About power12

power12 · ‎03-21-2024

Is there way to change the permissions of all lookups in a app

power12 · ‎03-13-2024

Can we ingest these logs?

power12 · ‎03-12-2024

I have .gz syslog files but I am unable to fetch all files For each host(abc) it has 23 .tgz files with extension like syslog.log1.gz until syslog.log.24.gz ...I only see the one with 24 ingested but not others ..for all others in internal logs I see "was already indexed as a non-archive, skipping" Log path /ad/logs/abc/syslog/syslog.log.24.gz Internal logs : 03-12-2024 14:59:59.590 -0700 INFO ArchiveProcessor [1944346 archivereader] - Archive with path="/ad/logs/abc/syslog/syslog.log.2.gz" was already indexed as a non-archive, skipping. 03-12-2024 14:59:59.590 -0700 INFO ArchiveProcessor [1944346 archivereader] - Finished processing file '/ad/logs/abc/syslog/syslog.log.2.gz', removing from stats> Should I try crcsalt or crclength ?

power12 · ‎03-12-2024

I have single instance splunk environment where the license is 100 gb there is another single instance using the same license .and we get data every day around 6 GB both combined . Instance A is very fast but instance B is very slow .(both have same resources) All searches and dashboards are really slow .For instance if I run a search to do a simple stats for 24 hrs ..it takes 25 seconds when compared to the other one which takes 2 seconds .I checked the job inspection which was showing dispatch.evaluate.search = 12.84 dispatch.fetch.rcp.phase_0 =7.78 I want to know where should I start checking on the host and what are the steps to be taken

power12 · ‎03-08-2024

@bowesmana that worked thank you

power12 · ‎03-04-2024

I have a query where I am counting the PASS and fail and displaying it as a pie-chart.Also I modified the search so that it displays the count and status .When the status field which has pass and fail values the pie chart displays green for pass and red for fail as expected but when there is only pass it displays red not green Attached is the screenshot <chart> <search> <query>index="abc" | rex field=source "ame\/(?<Type>[^\/]+)" |search Type=$tok_type$ | rex field=_raw "(?i)^[^ ]* (?P<status>.+)" | stats latest(status) as status by host | stats count by status | eval chart = count + " " + status | fields chart, count</query> <earliest>$tok_time.earliest$</earliest> <latest>$tok_time.latest$</latest> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> <option name="charting.legend.labels">[FAIL,PASS]</option> <option name="charting.seriesColors">[#BA0F30,#116530]</option> <option name="refresh.display">progressbar</option> <option name="charting.chart.showPercent">true</option> </chart> Thanks in Advance

power12 · ‎02-28-2024

Thank You @victor_menezes .I tried below and it worked . | eval _time = strptime(replace(source, ".*(\d\d\d\d-\d\d-\d\d\_\d\d-\d\d-\d\d).*","\1"),"%Y-%m-%d_%H-%M-%S")

power12 · ‎02-27-2024

I have the following source .I want to extract time from source when data is ingesting source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log" in props TRANSFORMS-set_time =source_path_time In transforms [set_time_from_file_path] INGEST_EVAL = | eval _time = strptime(replace(source, ".*/ute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S") I tried testing it but I am unable to get the _time | makeresults | eval source="/logs/gs/ute-2024-02-05a/2024-02-05_16-17-54/abc.log" | fields - _time ``` above set test data ``` | eval _time = strptime(replace(source, ".*/compute-(\\d{4}-\\d{2}-\\d{2}[a-z])/([^/]+/[^/]+).*","\1"),"%y-%m-%d_%H-%M-%S") Thanks in Advance

power12 · ‎02-23-2024

I have the following sample events coming from source="/project/admin/git/ys/es/perf/de/pure/abc0*/logs/*/results.csv" Event1: with no timestamp and these type of data is in files which are 2 days older abc|pxyz|0.1054|ops|0|null|null Event 2 with timestamp --these are new files from same location and going forward the data would be the same as below 2024-02-23T00:48:17|AID|read|454482.351348|PS|0|null|null I want to send data to splunk that has a timestamp and send the other to null queue or not to ingest it . Firstly I tried MAX_DAYS_AGO=2 which did not work then I tried the following props and transforms but it did not work . transforms [filter] REGEX = ^^\D* DEST_KEY = queue FORMAT = nullQueue props.conf CHARSET=AUTO SHOULD_LINEMERGE=false category=Custom disabled=false pulldown_type=true TRANSFORMS-null=filter Thanks in Advance

power12 · ‎08-03-2023

This worked. <html> <style> #myTable th:first-child,td:first-child { left:0; z-index: 9999; position: sticky; } #myTable th:nth-child(2), td:nth-child(2){ left: 110px !important; position: sticky; z-index: 9998; } </style> </html>

power12 · ‎08-03-2023

@ITWhisperer I tried the code but while scrolling I see only second column moving to right while scrolling to right

power12 · ‎08-02-2023

I am trying to make first two columns of a table output to be sticky...I can do one by using <html> <style> #myTable th:first-child,td:first-child { left:0; z-index: 9999; position: sticky; } The above code works for one column on the left..But I want two to be sticky

power12 · ‎08-02-2023

Does anyone have any idea on how to do it?

power12 · ‎07-28-2023

Hello Splunkers , I have created a script and places in <splunk_home>/etc/apps/search/bin/seq.py Below is the script for it import splunklib.client as client # Splunk connection details HOST = "localhost" PORT = 8089 USERNAME = "admin" PASSWORD = "changeme" # Create a Splunk service instance service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD ) # List of specific saved searches to run in sequence saved_searches_to_run = ['List of Indexes', 'List of Source Types', 'List of Sources'] # Function to run a saved search def run_saved_search(saved_search_name): saved_search = service.saved_searches[saved_search_name] job = saved_search.dispatch() while not job.is_done(): pass # Wait for the job to complete # Process the search results here results = job.results() # Print the raw search results print(f"Search results for {saved_search_name}:") for result in results: print(result) print() # Run the specific saved searches in sequence for saved_search_name in saved_searches_to_run: print("Running saved search:", saved_search_name) run_saved_search(saved_search_name) print("Completed saved search:", saved_search_name) print() I places the command <splunk_home>/etc/apps/search/local/commands.conf [seq] filename=seq.py But when I ran the command in splunk as |seq It returns error code External search command 'seq' returned error code 1. . This sample code works correctly with |test import sys import splunk.Intersplunk # Read parameters name_prefix = sys.argv[1] # Output data should be a list of dictionary like this data = [{'name': 'xyz', 'age': 23}, {'name': 'abc', 'age': 24}] # Corrected the syntax for record in data: record['name'] = name_prefix + record['name'] # Use the `outputResults` function from `splunk.Intersplunk` to send the data back to Splunk splunk.Intersplunk.outputResults(data) Should splunk SDK be installed? This is a single instance splunk

power12 · ‎06-29-2023

Ya even tried that but somehow it says "could not use regex to parse timestamp from source::source::C:\Users\vv\OneDrive-xx\Pictures\svc-logs\hostabc\mods\stdou."

power12 · ‎06-29-2023

I can try that but I am testing on my windows local splunk installed trying to do the same from C:\Users\vv\OneDrive-xx\Pictures\svc-logs\hostabc\mods\stdout.230629-081216.txt for this I changed it to [set_time_from_source_path] INGEST_EVAL = _time = strptime(replace(source, ".*\\stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") This also did not work. I am assuming something with "20\1"..how do we change that..Can you please let me know what should be changed for this case

power12 · ‎06-29-2023

In the regex its looking for .*/stdout so even if its _ or . ..it matches everything until stdout right INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S")

power12 · ‎06-29-2023

Yes...I did restart splunk after applying that...I tried mimicking the same on my local. I went to my local (C:\Program Files\Splunk\etc\apps\search\local) where I set the transforms to be [set_time_from_source_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") and in the props. [sourcetime] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom disabled = false pulldown_type = true TRANSFORMS-set_time = set_time_from_source_path Restarted> Then from WEB UI--->ADD DATA -->SELECTED FILE (_svc-logs_hostbac_mods_stdout.230629-053900) -->selected sourcetype (sourcetime) to see the preview I get errors(attached) that its failed to parse time

power12 · ‎06-29-2023

I tried this as well [< sourcetype name>] TRANSFORMS-set_time = set_time_from_file_path Added below in transforms.conf [set_time_from_file_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S") Should we have the "set_time" extension after the TRANSFORMS

power12 · ‎06-28-2023

@isoutamo I Added below conf...but somehow the data still did not take the source path time.Is there other steps I need to add props.conf [< sourcetype name>] TRANSFORMS-set_time = set_time_from_source_path Added below in transforms.conf [set_time_from_file_path] INGEST_EVAL = _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%Y%m%d-%H%M%S")

power12 · ‎06-27-2023

Thank you it worked

power12 · ‎06-27-2023

I get the below | makeresults | eval source="/svc-logs/hostabc/mods/stdout.230626-203719" ``` above set test data ``` | eval _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%y%m%d-%H%M%S")

power12 · ‎06-27-2023

@isoutamo This is what I used and I dont see _time field | makeresults | eval source="/svc-logs/hostabc/mods/stdout.230626-203719" | fields - _time ``` above set test data ``` | eval _time = strptime(replace(source, ".*/stdout.(\d{6}-\d{6}).*","20\1"),"%y%m%d-%H%M%S")

power12 · ‎06-27-2023

@isoutamo Thank you so much for you reply. I tried the below but I am not sure what mistake I am doing | makeresults | eval source="/logs/abc*/mods/stdout.230626-203719" | fields - _time ``` above set test data ``` | eval _time = strptime(replace(source, ".*\/stdout.(\d{6}\-\d{6}).*","\1") + tostring(random() % 86400,"duration"),"%Y%m%d%H:%M:%S")

power12 · ‎06-27-2023

I have the following source path which I am monitoring..I want splunk to use the _time from the source file. /svc-logs/host*/ads/stdout.230621-125941 Thanks in Advance

Posts	84
Solutions	2
Karma Given	9
Karma Received	2
Member Since	‎10-11-2021

Online Status	Offline
Date Last Visited	‎03-21-2024 03:12 PM

change bulk permissions of lookup in a app

Cant ingest .gz syslog files - was already indexed...

Searches taking long time to show results

Pie chart colors not changing when only one value

Use source path time when ingesting data

Send events to null queue which dont have time

How to make first two columns and header of those ...

How run python script as command?

How to make the _time from the source path?

How to highlight the cell if its above or below ...

change bulk permissions of lookup in a app

Re: Cant ingest .gz syslog files - was already ind...

Cant ingest .gz syslog files - was already indexed...

Searches taking long time to show results

Re: Pie chart colors not changing when only one va...

Pie chart colors not changing when only one value

Re: Use source path time when ingesting data

Use source path time when ingesting data

Send events to null queue which dont have time

Re: How to make first two columns and header of th...

Re: How to make first two columns and header of th...

How to make first two columns and header of those ...

Re: How run python script as command?

How run python script as command?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

Re: How to make the _time from the source path?

How to make the _time from the source path?