Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About uagraw01
uagraw01
Motivator
Member since:
06-03-2020
3 weeks ago
Community Statistics
| Posts | 563 |
| Solutions | 2 |
| Karma Given | 167 |
| Karma Received | 6 |
| Member Since | 06-03-2020 |
Activity Feed
- Posted Re: Issue with time selector on Dashboards & Visualizations. 3 weeks ago
- Posted Re: Issue with time selector on Dashboards & Visualizations. 3 weeks ago
- Posted Re: Issue with time selector on Dashboards & Visualizations. 3 weeks ago
- Posted Re: Issue with time selector on Dashboards & Visualizations. 3 weeks ago
- Karma Re: Issue with time selector for isoutamo. 3 weeks ago
- Karma Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk for livehybrid. 3 weeks ago
- Karma Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk for ITWhisperer. 3 weeks ago
- Karma Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk for PickleRick. 3 weeks ago
- Karma Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk for yuanliu. 3 weeks ago
- Posted Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk on Splunk Search. 3 weeks ago
- Posted Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk on Splunk Search. 3 weeks ago
- Posted Re: Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk on Splunk Search. 3 weeks ago
- Posted Re: Issue with time selector on Dashboards & Visualizations. 3 weeks ago
- Posted Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk on Splunk Search. 3 weeks ago
- Tagged Efficiently Expanding Multiple Multi-Value Fields Using mvexpand in Splunk on Splunk Search. 3 weeks ago
- Posted Issue with time selector on Dashboards & Visualizations. 4 weeks ago
- Karma Re: Hybrid Login with SSO and Traditional Login in Splunk (SSO + Local Auth) for livehybrid. 05-06-2025 02:36 AM
- Posted Hybrid Login with SSO and Traditional Login in Splunk (SSO + Local Auth) on Getting Data In. 05-06-2025 01:21 AM
- Karma Re: Enabling of Splunk PDF scheduler for marycordova. 05-06-2025 01:17 AM
- Posted Re: Enabling of Splunk PDF scheduler on Getting Data In. 05-04-2025 08:50 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
Hi @ITWhisperer I have already used the finalized and done brackets, but the issue still persists. Additionally, I moved the saved search to the search app location to test, but it did not resolve the problem either.
... View more
3 weeks ago
@ITWhisperer So, if I remove the depends attributes, will it start working for the users?
... View more
3 weeks ago
@ITWhisperer Below is my complete code. So do you any any possibility which is causing an issue ? What Can i fix here so it will work for all the users ? <form script="common:common.js, common:remove_elements.js, customer_reports:attrchange.js, customer_reports:kpi_dashboard.js" stylesheet="common:vanderlande.css, kpi_dashboard.css, common:project_specific.css" hideEdit="true" version="1.1">
<label>KPI Dashboard</label>
<search id="thresholds">
<query>| savedsearch report_kpi_dashboard_thresholds</query>
<finalized>
<!-- Availability -->
<eval token="availability_min_value">$result.system_dashboard_availability_min_value$-0.0001</eval>
<eval token="availability_max_value">$result.system_dashboard_availability_max_value$+0.0001</eval>
<set token="availability_max_range_threshold">$result.system_dashboard_availability_max_range_threshold$</set>
<!-- Completeness -->
<eval token="completeness_min_value">$result.system_dashboard_completeness_min_value$-0.0001</eval>
<eval token="completeness_max_value">$result.system_dashboard_completeness_max_value$+0.0001</eval>
<set token="completeness_max_range_threshold">$result.system_dashboard_completeness_max_range_threshold$</set>
<!-- Group Coherence -->
<eval token="group_coherence_min_value">$result.system_dashboard_group_coherence_min_value$-0.0001</eval>
<eval token="group_coherence_max_value">$result.system_dashboard_group_coherence_max_value$+0.0001</eval>
<set token="group_coherence_max_range_threshold">$result.system_dashboard_group_coherence_max_range_threshold$</set>
<!-- Lead Time -->
<eval token="lead_time_min_value">$result.system_dashboard_lead_time_min_value$-0.0001</eval>
<eval token="lead_time_max_value">$result.system_dashboard_lead_time_max_value$+0.0001</eval>
<set token="lead_time_max_range_threshold">$result.system_dashboard_lead_time_max_range_threshold$</set>
<!-- On-Time -->
<eval token="on-time_min_value">$result.system_dashboard_on-time_min_value$-0.0001</eval>
<eval token="on-time_max_value">$result.system_dashboard_on-time_max_value$+0.0001</eval>
<set token="on-time_max_range_threshold">$result.system_dashboard_on-time_max_range_threshold$</set>
<!-- Partitioning -->
<eval token="partitioning_min_value">$result.system_dashboard_partitioning_min_value$-0.0001</eval>
<eval token="partitioning_max_value">$result.system_dashboard_partitioning_max_value$+0.0001</eval>
<set token="partitioning_max_range_threshold">$result.system_dashboard_partitioning_max_range_threshold$</set>
<!-- Productivity -->
<eval token="productivity_min_value">$result.system_dashboard_productivity_min_value$-0.0001</eval>
<eval token="productivity_max_value">$result.system_dashboard_productivity_max_value$+0.0001</eval>
<set token="productivity_max_range_threshold">$result.system_dashboard_productivity_max_range_threshold$</set>
<!-- Throughput -->
<eval token="throughput_min_value">$result.system_dashboard_throughput_min_value$-0.0001</eval>
<eval token="throughput_max_value">$result.system_dashboard_throughput_max_value$+0.0001</eval>
<set token="throughput_max_range_threshold">$result.system_dashboard_throughput_max_range_threshold$</set>
<!-- Utilization -->
<eval token="utilization_min_value">$result.system_dashboard_utilization_min_value$-0.0001</eval>
<eval token="utilization_max_value">$result.system_dashboard_utilization_max_value$+0.0001</eval>
<set token="utilization_max_range_threshold">$result.system_dashboard_utilization_max_range_threshold$</set>
</finalized>
</search>
<search id="operational_hours">
<query>| savedsearch set_operational_hours</query>
<finalized>
<set token="operational_start_time">$result.operational_start_time$</set>
<set token="operational_end_time">$result.operational_end_time$</set>
<eval token="time.earliest_epoch">if($form.time.earliest$="",0,if(isnum($form.time.earliest$),$form.time.earliest$,relative_time(now(),$form.time.earliest$)))+($operational_start_time$*3600)</eval>
<eval token="time.latest_epoch">if(isnum($form.time.latest$),$form.time.latest$,relative_time(now(),$form.time.latest$))+($operational_start_time$*3600)</eval>
</finalized>
</search>
<fieldset autoRun="true" submitButton="false">
<input id="time" type="time" token="time" depends="$operational_start_time$, $operational_end_time$" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+($operational_start_time$*3600),relative_time(now(),'earliest')))+($operational_start_time$*3600)</eval>
<eval token="time.latest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+(86400)+($operational_start_time$*3600),relative_time(now(),'earliest')))+(86400)+($operational_start_time$*3600)</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Throughput</title>
<chart id="throughput">
<search>
<query>| savedsearch report_kpi_dashboard_throughput operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$throughput_min_value$,$throughput_max_range_threshold$,$throughput_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0x3FC77A","0xB44441"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Cases</center>
</html>
</panel>
<panel>
<title>Availability</title>
<chart id="availability">
<search>
<query>| savedsearch report_kpi_dashboard_availability operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$availability_min_value$,$availability_max_range_threshold$,$availability_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>Completeness</title>
<chart id="completeness">
<search>
<query>| savedsearch report_kpi_dashboard_completeness operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$completeness_min_value$,$completeness_max_range_threshold$,$completeness_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>On-Time</title>
<chart id="on_time">
<search>
<query>| savedsearch report_kpi_dashboard_on_time operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$on-time_min_value$,$on-time_max_range_threshold$,$on-time_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>Lead Time</title>
<chart id="lead_time">
<search>
<finalized>
<eval token="lead_time">now()</eval>
</finalized>
<query>| savedsearch report_kpi_dashboard_lead_time operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.majorUnit">1800</option>
<option name="charting.chart.rangeValues">[$lead_time_min_value$,$lead_time_max_range_threshold$,$lead_time_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0x3FC77A","0xB44441"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Duration (hh:mm)</center>
</html>
</panel>
</row>
<row>
<panel>
<title>Utilization</title>
<chart id="utilization">
<search>
<query>| savedsearch report_kpi_dashboard_lfl_utilisation operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$utilization_min_value$,$utilization_max_range_threshold$,$utilization_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>Partitioning</title>
<chart id="partitioning">
<search>
<query>| savedsearch report_kpi_dashboard_lfl_partitioning operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$partitioning_min_value$,$partitioning_max_range_threshold$,$partitioning_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>Group Coherence</title>
<chart id="group_coherence">
<search>
<query>| savedsearch report_kpi_dashboard_lfl_group_coherence operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$group_coherence_min_value$,$group_coherence_max_range_threshold$,$group_coherence_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Percentage</center>
</html>
</panel>
<panel>
<title>Productivity</title>
<chart id="productivity">
<search>
<query>| savedsearch report_kpi_dashboard_productivity operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.rangeValues">[$productivity_min_value$,$productivity_max_range_threshold$,$productivity_max_value$]</option>
<option name="charting.chart.showMinorTicks">1</option>
<option name="charting.chart.style">minimal</option>
<option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option>
<option name="refresh.display">progressbar</option>
</chart>
<html>
<center>Cases/Hour</center>
</html>
</panel>
<panel></panel>
</row>
</form>
... View more
3 weeks ago
hi @ITWhisperer Its hard for me to share complete events. FYI to you Area, zone, equipment fields are coming from the index search while other fields are coming through lookups.
... View more
3 weeks ago
@tej57 Hi Tejas thanks for the answer but I don't want chatgpt or any other AI promt answers.
... View more
3 weeks ago
Hi @gcusello | datamodel Mmm_availability adapto_shuttle_alarm flat
| lookup Alarm_list_adapto_details.csv ERROR_ID as ALARMID OUTPUTNEW DESCRIPTION Max_duration Min_duration OPERATIONAL TECHNICAL
| rename Max_duration as MAX_DURATION Min_duration as MIN_DURATION DESCRIPTION as description ID as id
| eval matchField = BLOCK."".SHUTTLEID
| lookup mordc_topo modified_field as matchField OUTPUTNEW ID "Parent Description" as Name Asas as asas Weight as Weight modified_field as isc_id
| table _time ID ALARMID description OPERATIONAL TECHNICAL Name Weight asas isc_id event_time MAX_DURATION MIN_DURATION state
| append
[ search index=mess sourcetype="EquipmentEventReport" "EquipmentEventReport.EquipmentEvent.Detail.State" IN("CAME_IN","WENT_OUT")
| spath input=_raw path=EquipmentEventReport.EquipmentEvent.ID.Location.PhysicalLocation.AreaID output=area
| spath input=_raw path=EquipmentEventReport.EquipmentEvent.ID.Location.PhysicalLocation.ZoneID output=zone
| spath input=_raw path=EquipmentEventReport.EquipmentEvent.ID.Location.PhysicalLocation.EquipmentID output=equipment
| search area=*
| dedup _raw
| lookup mordc_site_specific_scada_alarms.csv MsgNr as MsgNr OUTPUTNEW Alarmtext Functiongroup
| eval zone=if(len(zone)==1,"0".zone,zone), equipment=if(len(equipment)==1,"0".equipment,equipment)
| eval isc_id=area.".".zone.".".equipment
| fields _time, isc_id, area, zone, equipment start_time element error error_status description event_time state MsgNr Alarmtext Functiongroup alarm_severity
| fields - _raw, Alarmtext Functiongroup, MsgNr
| lookup isc id AS isc_id OUTPUTNEW statistical_subject mark_code
| eval statistical_subject = trim(statistical_subject)
| lookup Alarm_list_details_scada_mordc.csv component_type_id AS statistical_subject OUTPUTNEW operational_rate technical_rate maximum_duration minimum_duration alarm_severity
| search alarm_severity IN ("High", "Medium")
| lookup mordc_topology.csv modified_field as isc_id OUTPUTNEW ID "Description" as Name Asas as asas Weight as Weight
| rename operational_rate as OPERATIONAL technical_rate as TECHNICAL maximum_duration as MAX_DURATION minimum_duration as MIN_DURATION
| table _time ID description OPERATIONAL TECHNICAL Name Weight asas isc_id event_time MAX_DURATION MIN_DURATION state Alarmtext Functiongroup] Giving below multi value field results.
... View more
3 weeks ago
@isoutamo I am using only time selector in the dashboard and code for the time selector as mentioned below. <input id="time" type="time" token="time" depends="$operational_start_time$, $operational_end_time$" searchWhenChanged="true"> <label>Time</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+($operational_start_time$*3600),relative_time(now(),'earliest')))+($operational_start_time$*3600)</eval> <eval token="time.latest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+(86400)+($operational_start_time$*3600),relative_time(now(),'earliest')))+(86400)+($operational_start_time$*3600)</eval> </change>
... View more
3 weeks ago
Hello Splunkers !! How can I efficiently use the mvexpand command to expand multiple multi-value fields, considering its high resource consumption and expensive command? Please guide me
... View more
- Tags:
- other
Labels
- Labels:
-
other
4 weeks ago
Hello Splunkers The time selector is not visible for a specific user, whereas it is visible for the admin role. Could anyone please suggest which capability needs to be added to the user's role to make the time selector visible on the dashboard? Time selector is visible for the admin user.
... View more
Labels
- Labels:
-
Classic dashboard
05-06-2025
01:21 AM
Hi Splunkers!!, We have recently configured SSO in Splunk using Keycloak, and it's working fine — users are able to log in through the Keycloak identity provider. Now, we have a new requirement where some users should be able to bypass SSO and use the traditional Splunk login (username/password) instead. Current Setup: Splunk SSO is configured via Keycloak (SAML). All users are redirected to Keycloak for authentication. We now want to allow dual login options: Primary: SSO via Keycloak (default for most users). Secondary: Traditional login for selected users (e.g., admins, service accounts). Objective: Allow both SSO and non-SSO (Splunk local authentication) login methods to coexist. Below is our setting for SSO. [authentication] authSettings = saml authType = SAML [roleMap_SAML] commissioning_engineer = integration hlc_support_engineer = integration [saml] caCertFile = D:\Splunk\etc\auth\cacert.pem clientCert = D:\Splunk\etc\auth\server.pem entityId = splunk fqdn = https://splunk.kigen-iht-001.cnaw.k8s.kigen.com idpCertExpirationCheckInterval = 86400s idpCertExpirationWarningDays = 90 idpCertPath = idpCert.pem idpSLOUrl = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production/protocol/saml idpSSOUrl = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production/protocol/saml inboundDigestMethod = SHA1;SHA256;SHA384;SHA512 inboundSignatureAlgorithm = RSA-SHA1;RSA-SHA256;RSA-SHA384;RSA-SHA512 issuerId = https://keycloak.walamb-iht-001.cnap.k8s.kigen.com/auth/realms/production lockRoleToFullDN = true redirectPort = 443 replicateCertificates = true scimEnabled = false signAuthnRequest = true signatureAlgorithm = RSA-SHA1 signedAssertion = true sloBinding = HTTP-POST sslPassword = $7$CCkQUt0tA8sZJMmU+8kigen0zdv/mxXjJsLRbmuBkEnMfhQ== ssoBinding = HTTP-POST [userToRoleMap_SAML] kg-user = commiss_engineer;hlc_support_engineer::::
... View more
05-04-2025
08:50 PM
@marycordova Thank you for the valuable suggestion. The approach you've shared is indeed effective. However, in our current environment, implementing a user-based license model may not be feasible due to internal policy and stakeholder alignment constraints. We are exploring alternatives that align with our existing licensing agreements.
... View more
04-30-2025
12:41 AM
@gcusello @livehybrid I have removed all the inputs. But still option is not in a displaying mode.
... View more
04-29-2025
11:46 PM
Hi Splunk Community, I would appreciate your guidance regarding enabling Scheduled PDF Delivery in Splunk. Currently, the option does not appear for my Classic (Simple XML) dashboard, and I'm unsure how to enable or configure it correctly.
... View more
Labels
- Labels:
-
other
04-24-2025
01:51 AM
Hi @PickleRick , Just an update to you. We have identified and resolved an issue related to a time discrepancy in our system, which was caused by the Oracle server's timezone configuration. The server was set to local time instead of UTC, resulting in a 10-hour time difference that affected [specific process, application, or data]. To address this, we have reconfigured the Oracle server to use UTC as the standard timezone, ensuring consistency and alignment with our operational requirements. This change has eliminated the time discrepancy, and all affected processes are now functioning as expected.
... View more
04-21-2025
11:48 AM
@PickleRick A Python script is designed to establish a connection with the Oracle database, extract data from designated tables, and forward the retrieved data into Splunk for ingestion.
... View more
04-21-2025
11:29 AM
@livehybrid Both the servers are in the same timezone. As I already compared the timezone setting on Project A and B.
... View more
04-20-2025
09:56 PM
Hello Splunkers!! Issue Description We are experiencing a significant delay in data ingestion (>10 hours) for one index in Project B within our Splunk environment. Interestingly, Project A, which operates with a nearly identical configuration, does not exhibit this issue, and data ingestion occurs as expected. Steps Taken to Diagnose the Issue To identify the root cause of the delayed ingestion in Project B, the following checks were performed: Timezone Consistency: Verified that the timezone settings on the database server (source of the data) and the Splunk server are identical, ruling out timestamp misalignment. Props Configuration: Confirmed that the props.conf settings align with the event patterns, ensuring proper event parsing and processing. System Performance: Monitored CPU performance on the Splunk server and found no resource bottlenecks or excessive load. Note : Configuration Comparison: Conducted a thorough comparison of configurations between Project A and Project B, including inputs, outputs, and indexing settings, and found no apparent differences. Observations The issue is isolated to Project B, despite both projects sharing similar configurations and infrastructure. Project A processes data without delays, indicating that the Splunk environment and database connectivity are generally functional. Screenshot 1 : Screenshot 2 : Event sample : TIMESTAMP="2025-04-17T21:17:05.868000Z",SOURCE="TransportControllerManager_x.onStatusChangedTransferRequest",IDEVENT="1312670",EVENTTYPEKEY="TRFREQ_CANCELLED",INSTANCEID="210002100",OBJECTTYPE="TRANSFERREQUEST",OPERATOR="1",OPERATORID="1",TASKID="10030391534",TSULABEL="309360376000158328" props.conf [wmc_events] CHARSET=AUTO KV_MODE=AUTO SHOULD_LINEMERGE=false description= WMC events received from the Oracle database, formatted as key-value pairs pulldown_type=true TIME_PREFIX = ^TIMESTAMP= TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6NZ TZ = UTC NO_BINARY_CHECK = true TRUNCATE = 10000000 #MAX_EVENTS = 100000 ANNOTATE_PUNCT = false
... View more
Labels
- Labels:
-
indexing performance
03-27-2025
04:35 AM
@PickleRick I have executed the command but nothing is visible relevant to my required starnza. FYI to you my current inputs setting. [monitor://E:\var\log\Bapto\BaptoEventsLog\SZC\000000000*-*-SZC.VIT.BaptoEvents.*] whitelist = \.csv$ disabled = false index = Bapto initCrcLength = 256 sourcetype = SZC_BaptoEvent props.conf: [SZC_BaptoEvent] SHOULD_LINEMERGE = false #CHARSET = ISO-8859-1 TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD = 23 TRANSFORMS-drop_header = remove_csv_header TZ = UTC transforms.conf [remove_csv_header] REGEX = ^Timestamp;AlarmId;SenderType;SenderId;Severity;CreationTime;ComplexEventType;ExtraInfo DEST_KEY = queue FORMAT = nullQueue Sample of csv files to be monitor: Timestamp;AlarmId;SenderType;SenderId;Severity;CreationTime;ComplexEventType;ExtraInfo 2025-03-27 12:40:12.152;1526;Mpg;Shuttle_115;Information;2025-03-27 12:40:12.152;TetrisPlanningDelay;TetrisId: TetrisReservation_16_260544_bqixLeVr,ShuttleId: Shuttle_115,FirstDelaySection: A24.16,FirstSection: A8.16,LastSection: A24.16 2025-03-27 12:40:12.152;1526;Mpg;Shuttle_115;Unknown;2025-03-27 12:40:12.152;TetrisPlanningDelay; 2025-03-27 12:40:14.074;0;Shuttle;Shuttle_027;Unknown;2025-03-27 12:40:14.074;NoError; 2025-03-27 12:40:16.056;0;Shuttle;Shuttle_051;Unknown;2025-03-27 12:40:16.056;NoError; 2025-03-27 12:40:30.076;0;Shuttle;Shuttle_119;Unknown;2025-03-27 12:40:30.076;NoError;
... View more
03-27-2025
03:31 AM
Hi @vsommer I have tried your suggested one but still no luck found. [monitor://E:\var\log\Bapto\BaptoEventsLog\SZC\]
whitelist = \.csv$
... View more
03-27-2025
02:34 AM
Dear Splunkers!! I am facing an issue with Splunk file monitoring configuration. When I define the complete absolute path in the inputs.conf file, Splunk successfully monitors the files. Below are two examples of working stanza configurations: Working Configurations: [monitor://E:\var\log\Bapto\BaptoEventsLog\SZC\0000000002783979-2025-03-27T07-39-33-128Z-SZC.VIT.BaptoEvents.50301.csv] [monitor://E:\var\log\Bapto\BaptoEventsLog\SZC\0000000002783446-2025-03-27T05-09-20-566Z-SZC.VIT.BaptoEvents.50296.csv] However, since more than 200 files are generated, specifying absolute paths for each file is not feasible. To automate this, I attempted to use a wildcard pattern in the stanza, as shown below: Non-Working Configuration: [monitor://E:\var\log\Bapto\BaptoEventsLog\SZC\*.csv] Unfortunately, this approach does not ingest any files into Splunk. I would appreciate your guidance on resolving this issue. Looking forward to your insights.
... View more
Labels
- Labels:
-
monitor
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
