Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dwin02
dwin02
Explorer
Member since:
01-28-2016
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 01-28-2016 |
Activity Feed
- Got Karma for index the same logs to multiple indexes - good or bad?. 06-05-2020 12:48 AM
- Karma cooked connection timed out? for suhprano. 06-05-2020 12:46 AM
- Posted Re: index the same logs to multiple indexes - good or bad? on Getting Data In. 07-07-2017 10:55 AM
- Posted index the same logs to multiple indexes - good or bad? on Getting Data In. 07-04-2017 06:55 AM
- Tagged index the same logs to multiple indexes - good or bad? on Getting Data In. 07-04-2017 06:55 AM
- Tagged index the same logs to multiple indexes - good or bad? on Getting Data In. 07-04-2017 06:55 AM
- Tagged index the same logs to multiple indexes - good or bad? on Getting Data In. 07-04-2017 06:55 AM
- Posted Re: How do we monitor Disk I/O in Splunk? on Getting Data In. 02-23-2016 05:57 PM
- Posted How do we monitor Disk I/O in Splunk? on Getting Data In. 02-19-2016 12:53 PM
- Tagged How do we monitor Disk I/O in Splunk? on Getting Data In. 02-19-2016 12:53 PM
- Tagged How do we monitor Disk I/O in Splunk? on Getting Data In. 02-19-2016 12:53 PM
- Tagged How do we monitor Disk I/O in Splunk? on Getting Data In. 02-19-2016 12:53 PM
- Tagged How do we monitor Disk I/O in Splunk? on Getting Data In. 02-19-2016 12:53 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 09:19 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 08:06 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 06:53 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 01:25 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 12:18 PM
- Posted Re: How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 11:08 AM
- Posted How to create a table based on certain fields from the Output Results? on Splunk Search. 02-17-2016 06:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-07-2017
10:55 AM
Thank you both for your answers.
Much appreciated!!!
... View more
07-04-2017
06:55 AM
1 Karma
Hi There,
I would like to know if it's not recommended to index the same logs to two different indexes?
We actually found a way to do it using a symlink :
https://answers.splunk.com/answers/61433/have-forwarder-duplicating-data-to-2-indexes.html
Besides the license usage since we will be indexing the same logs twice, is this a bad practice?
Thanks,
Aldwin
... View more
02-19-2016
12:53 PM
Hi Splunk Support,
When activating the Performance Monitoring in inputs.conf, I was able to send free disk space to Splunk, but how do I activate monitoring of Disk I/O?
Please advise?
Thanks,
Aldwin
... View more
02-17-2016
09:19 PM
It would need to this one :
Do you you've multiple queues in single events and want to sum all the queue depth in each event and compare it to100?
... View more
02-17-2016
08:06 PM
Hi Somesoni,
I've tried that already but it did not work. Even if I change it to where CURRENT_QUEUE_DEPTH > 1 since I only have 4 as the highest current depth.
Thanks,
Aldwin
... View more
02-17-2016
06:53 PM
Hi Somesoni2,
Thank you for all your help. It worked perfectly.
If you don't mind, using the same search:
index=iib_mq sourcetype=iib_mq_dev source="C:\\Temp\\mqoutput.txt" "QUEUE(" "CURDEPTH(" | rex max_match=8 "QUEUE\((?[^\)]+)" | rex max_match=8 "CURDEPTH\((?\d+)"
I just want to show where the value of CURDEPTH is more than let's say 100, I've tried looking at some solutions but can't seem to find the right solution.
Thanks,
Aldwin
... View more
02-17-2016
01:25 PM
You mean this one:
index=iib_mq sourcetype=iib_mq_dev source="C:\\Temp\\mqoutput.txt" "QUEUE(" "CURDEPTH("
| rex "QUEUE\((?[^\)]+)[\S\s]CURDEPTH\((?\d+)" | table QUEUE_NAME CURRENT_QUEUE_DEPTH
I've tried this and it's not working.
Your second update worked but only for rex "CURDEPTH\((?\d+)", the rex "QUEUE\((?[^\)]" did not work.
... View more
02-17-2016
12:18 PM
Hi Somesoni2,
I'm now getting a result for the rex "CURDEPTH\((?\d+)" but still not working for rex "QUEUE\((?[^\)]" .
Please see screenshot attach.
Thanks,
Aldwin
... View more
02-17-2016
11:08 AM
Thank you for your suggestion but it's not working.
| rex "QUEUE\((?[^\)]+)[\S\s]CURDEPTH\((?\d+)"
The following regex expression doesn't show the queue name and nor the Current Queue Depth.
I'm trying to find out maybe there's something wrong with the expression but your suggestion is very appreciated.
Thanks,
Aldwin
... View more
02-17-2016
06:46 AM
Hi Splunk Support,
I'm trying to create a table based on certain fields from the Output Results:
Search String:
index=iib_mq sourcetype=iib_mq_dev source="C:\\Temp\\mqoutput.txt"
Results :
1 : dis ql (VIA.EVENT.ACTUTIME.UPD.FOR.ODBS) curdepth
AMQ8409: Display Queue details.
QUEUE(VIA.EVENT.ACTUTIME.UPD.FOR.ODBS)
TYPE(QLOCAL) CURDEPTH(0)
2 : dis ql (VIA.EVENT.ACTUTIME.UPD.FOR.ODBS.BO) curdepth
AMQ8409: Display Queue details.
QUEUE(VIA.EVENT.ACTUTIME.UPD.FOR.ODBS.BO)
TYPE(QLOCAL) CURDEPTH(0)
3 : dis ql (VIA.EVENT.ACTUTIME.UPD.FOR.OTP) curdepth
AMQ8409: Display Queue details.
QUEUE(VIA.EVENT.ACTUTIME.UPD.FOR.OTP) TYPE(QLOCAL)
CURDEPTH(0)
Table to Create:
QUEUE NAME CURRENT_QUEUE_DEPTH
VIA.EVENT.ACTUTIME.UPD.FOR.ODBS CURDEPTH(0)
Thanks,
Aldwin
... View more
- Tags:
- splunk-cloud
- table
02-08-2016
06:33 AM
Hi Splunk Support,
From Settings>Forwarding and Receiving, I was able to configure my forwarding, but I'm not able to configure receiving. Whenever I click on Configure Receiving, I get redirected to a "Page not Found"
URL: https://<hostname>.cloud.splunk.com/en-US/manager/system/data/inputs/tcp/cooked
Error:
404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 56b8a6b8f37f8ed44fcc50) in Search
This page was linked to from https://<hostname>.cloud.splunk.com/en-US/manager/system/forwardreceive.
You are logged into prd-p-z62lqxmx6n3p.cloud.splunk.com as dwin, which is connected to splunkd @90ea9ab275dc at https://127.0.0.1:8089 on Mon Feb 8 14:31:22 2016.
... View more
01-28-2016
10:16 AM
Protocols, I am assuming that everything is running on TCP, but perhaps UDP is required as well
Permission, there is no mention on permission set for the Splunk Universal forwarder. This should be run on an account other than admin. We need to get very specific here.
Network communication instantiation. Is communication with the universal forwarder bi-lateral or uni-lateral pushing information out? This will be important for the firewall rules to be setup properly.
... View more
