About tmuthuk

tmuthuk · ‎10-28-2019

Try this : |rex "Instrument=\"(?[^\"]+)\""

tmuthuk · ‎11-29-2018

tmuthuk · ‎10-30-2015

We currently have 4 servers that send data to the Splunk indexer. Each server is located in different time zone, Our indexer is in CST timezone. We want to index the data in CST time. Is there anyway it can be before indexing the data.

tmuthuk · ‎06-19-2015

Splunk DB Connected stoped scheduling queries. I have spotted this error in dbx_debug log: Scheduler - Scheduler thread has been interrupted Can anyone me in solving this issue ?

tmuthuk · ‎12-22-2014

Hi mbenwell, Thanks a lot for your suggestion. The data looks clean , when run the query from query view. I also tried changing the line breaking parameter SHOULD_LINEMERGE should be true . But it is still not indexing properly.

tmuthuk · ‎12-19-2014

I am extracting data using db connect from one of our tables. The issue is one of the fields has XML data and the data is not getting indexed properly and the value for the field is breaking into multiple and indexed as multiple events. The query which i run: select APPLICATIONID, EXCEPTIONID, EXCEPTIONCODE, COMPONENTNAME, HOSTNAME, TRANSACTIONDOMAIN, TRANSACTIONID, TRANSACTIONTYPE, FILENAME, INTERFACEID, TO_CHAR(TIME_STAMP,'YYYY-MM-DD HH24:MI:SS') "TIME_STAMP", MESSAGE, TRANSACTIONDATA, TRANSACTIONDATAAFTER, NOTIFICATIONCHNL, REPLYDESTINATION, STACKTRACE, STATUS, RESOLUTIONDESCRIPTION, DATAENCODING, CORRELATIONID, RENDERID, TO_CHAR(RESOLVEDELAYTIME,'YYYY-MM-DD HH24:MI:SS') "RESOLVEDELAYTIME", EVENTTYPE, JMSPROPERTIES, CUSTOM from cle_up.exceptionrec Expected data in index : 2014-12-19 14:39:40 applicationid=Product_MDM_DExtract exceptionid=4608670 exceptioncode=SYS-CIM-001 componentname=ProductMDMExternalFeeder-ProductMDMExternalFeederProcessArchive hostname=plm00385.kohls.com transactiondomain= transactionid=000784672453882-164783-US transactiontype= filename= interfaceid= message="Error in response from CIM" transactiondata="10.5.80.46Member8STATE_CHANGE22014-12-19 14:39:34.116141902157411611580129729372tkcdh0634484UPC_VENDOR_COUNTRY000784672453882164783-US109322645CONFIRMEDY" transactiondataafter= notificationchnl= replydestination=UP.MDM.DAILYDELTA.FEEDER.RECEIVE.V1 stacktrace="Job-4976630 Error in [BusinessProcesses/Processes/CIMWSCall.process/Retrieve the data from cim] at com.tibco.plugin.soap.SOAPSendReceiveActivity.postEval(Unknown Source) at com.tibco.pe.core.TaskImpl.eval(Unknown Source) at com.tibco.pe.core.Job.a(Unknown Source) at com.tibco.pe.core.Job.k(Unknown Source) at com.tibco.pe.core.JobDispatcher$JobCourier.a(Unknown Source) at com.tibco.pe.core.JobDispatcher$JobCourier.run(Unknown Source) This is the response from CIM: " status=Notified resolutiondescription= dataencoding= correlationid= renderid= resolvedelaytime="2014-12-19 14:40:04" eventtype= jmsproperties= custom= Actual indexed data : 12/19/14 2:39:40.000 PM 2014-12-19 14:39:40 applicationid=Product_MDM_DExtract exceptionid=4608670 exceptioncode=SYS-CIM-001 componentname=ProductMDMExternalFeeder-ProductMDMExternalFeederProcessArchive hostname=plm00385.kohls.com transactiondomain= transactionid=000784672453882-164783-US transactiontype= filename= interfaceid= message="Error in response from CIM" transactiondata=" 12/19/14 2:39:40.000 PM ns:RecordNotificationEventns:IPAddress10.5.80.46/ns:IPAddressns:NodeIDMember8/ns:NodeIDns:ActionSTATE_CHANGE/ns:Actionns:Version2/ns:Versionns:ActionDate2014-12-19 14:39:34.116/ns:ActionDatens:ActionDateLong1419021574116/ns:ActionDateLongns:UserID115801/ns:UserIDns:EventID29729372/ns:EventIDns:UserNametkcdh06/ns:UserNamens:RepositoryID34484/ns:RepositoryIDns:RepositoryNameUPC_VENDOR_COUNTRY/ns:RepositoryNamens:RecordID000784672453882/ns:RecordIDns:RecordIDExt164783-US/ns:RecordIDExtns:RecordKey109322645/ns:RecordKeyns:StateCONFIRMED/ns:Statens:IsActiveY/ns:IsActive/ns:RecordNotificationEvent/ns:NotificationEvent" transactiondataafter= notificationchnl= replydestination=UP.MDM.DAILYDELTA.FEEDER.RECEIVE.V1 stacktrace="Job-4976630 Error in [BusinessProcesses/Processes/CIMWSCall.process/Retrieve the data from cim] 12/19/14 2:39:40.000 PM at com.tibco.plugin.soap.SOAPSendReceiveActivity.postEval(Unknown Source) 12/19/14 2:39:40.000 PM at com.tibco.pe.core.TaskImpl.eval(Unknown Source) 12/19/14 2:39:40.000 PM at com.tibco.pe.core.Job.a(Unknown Source) 12/19/14 2:39:40.000 PM at com.tibco.pe.core.Job.k(Unknown Source) 12/19/14 2:39:40.000 PM at com.tibco.pe.core.JobDispatcher$JobCourier.a(Unknown Source) 12/19/14 2:39:40.000 PM at com.tibco.pe.core.JobDispatcher$JobCourier.run(Unknown Source) 12/19/14 2:39:40.000 PM This is the response from CIM: " status=Notified resolutiondescription= dataencoding= correlationid= renderid= resolvedelaytime="2014-12-19 14:40:04" eventtype= jmsproperties= custom= transactiondata field is getting split into multiple events. Is there any way i can index the XML data with out breaking into multiple events?

tmuthuk · ‎11-29-2013

Thanks for your reply.

tmuthuk · ‎11-29-2013

Thanks for your Reply . Could you please explain me how could we set the maximum time range ?

tmuthuk · ‎11-29-2013

Is there anyway to restrict the max no of events to be searched in an index irrespective of the time chosen the time picker ? Example : i have 100000 events in a index. But i want the queries executed by users to search only latest 50000 records , irrespective the of the time chosen by the user

tmuthuk · ‎06-11-2013

You cannot change the source type once the data has been indexed

tmuthuk · ‎06-11-2013

Need help in parsing the below data : 000008360.46880570[4940] +++< 15:32:12.832 0h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008370.46880570[4940] Source: Routine CReprintServer::initialize(), SubRoutine:<none>, Line:150 000008380.46880570[4940] 000008390.47006419[4940] +++T 15:32:12.832 102h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008400.47006419[4940] Source: Routine MANH_Print_Service::PRINT_TEST::GetLabelSubsForCarton, SubRoutine:<none>, Line:0 000008410.47006419[4940] Substitution Value [0]: In Catch Block prior call to get substitution m_xmlSession :<session id="NOCORBA"><user>TKMAX93UI</user><role></role><warehouse id="1">873</warehouse><company id="1">01</company><division id="1">01</division><requestor>806_IS01</requestor><menuid>2190</menuid><customerid></customerid><corbalogin>IOR:012020201300000049444c3a506b4c6f67696e5f49463a312e300020010000000000000068000000010102200c00000031302e322e34312e31303500c6eb20201c00000000564201000000022f002020000000033362642051b64c57000cf81c020000000353495605000000010407010320202001000000140000000120202001000100000000000901010000000000</corbalogin><language>ENG</language><browsertype></browsertype><debuglevel></debuglevel><ipaddress></ipaddress><requestid></requestid><pagesize>200</pagesize><dbtype></dbtype><datemask>MM/DD/YY</datemask><timemask>HH:MM</timemask><whse_tz>US/Eastern</whse_tz><user_tz>Warehouse</user_tz><errors/><three_pl enterprise="N" loginsvr3pl="N"><default_co_div id="1" co="01" div="01" skumask=" | | |AAAAAAAA| | | | | "/><eligible_co_div><eligible id="1" co="01" div="01" skumask=" | | |AAAAAAAA| | | | | "/></eligible_co_div></three_pl><print_source>PkMSLaunch</print_source><info><system><logrecords><logrecord index="0"><id>{FE77421B-D2D5-11E2-9470-00505687047E}</id><whenoccurred>2013/06/11 15:32:12.472</whenoccurred><routinename>PkMSError::Error()</routinename><subroutinename>CReprintServer::getShippingLabelSubs()</subroutinename><linenumber>207</linenumber><primaryrc>16908321</primaryrc><severity>64</severity><secondaryrc>0</secondaryrc><secondaryowner>0</secondaryowner><flags>4097</flags><threadid>5196</threadid><procesid>4940</procesid><machineid>KSMS1453</machineid><com><activityid/><contextid/><transactionid/></com><substitutionvalues><substitutionvalue index="0">26002</substitutionvalue><substitutionvalue index="1"></substitutionvalue><substitutionvalue index="2">CReprintServer::getShippingLabelSubs()</substitutionvalue><substitutionvalue index="3"></substitutionvalue><substitutionvalue index="4">ReprintServer has not been initialized!</substitutionvalue><substitutionvalue index="5">0</substitutionvalue></substitutionvalues><text><raw><normal/><short/><long/></raw><expanded><normal/><short/><long/></expanded></text></logrecord></logrecords></system></info></session> 000008420.47006419[4940] 000008430.47006419[4940] 000008440.47118703[4940] +++> 15:32:12.832 0h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008450.47118703[4940] Source: Routine CReprintServer::getShippingLabelSubs(), SubRoutine:<none>, Line:1495 000008460.47118703[4940] Substitution Value [0]: cartonNbr = 00000999990537100272 000008470.47118703[4940] Substitution Value [1]: labelType = FXG 000008480.47118703[4940] I need to break it when ever i find 00000836 0.46880570 [4940] +++< Props.conf , i used is BREAK_ONLY_BEFORE =\w*\s*\w\W\w*\s*[\w*]\s*\W{3} SHOULD_LINEMERGE = true But it is not breaking it properly . Please help me parse this data

tmuthuk · ‎05-14-2013

Can we mask sensitive information in search time ?

tmuthuk · ‎05-13-2013

There is log which we have n index has sensitive information like Date of birth /SSN /Credit card I want to mask the sensitive information at execution time . Here is the sample log ................... ns6:Date_Time2013-05-13T01:00:09/ns6:Date_Time ns6:UpdateSourceLY/ns6:UpdateSource ns7:Person ns7:FirstNameTest/ns7:FirstName ns7:LastNameuser/ns7:LastName ns7:DateOfBirth1984-03-03/ns7:DateOfBirth ...................... I want to mask the data of birth as below ns7:DateOfBirthXXXX-XX-XX/ns7:DateOfBirth The transforms.conf i used is REGEX = (?m)^(.):DateOfBirth>\d{4}-d{2}-d{2}(.)$ FORMAT = $1:DateOfBirth>####-##-##$2 DEST_KEY = _raw But it is not working . Can anyone please help on this ?

tmuthuk · ‎03-28-2013

The PGP" field will change. I will get different values for the different events My exact requirement is to find the attribute ID . which is' B ' in the event. I have to name is as attribute_id (field name ) . I tried your answer . But getting an error message " Unbalanced quotes . I am new to splunk. It would be very helpful if you share me any tutorials on splunk

tmuthuk · ‎03-28-2013

Need a help on reg ex . My event will look like this B/ns7:Attribute I want to get the value B as my answer using reg ex . hot to get it

tmuthuk · ‎03-20-2013

Data: [2013-03-17 23:48:23,472] [[ACTIVE] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'] INFO - TYPE=0;SEV=INFO;APPLID=LY.LL;ALERTKEY=LY.LL:mdb.personmaintenance.MaintainPerson:Maintain message;INCIDENT_GROUP=Loyalty Program;SUMMARY=<?xml version="1.0" encoding="UTF-8" standalone="yes"?> ns6:Date_Time2013-03-16T14:31:44.000000/ns6:Date_Time ns6:UpdateSourceCW/ns6:UpdateSource ns7:Person ns7:FirstNameAndrea/ns7:FirstName ns7:LastNameColocillo/ns7:LastName ns7:DateOfBirth1978-02-17/ns7:DateOfBirth ns7:GenderF/ns7:Gender ns7:Aliases 146309668/ns7:Alias /ns7:Aliases ns7:LastUpdateDateTime2013-03-16T14:31:44.000000/ns7:LastUpdateDateTime /ns7:Person ;CLASS=com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson; -class com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson [2013-03-17 23:48:23,472] [[ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] INFO - TYPE=0;SEV=INFO;APPLID=LY.LL;ALERTKEY=LY.LL:...rsonmaintenance.MaintainPerson:MaintainPerson OnMessage;INCIDENT_GROUP=Loyalty Program;SUMMARY=MaintainPerson OnMessage for debug id 146309729: took 100 milliseconds to complete;CLASS=com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson; -class com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson [2013-03-17 23:48:23,475] [[ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] INFO - TYPE=0;SEV=INFO;APPLID=LY.LL;ALERTKEY=LY.LL:mdb.personmaintenance.MaintainPerson:Maintain message;INCIDENT_GROUP=Loyalty Program;SUMMARY=<?xml version="1.0" encoding="UTF-8" standalone="yes"?> ns6:Date_Time2013-03-16T14:31:44.000000/ns6:Date_Time ns6:UpdateSourceCW/ns6:UpdateSource ns7:Person ns7:FirstNameLEE/ns7:FirstName ns7:MiddleNameR/ns7:MiddleName ns7:LastNameCHRISTMANN/ns7:LastName ns7:DateOfBirth1959-11-04/ns7:DateOfBirth ns7:GenderM/ns7:Gender ns7:Aliases 146309729/ns7:Alias /ns7:Aliases ns7:LastUpdateDateTime2013-03-16T14:31:44.000000/ns7:LastUpdateDateTime /ns7:Person ;CLASS=com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson; -class com.XXXXXXX.ly.ll.mdb.personmaintenance.MaintainPerson data needs to be break the event whenver [2013-03-17 23:48:23,472] [[ACTIVE] occurs Source type i used : MAX_TIMESTAMP_LOOKAHEAD = 30 SHOULD_LINEMERGE = true TIME_FORMAT = ^[%Y-%m-%d %H:%M:%S,%3N^] TIME_PREFIX = ^[ BREAK_LINE_BEFORE = ^[ pulldown_type=1 But it is not breaking me properly . I ma new to splunk. Please provide me the link for 'how to parse the data'

Posts	16
Solutions	0
Karma Given	3
Karma Received	5
Member Since	‎03-20-2013

Online Status	Offline
Date Last Visited	‎01-24-2023 07:44 AM

indexing multiple timezone data

How to troubleshoot why Splunk DB Connect 2 stoppe...

DB Connect: How to format a field containing XML d...

How to set up a limit to max no of events to be s...

Need help in parsing

Can we masking sensitive fields in Search time ?

Masking a data at search time

Help on regex

Need to parse the data

Re: Going crazy with simple Regex

Re: checking list of email domains appear in a fie...