Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vjsplunk
vjsplunk
Loves-to-Learn Lots
Member since:
04-12-2022
11-25-2022
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-12-2022 |
Activity Feed
- Posted Logs from windows server are getting delayed to indexed in splunk on All Apps and Add-ons. 11-23-2022 08:47 PM
- Posted Re: Why am I receiving fewer events when using rename command in Splunk? on Splunk Search. 10-25-2022 08:00 AM
- Posted Why am I receiving fewer events when using rename command in Splunk? on Splunk Search. 10-25-2022 07:43 AM
- Posted How to resolve this error on search head: The metric> value=0.00003393234971117585 provided> on Splunk Search. 08-01-2022 12:07 AM
- Posted Is there any reason why syntax highlighting is not working by default for splunk logs? on Splunk Search. 07-11-2022 11:19 PM
- Posted Re: Mapping index to another index on Splunk Search. 05-13-2022 05:02 AM
- Posted Re: Mapping index to another index on Splunk Search. 05-13-2022 04:52 AM
- Posted Re: Mapping index to another index on Splunk Search. 05-10-2022 09:27 PM
- Posted Is it possible to map one index to another index? on Splunk Search. 05-10-2022 09:14 PM
- Tagged Is it possible to map one index to another index? on Splunk Search. 05-10-2022 09:14 PM
- Posted Re: Timestamp Parsing on Splunk Search. 04-12-2022 11:11 PM
- Posted Re: Timestamp Parsing on Splunk Search. 04-12-2022 11:01 PM
- Posted Receiving timestamp parsing error on Splunk Search. 04-12-2022 10:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-23-2022
08:47 PM
Logs from windows server are getting delayed to indexed in splunk. Noticed the below error in plunked.log in the windows server. — ERROR [MethodServerMonitor] wt.manager.ServerTable - Dead MethodServer reported; reported exception -- Any thoughts?
... View more
Labels
- Labels:
-
search
10-25-2022
08:00 AM
Without rename: index="A" sourcetype="B" | stats values(project_name2), count(linecount) by pod | sort - count(linecount) | head 10 With rename: index="A" sourcetype="B" | stats values(project_name2) as project count(linecount) as lines by pod | sort - count(linecount) | head 10
... View more
10-25-2022
07:43 AM
I am getting fewer events when using rename command in splunk. ( Compared to the search where I haven't used rename). What could be the reason behind this?
... View more
Labels
- Labels:
-
other
08-01-2022
12:07 AM
Got this error on the search head, Please help us to resolve this .
> Search peer xxxxxx has the following> message: The metric> value=0.00003393234971117585 provided> for > source=/opt/splunkforwarder/var/log/splunk/metrics.log,> sourcetype=splunk_metrics_log,> host=xxxxx, index=_metrics is not a> floating point value. Using a> "numeric" type rather than a "string"> type is recommended to avoid indexing> inefficiencies. Ensure the metric> value is provided as a floating point> number and not as a string. For> instance, provide 123.001 rather than> "123.001"
... View more
Labels
- Labels:
-
metadata
07-11-2022
11:19 PM
Is there any reason why syntax highlighting is not working by default for splunk logs?. While clicking on the Syntax hightlight option I am getting the logs Highlighted.
... View more
Labels
- Labels:
-
search job inspector
05-13-2022
05:02 AM
Thank you. This is for mapping one prod index to another prod index
... View more
05-13-2022
04:52 AM
I haven't find any documents for mapping one index to another via summery index..Can you gave the documents or process
... View more
05-10-2022
09:14 PM
04-12-2022
11:11 PM
Thank you. These are the sample lines: ======== Sat Mar 19 16:33:08 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_44388_20220319163308485740872483.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.14.0.0.0 Sat Mar 19 15:25:42 2022 -05:00 LENGTH : '228' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/1' STATUS:[1] '0' DBID:[0] '' SESSIONID:[0] '' USERHOST:[0] '' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Audit file /u01/app/oracle/product/19.3.0/dbhome_1/rdbms/audit/lllprd1_ora_4908_20220319152542116439456508.aud Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production ==============
... View more
04-12-2022
11:01 PM
Yes. I have applied the below 2 rules: LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true Line breaking is proper. Not sure it is showing the error
... View more
04-12-2022
10:03 PM
I am trying to set timestamp for the event :
========
Sat Mar 19 16:33:08 2022 -05:00
LENGTH : '228'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
=========
The rules I used are:
TIME_FORMAT = %a %b %d %H:%M:%S %Y %:z
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 32
It is catching the timestamp correctly. However showing the error "could not use strptime to parse timestamp from LENGTH : '228' "
I am not sure how to resolve the error.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-25-2022
08:30 AM
|
