About ryoji_solsys

ryoji_solsys · ‎05-02-2017

Splunk doesn't seem to have a supported option to export data as LEEF. Could anyone please suggest any customized way to export data as LEEF ? Thanks, R

ryoji_solsys · ‎09-01-2016

If you want all the events to be in one transaction, just add | transaction fields=TID at the end of the query above. E.g. index=my_server sourcetype=server1_log [ | search index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client" | fields TID] | transaction fields=TID

ryoji_solsys · ‎09-01-2016

Would you like to try this ... index=my_server sourcetype=server1_log [ | search index=my_server sourcetype=server1_log NOT "status=SUCCESS" "client_id=my_client" | fields TID]

ryoji_solsys · ‎10-13-2015

Hi there, Would someone tell me if I can disable atime update for logs monitored by a universal forwarder? Even though atime is not being updated, can the forwarder correctly monitor and splunk the logs? Thanks

ryoji_solsys · ‎09-15-2015

I am using Splunk 6.2.6 and have 3 search heads and 4 peers. I installed SoS and Splunk App for Unix and Linux. Every instance reports the following two error messages frequently in the splunkd.log. - ERROR AdminManagerDispatch - Admin handler 'resource-usage' not found. - ERROR AdminManagerDispatch - Admin handler 'limits' not found. Does anyone know what these error messages mean and how I can get rid of them ? Thanks

ryoji_solsys · ‎03-09-2015

Hi, My code looks something like this. // Retrieve the new saved search SavedSearch savedSearch = splunk.getSavedSearches().get("SERVICE_CREATED"); // Run a saved search Job jobSavedSearch = null; // Run the saved search try { jobSavedSearch = savedSearch.dispatch(); } catch (InterruptedException e1) { e1.printStackTrace(); } // Wait for the job to finish while (!jobSavedSearch.isDone()) { try { Thread.sleep(500); } catch (InterruptedException e) { // TODO Auto-generated catch block e.printStackTrace(); } } The problem I am having is that SOMETIMES "jobSavedSearch.isDone()" never being set to true. So it goes into an infinite loop. I checked the job management on Splunk Web UI and it shows that the status of all the jobs executed are Done. The saved search is located at a remote instance and I am executing this from my local machine. Does anyone have a similar issue ? Is there anything I can do to avoid going into an infinite loop ? Thanks

ryoji_solsys · ‎12-04-2014

Thanks for the prompt answer. This helped me to extract multiple fields. But can I also somehow append "req" to each field automatically ?

ryoji_solsys · ‎12-04-2014

I would like to extract fields in the response field dynamically by using "<_KEY_1" "<_VAL_1>" in transforms.conf response = "customer:{tel:123456} startpoint:{http://www.splunk.com} interfaceNumber:{1234} name:{abc}" Ideally I want to generate fields as response-customer-tel = 123456 response-startpoint = http://www.splunk.com response-interfacenumber = 1234 response-name = abc I have the following regex. response=.+ (?<_KEY_1>\w+)\:\{(?<_VAL_1>.+)\} I only get the last field "name" = "abc" extracted. What is the best way to extract multi-fields dynamically by using KEY and VAL. (I don't know how many entries the response field has since each event can have a different number of entries in the response field). I would also like to extract fields in a way that append "response" to each field so that it says response-name, response-interfacenumber and so on... I learned that I can use "FIELDALIAS" to modify the field names from the previous question but is there anyway I can append "request" to the extracted fields automatically ? Thanks.

ryoji_solsys · ‎12-04-2014

Hi richgalloway and somesoni2, Thanks for the quick reply. "FIELDALIAS" works for me. I tried using wildcard as somesoni2 suggested but it's not working for me. I wonder if "FIELDALIAS" doesn't support wildcard.

ryoji_solsys · ‎12-04-2014

Is there anyway I can modify a field name at search time ? I have a field "client__phone" (with double underscores) which is dynamically generated based on my regex in transforms.conf as shown below at search time. [req_transform] CLEAN_KEYS = 1 REGEX = request\=\"(?<_KEY_1>\w+.+\w+)\:(?<_VAL_1>\w+|\d+)\}\s MV_ADD = 1 And a sample data is ...request="client:{phone:1234456} receiver:{23404} accesspoint:{Notifier} endpoint:{343} " opn="..... I would like to append "req" in front of the field and remove an underscore so that it becomes something like "req_client_phone". I would like to modify the field automatically by editing transforms.conf and props.conf. I know that I can modify the field with "rename" command but I want to do this "automatically". Thanks.

ryoji_solsys · ‎08-21-2014

I confirmed that the path to indexes is correctly configured as "/opt/splunk/var/lib/splunkdb" which is the new mount point and new data is indexed there. The problem is that I cannot figure out why splunk keeps generating .dat files and persistentstorage in the old directory (splunk)although SPLUNK_DB is now pointing to the new directory(splunkdb).

ryoji_solsys · ‎08-21-2014

I would like to move the entire index database from "/opt/splunk/var/lib/splunk" to "/opt/splunk/var/lib/splunkdb" which is a new mount point. I followed the direction from the documentation except I used rsync instead of cp. It seems that everything works except when I remove the "/opt/splunk/var/lib/splunk" directory (the old index database), and restart splunk, it will add the "/opt/splunk/var/lib/splunk" directory back again. And that directory ("/opt/splunk/var/lib/splunk") contains .dat files and persistentstorage. I would like to permanently remove the directory and only use the new mount point, "/opt/splunk/var/lib/splunkdb". Would anyone please help me why splunk keeps adding the old directory back again, and what I can do to prevent this to happen again so that I can only use the new mount point. Thanks

Posts	12
Solutions	1
Karma Given	11
Karma Received	4
Member Since	‎08-06-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How can I export search results as LEEF (Log Event...

Does atime (file access time) need to be up-to-dat...

Why are all Splunk instances reporting "ERROR Admi...

Splunk Java API : Why a job object (savedSearch.di...

Extract Multiple Fields with Regex

Is there anyway to modify a field name automatical...

How to move the index database and remove the old ...

How can I export search results as LEEF (Log Event...

Re: How do I search for the Errored Transaction_ID...