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:738)<br>at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1651)<br/>at

gnanaraj_mcc · ‎04-03-2017

Hi Dal, i have answered to @SloshBurch, is that the same thing you are asking. do let me know. thank you

gnanaraj_mcc · ‎04-03-2017

Thanks @SloshBurch. The details i posted above is from the file i open from my desktop. i have posted the actual content of the html file below. i cant paste the full content due to character limitation to submit in splunk answers /qc/data/logs/sa/ and /data/logs/qc/qc are the locations. FYI.. there are two different html files, both need to be indexed. let me know any more details required

gnanaraj_mcc · ‎03-30-2017

Hi, i have situation to index a log file which is actually a html file. This is an access log. This looks complex to me. The html file has got different sections. i want only the actual access log part (section 4) to be indexed. Can someone help me to come up with props.conf/transforms.conf files for this? Section 1: (general information about the log) XXX XXX Server log Log file format version 12.20 [debug] Log started at 03:57:42 Mar 13 2017 DB Time when log started 03:57:42 Mar 13 2017 Server name XXX Machine name XXX Machine address XXX Build Number 3424 Server Node started at 03:57:02 Mar 13 2017 Section 2: Java Properties ( It is of a table format) i am not able to put it in table form here. Its a big table, i gave only sample Java Properties OS os.name Linux os.version 2.6.32-642.11.1.el6.x86_64 os.arch amd64 os.home null DB Oracle.JDBC.version 5.1.x.000150 Mssql.JDBC.version 5.1.x.000085 user.language en Section 3: Filter section. This got few text box and buttons (to click and filter) Log Filter Thread: (text box) Login: (text box) IP: (text box) Method: (text box) Filter (button) Clear Filter (Button) Section 4: Actual log file, in a table format DB Dateand Time ALM Node Date and Time Thread Request Type Login IP Level Method Message Mar 13 03:57:48.942 Mar 13 03:57:49.613 WrapperSimpleAppMain N/A N/A N/A ERR FTPServerInitializerImpl.startFTPServer(145) FTP server failed to start Mar 1304:00:01.692 Mar 1304:00:02.363 newjob:alm.qc.job.automail[939e4baa-c814-40f1-834b-fe46b83336e3] N/A N/A N/A WRN AutoMailLogicImpl.getDefaultFromAddress(862)

gnanaraj_mcc · ‎06-02-2016

I am looking for some help in managing apps using the deployment server. Here is the case. I have two different apps, sending two different logs from the same set of servers. The index and sourcetype are the same. They use the same server class. App 1: monitor://G:\Logfiles\subdir1\*.log monitor://G:\Logfiles\subdir2\*.log App2 monitor://G:\Logfiles\subdir3\*.log monitor://G:\Logfiles\subdir4\*.log Now I have a new requirement to send the all the logs from all the sub directories. There are close to 250 sub directories monitor://G:\Logfiles\*\*.log How to do I achieve this? • Should I disable App1 and App2, create new app to monitor://G:\Logfiles\*\*.log . if yes, how to disable app • Should I delete App1 and App2, create new app to monitor://G:\Logfiles\*\*.log • Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log . Will this cause events duplicating • Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log excluding the subdir1, subdir2, subdir3 and subdir4 Any other ways of doing this?

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-24-2013

Online Status	Offline
Date Last Visited	‎12-14-2021 03:00 AM

Access to edit specific license pool

splunk license usage by indexer not on GUID

Comparing raw data volume Vs indexed data volume

Index name not showing up HTTP Event Collector(HEC...

how does time synchronization work between forward...

How to index only part of a html log file?

How to merge two apps in deployment server

Access to edit specific license pool

Re: splunk license usage by indexer not on GUID

splunk license usage by indexer not on GUID

Comparing raw data volume Vs indexed data volume

Index name not showing up HTTP Event Collector(HEC...

how does time synchronization work between forward...

Re: Where can I contact someone about Splunk Certi...

Re: How to index only part of a html log file?

Re: How to index only part of a html log file?

Re: How to index only part of a html log file?

Re: How to index only part of a html log file?

How to index only part of a html log file?

How to merge two apps in deployment server