cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
uchoavaz
Explorer
Member since: ‎08-11-2022
‎09-22-2022
Community Statistics
Posts 7
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎08-11-2022
Activity Feed
View All

Re: Set up Syntax highlighted for a log file

by in Alerting
‎09-22-2022 07:42 AM
‎09-22-2022 07:42 AM
I will give you an example... This json event i could set up the highlight   The raw text is: {"message":"Nothing to process in worldpay-prd-scheme-event-store-queue-dlq","context":[],"level":200,"level_name":"INFO","channel":"app","datetime":{"date":"2022-08-30 13:06:13.999247","timezone_type":3,"timezone":"UTC"},"extra":{"uid":"e527f53"}}   the sourcetype setup is: ... View more

How would I set up Syntax highlighted for a log fi...

by in Alerting
‎09-22-2022 06:32 AM
‎09-22-2022 06:32 AM
Hello! I have a log file with the following pattern:         13:06:03 CRITICAL  [app] An error happened while processing message active/mastercard/event/secondpresentmentcreateevent/v1/2022/08/30/afae9068-8dc2-5e3a-9e4a-83081925238f ["message" => "[{"requestid":"49120180-f64d-863d-f7f5-c2f58b180587","source":"SYSTEM","reasoncode":"INVALID_REQUEST","description":" [CreateCR2] usecase is not applicable in this context.","recoverable":false,"details":[{"name":"ErrorDetailCode","value":"100001"}]}]","status" => 400,"trace" => [["file" => "/var/www/drm-scheme/vendor/react/event-loop/src/Timer/Timers.php","line" => 101,"function" => "App\Command\{closure}","class" => "App\Command\AbstractQueueProcessor","type" => "->"],["file" => "/var/www/drm-scheme/vendor/react/event-loop/src/StreamSelectLoop.php","line" => 185,"function" => "tick","class" => "React\EventLoop\Timer\Timers","type" => "->"],["file" => "/var/www/drm-scheme/src/AppBundle/Command/AbstractQueueProcessor.php","line" => 311,"function" => "run","class" => "React\EventLoop\StreamSelectLoop","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Command/Command.php","line" => 255,"function" => "execute","class" => "App\Command\AbstractQueueProcessor","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 929,"function" => "run","class" => "Symfony\Component\Console\Command\Command","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/framework-bundle/Console/Application.php","line" => 96,"function" => "doRunCommand","class" => "Symfony\Component\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 264,"function" => "doRunCommand","class" => "Symfony\Bundle\FrameworkBundle\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/framework-bundle/Console/Application.php","line" => 82,"function" => "doRun","class" => "Symfony\Component\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 140,"function" => "doRun","class" => "Symfony\Bundle\FrameworkBundle\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/bin/console","line" => 42,"function" => "run","class" => "Symfony\Component\Console\Application","type" => "->"]],"line" => 261,"class" => "App\Command\AbstractQueueProcessor","request" => "active/mastercard/request/secondpresentmentrequest/v1/2022/08/29/204618304273/cb905322-b2ab-4742-8acd-a7915b9be744","caseId" => "204618304273"] ["uid" => "31473ed"]           But i need to understand how can i set up in the Settings -> Source types -> (sourcetype name create) to make this event highlighted. Here is how i tried to set up (but didn't work):   ... View more
Labels

Re: Create alert for disk usage

by in Alerting
‎09-20-2022 02:26 PM
‎09-20-2022 02:26 PM
I know that the issue is at the dot (".") that can exist or not in the column 3,4 or 5. But how can i put that in the regex? ... View more

Re: Create alert for disk usage

by in Alerting
‎09-20-2022 02:07 PM
‎09-20-2022 02:07 PM
@gcusello i have an issue here with this regex... it is not filtering  this type of event: /dev/mapper/group1-mountpoint_www xfs 9.0G 674M 8.4G 8% 4.5M 33K 4.5M 1% /var/www   basically what changes is the filesystem name (uses "-" and "_") and the size of the numbers and the sizy (M, G, K).   PS: I know that in your example the disk needs to be higher than 80, but i changed the value to 2. ... View more

Re: Create alert for disk usage

by in Alerting
‎09-18-2022 07:19 AM
‎09-18-2022 07:19 AM
Worked! Thanks. ... View more

How to create an alert for disk usage?

by in Alerting
‎09-17-2022 06:11 AM
‎09-17-2022 06:11 AM
Hello!   i am sending from a host to splunk cloud logs from the disk usage. Here is an example how the events are:       /dev/nvme4n1p1 xfs 50G 555M 50G 2% 25M 33K 25M 1% /var/www         where "2%" field is called as "Use_". How can i create an alert/search when this number (without the percentage symbol) is higher than 80 ?   Thanks! ... View more
Labels

Why is sendalert not working with makeresults?

by in Splunk Search
‎08-11-2022 07:37 AM
‎08-11-2022 07:37 AM
Hello! I am trying to use makeresults + eval inside a sendalert parameters, but it doesn't return what i need. Follow the example:         index=client1 sourcetype=report_case source=splunk-hf | table action_date case_post_date action_taken arn scheme_case_number client_internal_id uuid acquirer_case_number | sendalert s3_upload param.bucket_name="bucket_name" param.file_format="csv" param.file_name=[|makeresults | eval filename=strftime(now(), "filename-PreviousDay_%Y_%m_%d_%H_%M_%S") | return $filename]           the file is created but with a default name "test_20220811.csv". What am i doing wrong in the search? Thanks ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-22-2022 03:24 PM