I am using Splunk Add-on for AWS and what to ingest data from S3 bucket. I have referred the below document which says there are multiple inputs for S3 configuration. Please assist me with an information on which input has to be used in which condition. Also can we ingest html data from S3 or cloudwatchlog to splunk using the same app? https://docs.splunk.com/Documentation/AddOns/released/AWS/S3   ... View more

How can I control or force the hostname to be a specific value via inputs.conf? Inputs.conf stanza [monitor:///var/log/*] disabled = 0 index = test_data host = hostname1,hostname2,hostname3,hostname4 [monitor:///var/adm/*] disabled = 0 index = test_data host = hostname1,hostname2,hostname3,hostname4 [monitor:///etc/*] disabled = 0 index = test_data host = hostname1,hostname2,hostname3,hostname4 I have tried multiple solution Case 1--> added host_regex=<regular expression>  this did not work. Case 2 --> added host= hostname1,hostname2,hostname3,hostname4 ---> this worked for some log file path like .var/log/message host = hostname1 and for some log file path like /var/log/dnf.log I am getting hostname=hostname1,hostname2,hostname3,hostname4 Case 3 --> I tried utilizing the feature where inputs.conf looks like below. But I can not implement this as a solution as the app will be pushed from DS to all UF respectively hence hardcoding using default setting can not be done in my case. inputs.conf [default] host = <hostname1> [monitor:///var/log/*] disabled = 0 index = test_data [monitor:///var/adm/*] disabled = 0 index = test_data [monitor:///etc/*] disabled = 0 index = test_data   ... View more

Need help with regex for inputs.conf to change the host as hostname and incase host has FQDN it should pick up till hostname only  example  1) host=hostname1 2) host = hostname2.yahoo.com 3) host = hostname3.google.com   In all these example it should pick only hostname1,hostname2,hostname3 ... View more

I am getting log file data from some linux boxes and some are not sending data. Unable to find the reason why? Please assist me on the same  Input stanza [monitor:///var/log] disabled = 0 index = unix_data [monitor:///var/adm] disabled = 0 index = unix_data [monitor:///etc] disabled = 0 index = unix_data RHEL 6.9----------------->not Working RHEL 7.4----------------->not Working SLES 11-------------->Working HP-UX 11.31--------->not Working  HP-UX 11.31---------->not Working  Solaris10--------------->Working  ... View more

I am facing issue for certain sourcetype the indexed events are with the future time stamp. The data of these source type is getting indexed in splunk via HF and forwarded to IDX. The props is defined from the SH GUI. please help me understand and eradicate this issue. Example event data 12/12/2024 10:08:24 PM LogName=Application SourceName=Galaxy EventCode=1 EventType=4 Type=Information ComputerName=testserver.gtest.com TaskCategory=None OpCode=None RecordNumber=8425512 Keywords=Classic ... View more

Need help with regex for below data. Please assist me on the same. field name -------- fieldvalue Devicename------GNTESTFS1 Sample data Jan 5 15:34:18 7.73.151.197 1 2023-01-05T14:34:17Z 1.2.3.44 StorageArray - - [0@0] GNTESTFS1;2288;Critical;Either the NTP server's resolved or configured IP address is wrong or the IP address is unavailable via the attached network Jan 5 15:31:20 7.73.151.197 1 2023-01-05T14:31:19Z 1.2.3.44 StorageArray - - [0@0] GNTESTFS1;2288;Critical;Either the NTP server's resolved or configured IP address is wrong or the IP address is unavailable via the attached network Jan 5 09:32:37 7.73.151.197 1 2023-01-05T08:32:36Z 1.2.3.44 StorageArray - - [0@0] GNTESTFS1;2288;Critical;Either the NTP server's resolved or configured IP address is wrong or the IP address is unavailable via the attached network Thanks in advance   ... View more

Need help with Regex field ------------------------feildvalue servername ---------- xtestf100s log_level--------------INFO OR error or warning message ------------ anything from gofer till end Jan 3 03:50:38 xtestf100s goferd: [INFO][worker-0] gofer.messaging.adapter.connect:28 - connecting: proton+amqps://xtest123s.pharma.aventis.com:5647 Jan 3 03:50:38 xtestf100s goferd: [INFO][worker-0] gofer.messaging.adapter.proton.connection:87 - open: URL: amqps://xtest123s.pharma.aventis.com:5647|SSL: ca: /etc/rhsm/ca/katello-default-ca.pem|key: None|certificate: /etc/pki/consumer/bundle.pem|host-validation: None Jan 3 03:50:38 xtestf100s goferd: [ERROR][worker-0] gofer.messaging.adapter.connect:33 - connect: proton+amqps://xtest123s.pharma.aventis.com:5647, failed: Connection amqps://xtest123s.pharma.aventis.com:5647 disconnected: Condition('proton.pythonio', 'Connection refused to all addresses') Jan 3 03:50:38 xtestf100s goferd: [INFO][worker-0] gofer.messaging.adapter.connect:35 - retry in 106 seconds Jan 3 03:50:54 xtestf100s kernel: type=1400 audit(1672714254.276:566412): avc: denied { read } for pid=75981 comm="ip" name="libCvDllFilter.so" dev="dm-13" ino=393745 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 Jan 3 03:50:54 xtestf100s kernel: type=1400 audit(1672714254.276:566413): avc: denied { open } for pid=75981 comm="ip" path="/opt/commvault/Base64/libCvDllFilter.so" dev="dm-13" ino=393745 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 Jan 3 03:50:54 xtestf100s kernel: type=1400 audit(1672714254.276:566414): avc: denied { getattr } for pid=75981 comm="ip" path="/opt/commvault/Base64/libCvDllFilter.so" dev="dm-13" ino=393745 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 Jan 3 03:50:54 xtestf100s kernel: type=1400 audit(1672714254.276:566415): avc: denied { execute } for pid=75981 comm="ip" path="/opt/commvault/Base64/libCvDllFilter.so" dev="dm-13" ino=393745 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 Jan 3 03:51:43 xtestf100s kernel: type=1400 audit(1672714303.392:566416): avc: denied { read } for pid=77988 comm="ip" name="Base" dev="dm-13" ino=116 scontext=system_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=lnk_file permissive=1 Jan 3 03:51:43 xtestf100s kernel: type=1400 audit(1672714303.392:566417): avc: denied { read } for pid=77988 comm="ip" name="libCvDllFilter.so" dev="dm-13" ino=393745 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 ... View more

Regex working fine in standalone splunk but not in clustered environment. 1) Indexer conponent of app-->test_log_idx having the indexes.conf and  props.conf kept at default directory with local directory empty is below.  [test:sanetiq:log] CHARSET = AUTO DATETIME_CONFIG = EXTRACT-log_level = \[\d+\]\s(?P<log_level>[^\s]+) EXTRACT-message = \]\s-\s(?P<message>.+) EXTRACT-process_name = \[\d+\]\s.+\s\s(?P<process_name>.+)\s\[ EXTRACT-sanetiq_label_type = Label\sType\s=\s(?P<sanetiq_label_type>[^\s]+) EXTRACT-sanetiq_mask_template = Mask\sTemplate\s=\s(?P<sanetiq_mask_template>[^\s]+) EXTRACT-sanetiq_print_request_id = Print\sRequest\s=\s(?P<sanetiq_print_request_id>[^\s]+) EXTRACT-sanetiq_printer_name = Printer\s=\s(?P<sanetiq_printer_name>[^\s]+) NO_BINARY_CHECK = true category = Custom disabled = false pulldown_type = true 2) UF component of app-->deployed to UF is test_log_uf having inputs.conf placed in default and local directory is empty [monitor://D:\Tab\Server\data\SanetiqLogger\*log*] index=test_log_data source=test:sanetiq:log 3) Search head component of app-->test_log_sh having same props.conf as mentioned above Sample data 2022-12-09 16:02:04,304 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method ends 2022-12-09 16:02:04,040 [2452022120993750] INFO SanetiqLogger [(null)] - Closing all documents in Codesoft Instance 2022-12-09 16:02:04,038 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 16:02:04,037 [2452022120993750] INFO SanetiqLogger [(null)] - Get Active Codesoft Instance to quit : PID - 30812 2022-12-09 16:02:04,035 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method begins 2022-12-09 16:02:04,030 [2452022120993750] INFO SanetiqLogger [(null)] - Finish Codesoft Instance PID : 30812 1 Labels printed Printer = Zebra ZM400 (203 dpi)- ABCDB362 Mask Template = DI AMBRS-IDENT REGLEMENTEE Label Type = DI IDENT REGLEMENTEE 2022-12-09 16:02:03,480 [2452022120993750] INFO SanetiqLogger [(null)] - PRINT : Print Request = 3855021 2022-12-09 16:01:56,936 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method ends 2022-12-09 16:01:56,928 [2452022120993750] INFO SanetiqLogger [(null)] - Codesoft Instance Created : PID - 30812 2022-12-09 16:01:52,127 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 16:01:50,708 [2452022120993750] INFO SanetiqLogger [(null)] - End of CheckIntegrity(string strUserMatricule) 2022-12-09 16:01:50,675 [2452022120993750] INFO SanetiqLogger [(null)] - Satrt of CheckIntegrity(string strUserMatricule) 2022-12-09 16:01:50,670 [2452022120993750] INFO SanetiqLogger [(null)] - Check Integrity of printTask 1604231 printrequest 3855021 Imported Print Requests : 1 2022-12-09 15:56:27,266 [2412022120993750] INFO SanetiqLogger [(null)] - Imported Data Lines : 1 2022-12-09 15:56:23,731 [2412022120993750] INFO SanetiqLogger [(null)] - Data Import File E:\sanetiq\sanofi\etudes\ficentree\AMBXSQP\GPAO\TPSREEL\SANIDENT.1 correctly deleted at Sanetiq.BusinessFramework.BusinessObjects.PrintModule.Loop() at Sanetiq.BusinessFramework.BusinessObjects.PrintTask.CheckIntegrity(String strUserMatricule) 2022-12-09 15:51:26,540 [2452022120993750] ERROR SanetiqLogger [(null)] - ERROR : at Sanetiq.BusinessFramework.BusinessObjects.PrintTask.checkPrinterAndMaskTemplateCompatibility(Printer printer, MaskTemplate maskTemplate, String strUserMatricule) 2022-12-09 15:51:26,532 [2452022120993750] ERROR SanetiqLogger [(null)] - Service Print Error2 : PrintRequest ID=3855018, Error=LABEL_FORMAT_INCOMPATIBLE 2022-12-09 15:51:26,367 [2452022120993750] INFO SanetiqLogger [(null)] - Satrt of CheckIntegrity(string strUserMatricule) 2022-12-09 15:51:26,363 [2452022120993750] INFO SanetiqLogger [(null)] - Check Integrity of printTask 1604228 printrequest 3855018 2022-12-09 15:48:58,989 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method ends 2022-12-09 15:48:58,736 [2262022120993750] INFO SanetiqLogger [(null)] - Closing all documents in Codesoft Instance 2022-12-09 15:48:58,732 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 15:48:58,728 [2262022120993750] INFO SanetiqLogger [(null)] - Get Active Codesoft Instance to quit : PID - 4340 2022-12-09 15:48:58,724 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method begins 2022-12-09 15:48:58,717 [2262022120993750] INFO SanetiqLogger [(null)] - Finish Codesoft Instance PID : 1234 1 Labels printed Printer = Zebra ZM400 (203 dpi) - BOX5 Mask Template = TICKET-PESEE-300 Label Type = Tickets BOX5 2022-12-09 15:48:58,152 [2262022120993750] INFO SanetiqLogger [(null)] - PRINT : Print Request = 3855017 2022-12-09 15:48:47,883 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method ends 2022-12-09 15:48:47,879 [2262022120993750] INFO SanetiqLogger [(null)] - Codesoft Instance Created : PID - 4340 2022-12-09 15:48:42,148 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 15:48:41,272 [2262022120993750] INFO SanetiqLogger [(null)] - End of CheckIntegrity(string strUserMatricule) 2022-12-09 15:48:41,211 [2262022120993750] INFO SanetiqLogger [(null)] - Satrt of CheckIntegrity(string strUserMatricule) 2022-12-09 15:48:41,204 [2262022120993750] INFO SanetiqLogger [(null)] - Check Integrity of printTask 1234567 printrequest 1234567 Imported Print Requests : 1 2022-12-09 15:48:40,389 [2222022120993750] INFO SanetiqLogger [(null)] - Imported Data Lines : 1 2022-12-09 15:48:40,276 [2222022120993750] INFO SanetiqLogger [(null)] - Data Import File E:\sanetiq\sanofi\etudes\ficentree\AMBXSQP\XFP\BOX5\ticpes correctly deleted at Sanetiq.BusinessFramework.BusinessObjects.PrintModule.Loop() at Sanetiq.BusinessFramework.BusinessObjects.PrintTask.CheckIntegrity(String strUserMatricule) 2022-12-09 15:53:48,067 [2452022120993750] ERROR SanetiqLogger [(null)] - ERROR : at Sanetiq.BusinessFramework.BusinessObjects.PrintTask.checkPrinterAndMaskTemplateCompatibility(Printer printer, MaskTemplate maskTemplate, String strUserMatricule) 2022-12-09 15:53:48,060 [2452022120993750] ERROR SanetiqLogger [(null)] - Service Print Error2 : PrintRequest ID=3855020, Error=LABEL_FORMAT_INCOMPATIBLE 2022-12-09 15:53:47,909 [2452022120993750] INFO SanetiqLogger [(null)] - Satrt of CheckIntegrity(string strUserMatricule) 2022-12-09 15:53:47,905 [2452022120993750] INFO SanetiqLogger [(null)] - Check Integrity of printTask 1604230 printrequest 3855020 2022-12-09 15:52:20,553 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method ends 2022-12-09 15:52:20,548 [2262022120993750] INFO SanetiqLogger [(null)] - Codesoft Instance Created : PID - 1556 2022-12-09 15:52:16,395 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 15:52:15,859 [2262022120993750] INFO SanetiqLogger [(null)] - End of CheckIntegrity(string strUserMatricule) 2022-12-09 15:52:15,825 [2262022120993750] INFO SanetiqLogger [(null)] - Satrt of CheckIntegrity(string strUserMatricule) 2022-12-09 15:52:15,822 [2262022120993750] INFO SanetiqLogger [(null)] - Check Integrity of printTask 1604229 printrequest 3855019 Imported Print Requests : 1 2022-12-09 15:52:14,912 [2222022120993750] INFO SanetiqLogger [(null)] - Imported Data Lines : 1 2022-12-09 15:52:14,847 [2222022120993750] INFO SanetiqLogger [(null)] - Data Import File E:\sanetiq\sanofi\etudes\ficentree\AMBXSQP\XFP\BOX5\ticpes correctly deleted 2022-12-09 15:52:30,245 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method ends 2022-12-09 15:52:29,871 [2262022120993750] INFO SanetiqLogger [(null)] - Closing all documents in Codesoft Instance 2022-12-09 15:52:29,866 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 15:52:29,861 [2262022120993750] INFO SanetiqLogger [(null)] - Get Active Codesoft Instance to quit : PID - 1556 2022-12-09 15:52:29,855 [2262022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method begins 2022-12-09 15:52:29,848 [2262022120993750] INFO SanetiqLogger [(null)] - Finish Codesoft Instance PID : 1556 1 Labels printed Printer = Zebra ZM400 (203 dpi) - BOX5 Mask Template = TICKET-PESEE-300 Label Type = Tickets BOX5 2022-12-09 15:52:29,213 [2262022120993750] INFO SanetiqLogger [(null)] - PRINT : Print Request = 3855019 2022-12-09 15:43:03,149 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method ends 2022-12-09 15:43:02,688 [2452022120993750] INFO SanetiqLogger [(null)] - Closing all documents in Codesoft Instance 2022-12-09 15:43:02,682 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.connectToLppx2() method begins 2022-12-09 15:43:02,676 [2452022120993750] INFO SanetiqLogger [(null)] - Get Active Codesoft Instance to quit : PID - 18592 2022-12-09 15:43:02,670 [2452022120993750] INFO SanetiqLogger [(null)] - Lppx2Manager.QuitLppx2() method begins 2022-12-09 15:43:02,662 [2452022120993750] INFO SanetiqLogger [(null)] - Finish Codesoft Instance PID : 18592 1 Labels printed Printer = ZEBRA 105S/Se - Fab Multi-produits - Vracs avec picto Mask Template = SHP-END Label Type = 01-Identification Vracs Int avec picto Multi-Pro 2022-12-09 15:43:00,828 [2452022120993750] INFO SanetiqLogger [(null)] - PRINT : Print Request = 3855015 1 Labels printed Printer = L_LPAMB406 Mask Template = LUNA_AMB_PREL_AC_SEP Label Type = Prélèvements AC Séparateur 2022-12-09 15:43:00,336 [2252022120993750] INFO SanetiqLogger [(null)] - PRINT : Print Request = 3855014 2022-12-09 15:42:58,512 [2452022120993750] INFO SanetiqLogger [(null)] - Print with Codesoft Instance PID : 18592 at Sanetiq.BusinessFramework.BusinessObjects.PrintModule.Loop() at Sanetiq.BusinessFramework.BusinessObjects.PrintTask.CheckIntegrity(String strUserMatricule) ... View more

Need help with splunk SPL or rest api to fetch areport where we can see the count of total servers(splunk universal forwarders) reporting to IDX and HF with breakup. Some UF are sending data to IDXers directly and few of them are sending it via HF(due to some connection issues we have followed this architecture) Please assist me on the same. ... View more

File monitoring inputs for Splunk Add-on for Unix and Linux Query 1-->I have installed the above mentioned app to monitor the file monitoring input from the same. When I enable the default file monitoring inputs I am getting source and source type as attached in the data. But I do not see much interesting fields for the same source and source type. Please assist me with the exact source and source type along with the list of interesting fields it will extract via field extraction. Query 2-->I have installed the above mentioned app to monitor the file monitoring input from the same. When I updated inputs.conf with new file monitoring inputs I am not getting data for the new input. Please let me know why and how can we work on the same to get exact data from new input files. ... View more