Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About miken_hg5
miken_hg5
Explorer
Member since:
08-24-2011
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 08-24-2011 |
Activity Feed
- Karma Re: WebSphere logs and timezone set as EST for Australian user? for MHibbin. 06-05-2020 12:46 AM
- Got Karma for WebSphere logs and timezone set as EST for Australian user?. 06-05-2020 12:46 AM
- Got Karma for Re: XML file, Breaking before and/or after matching <Document> .. </Document> tags. 06-05-2020 12:46 AM
- Posted Re: How to calculate the total time taken for each transaction on Splunk Search. 09-22-2013 06:30 AM
- Posted Re: How to calculate the total time taken for each transaction on Splunk Search. 09-22-2013 06:02 AM
- Posted Re: XML file, Breaking before and/or after matching <Document> .. </Document> tags on Dashboards & Visualizations. 09-22-2013 05:53 AM
- Posted XML file, Breaking before and/or after matching <Document> .. </Document> tags on Dashboards & Visualizations. 09-21-2013 09:46 AM
- Tagged XML file, Breaking before and/or after matching <Document> .. </Document> tags on Dashboards & Visualizations. 09-21-2013 09:46 AM
- Tagged XML file, Breaking before and/or after matching <Document> .. </Document> tags on Dashboards & Visualizations. 09-21-2013 09:46 AM
- Posted Re: WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 12-02-2011 11:17 PM
- Posted Re: WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 12-02-2011 11:16 PM
- Posted Re: WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 09:01 PM
- Posted Re: WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:48 AM
- Posted WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
- Tagged WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
- Tagged WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
- Tagged WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
- Tagged WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
- Tagged WebSphere logs and timezone set as EST for Australian user? on Getting Data In. 11-28-2011 02:24 AM
Topics I've Started
09-22-2013
06:30 AM
search source="your files" | reverse | transaction TransactionID | eval TimeTaken=_duration | fields _time, TransactionID, TimeTaken | sort _time, TransactionID?
Will that join the events as needed on TransactionID and then zoom in on the fields you need ?
If not I'm possibly not understanding your requirements fully
I've just recently used transaction and also delta to help get end to end timings for events
In one case I resorted to using delta because I could not get the events into Splunk exactly right
Otherwise I think transaction is simpler
... View more
09-22-2013
06:02 AM
Could this be done using the | reverse | transaction TransactionId?
The reverse should ensure that the start_process is listed before completed
The transaction will join separate events into one combined event = a transaction
- and every unique value of TranscationID results in multiple transactions
Splunk will automatically create a new field = _duration for you which is the difference between first and last event in the combined event.
So you don't need to even do a time difference between the fields yourself
nb: I note that the date and times for the events are identical in your quoted example - if there is no difference in log time NOR in the event details themselves, sadly _duration may prove to be 0?
... View more
09-22-2013
05:53 AM
1 Karma
Aha, I've solved it and found this answer especially relevant to my problem
http://answers.splunk.com/answers/88201/need-help-with-event-breaking-in-xml-log-file
The fix for my file was to use this in props.conf in Advanced Mode in Data Inputs
BREAK_ONLY_BEFORE=<Document
MUST_BREAK_AFTER=<\/Document>
... View more
09-21-2013
09:46 AM
I am puzzled why I cannot configure Splunk to break on what appears to be simple ... tags
My XML looks like this (a snippet)
<?xml etc .. with <Document ...> ... </Document> tags
What I want to do is treat the <Document ...> ... </Document> as an event
I've tried using MUST BREAK AFTER = </Document>
and with and without BREAK ONLY BEFORE
Splunk is stubbornly breaking part way thru my intended event
I have tried escaping the < and > and even the escaping the / too
But no joy ... it should be simple based on what I have read and the XML seems well formed ... I am puzzled
... View more
- Tags:
- must_break_after
- xml
12-02-2011
11:17 PM
Sorted using the tip on
MAX_TIMESTAMP_LOOKAHEAD = 22
... View more
12-02-2011
11:16 PM
Sorted 😉
The change to using MAX_TIMESTAMP_LOOKAHEAD was the key
without it the system always gave preference to the EST and assumed data was from the US EST zone. Now it stores 'as is' in Oz time
... View more
11-28-2011
09:01 PM
I have tried the above without success 😞
By default, Splunk applies time zones using these rules, in this order:
FIRSTLY. Splunk uses any time zone specified in raw event data (for example, PST, -0800).
And my log has an eyecatching EST in it !
e.g. [24/11/11 10:49:57:538 EST] 0000004a ServletWrapper I SRVE0242I: [custom-webapp] [/app]
Then ... Splunk uses the value of a TZ attribute set in props.conf, if the event matches the host, source, or source type specified by the stanza.
And then ... Splunk uses the time zone of the Splunk server that indexes the event.
So I suspect my props.conf is being bypassed because it sees EST in there already.
My host name matches the wildcard in the props stanza
... View more
11-28-2011
02:48 AM
PS: One option I have considered is this
that Splunk in order of preference sees the EST entry and assumes it is US/EST, and applies that by default
The documentation says it evaluates timezone in this order
a. seeing values in the log like EST
b. then using values in props
c. then using time set on the server
So I think in my case (a) is being applied before it even considers b, hence my mods to props.cong are redundant
So ... how I teach Splunk to recognise Oz style timezones ??
... View more
11-28-2011
02:24 AM
1 Karma
I am trying to index a WebSphere WAS log, where the time sone format is like this
[24/11/11 10:49:57:538 EST] 0000004a ServletWrapper I SRVE0242I: [custom-webapp] [/app]
The EST used here I think means Australian EST not American EST !
Splunk reads the log fine BUT ... it treats the 'raw input' time to US EST
e.g the entry above which was recorded at 10.49 am is indexed as 11/25/11 2:49:57.538 AM
this suggests that Spunk has interpreted this date as US EST raw
and 'wound this date/time' forward to its Oz equivalent namely Nov 25th at 2.49 am
What I actually want Splunk to do is treat this date time as Australian 'as is'
- namely the date in the index = exactly the same as the date recorded
I've tried the following changes to props.conf without success
[host::my_host*]
TZ = Australia/Melbourne
I suspect that Splunk sees EST in the input file and assumes its US EST
and then sees TZ and adds the diff between US EST and Oz to the input values
- thus winding my logs entries fwd
I just want them to be treated 'as is'
Can you help ?
... View more
