About salles

salles · ‎09-29-2021

Hi, I tried to search for this online and I am probably not typing my search correctly :-), and am hoping one of you Splunk experts could possibly help me or point me in the right direction. I have a full Splunk heavy forwarder that is monitoring some network folders (and sending them to some indexes using the outputs.conf configuration). This server is going to be retired, and I am moving this to a new Splunk server installation. My question is, where does Splunk store the information about the last file it has read ? I am looking to recreate the Directory Monitor input ont he new server, however, I am assuming that on the new server, it would start reading the folder from scratch again. I am hoping to stop the old serve's input and start the new server but have the new server read from where the old server left off. Any help would be appreciated. Thanks so much! Oh also this is on Microsoft Windows.

salles · ‎09-05-2019

panguy, Thanks so much I can see it in the "Browse More apps" page now! Thanks again!

salles · ‎09-05-2019

Hi, I am currently trying to install the Splunk for Palo Alto Networks app on a Splunk 7.3.1 SH cluster, and when I try to find this app on Splunk Base from one of the Search Heads, I am not able to actually find it. If I search for it on a 7.2 SH, I do find it (available for install). Is this because the app is not yet currently supported on Splunk 7.3 ? I do understand that the recomendation is to use a deployer on SH clusters, but I was just trying to see if I can find it using the regular Splunk browser using "Find More Apps" on one of the search heads. Thanks so much for you answers 🙂

salles · ‎06-21-2019

Hi rslama, This works perfectly! Thank you so much for the help. You guys are awesome!!!

salles · ‎06-20-2019

Hi, I have a log file that has a field called "TimeTaken". The values of this field are in the format: 00:01:27.763 00:02:10.15 00:01:36.175 00:00:48.368 00:00:22.692 etc.. This signifies how long this operation took in HH:MM;SS;ms format (per each log line). I am trying to figure out a way to do calculations on this field, for example, get an Average "timetaken" or how many events took longer than 00:12:00:00 (12 minutes) etc. Is there any way this can be done using a clever Splunk search? Any help would be much appreciated.

salles · ‎03-26-2019

Thanks so much, this saved me a bunch of time!

salles · ‎08-22-2018

Thank you SO MUCH! This helped and your answer saved me so much time not having to open a support case. Weirdly though, my iis logs were not custom but changing the source type to iis_2 and creating a custom extraction worked.

salles · ‎05-05-2014

Guys, I'm trying to index some Syslog data from some F5's. The issue I have is, Splunk seems to recognize and break log lines correctly, a majority of the time, but, sometimes, lumps more than a single event into one event. There is not difference in the log lines. Here's an example: 2014-05-05 14:53:19 Local6.Info 10.0.2.64 May 5 14:53:19 DR0-f5-02 info logger: [ssl_acc] 127.0.0.1 - - [05/May/2014:14:53:19 -0600] "/iControl/iControlPortal.cgi" 200 795 2014-05-05 14:53:19 Local6.Info 10.0.2.64 May 5 14:53:19 DR0-f5-02 info logger: [ssl_acc] 127.0.0.1 - - [05/May/2014:14:53:19 -0600] "/iControl/iControlPortal.cgi" 200 950 The above 2 lines were correctly detected as two separate events. However, all 7 lines below were detected as ONE event. They shouldn't because the time stamp is pretty clear on each log event. 2014-05-05 14:53:19 Local6.Info 10.0.2.64 May 5 14:53:19 DR0-f5-02 info logger: [ssl_req][05/May/2014:14:53:19 -0600] 127.0.0.1 TLSv1 AES256-SHA "/iControl/iControlPortal.cgi" 950 2014-05-05 14:53:19 Local0.Notice 10.0.2.64 May 5 14:53:19 DR0-f5-02 notice bigd[7342]: 01060001:5: Service detected UP for ::ffff:10.0.36.23%149:443 monitor /Common/xxxx 2014-05-05 14:53:19 Local0.Notice 10.0.2.64 May 5 14:53:19 DR0-f5-02 notice mcpd[7130]: 01070727:5: Pool /Common/--test-- member /Common/dddd:0 monitor status up. [ /Common/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx_HTTPS: up ] [ was down for 0hr:0min:6sec ] 2014-05-05 14:53:19 Local0.Error 10.0.2.64 May 5 14:53:19 DR0-f5-02 err tmm1[10172]: 01010221:3: Pool /Common/--test-- now has available members 2014-05-05 14:53:19 Local0.Error 10.0.2.64 May 5 14:53:19 DR0-f5-02 err tmm[10172]: 01010221:3: Pool /Common/--test-- now has available members 2014-05-05 14:53:19 Local0.Error 10.0.2.64 May 5 14:53:19 DR0-f5-02 err tmm2[10172]: 01010221:3: Pool /Common/--test-- now has available members 2014-05-05 14:53:19 Local0.Error 10.0.2.64 May 5 14:53:19 DR0-f5-02 err tmm3[10172]: 01010221:3: Pool /Common/--test-- now has available members Could you guys give me any ideas for what would be going on, why does the 2 lines above get parsed correctly and not the following ones ? Thank you guys, any help would be appreciated.

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-18-2011

Online Status	Offline
Date Last Visited	‎10-01-2021 11:20 AM

Migrating a folder monitor to a new Splunk server

Palo Alto Ntworks App support on 7.3

Search average for time-taken field

Help with line breaking

Migrating a folder monitor to a new Splunk server

Re: Palo Alto Ntworks App support on 7.3

Palo Alto Ntworks App support on 7.3

Re: Search average for time-taken field

Search average for time-taken field

Re: Why is Microsoft Office 365 O365 Add-On Data c...

Re: ERROR TailReader - Ran out of data while looki...

Help with line breaking