Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sriram
Sriram
Communicator
Member since:
11-17-2011
06-05-2020
Community Statistics
| Posts | 55 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 13 |
| Member Since | 11-17-2011 |
Activity Feed
- Karma Re: Search using NOT for richgalloway. 06-05-2020 12:47 AM
- Karma Re: Search using NOT for acharlieh. 06-05-2020 12:47 AM
- Got Karma for Re: Search using NOT. 06-05-2020 12:47 AM
- Karma Re: Export Link for kmattern. 06-05-2020 12:46 AM
- Karma Re: transaction duration between subevents for lguinn2. 06-05-2020 12:46 AM
- Karma Re: search based on logged in user id for bwooden. 06-05-2020 12:46 AM
- Karma Re: Navigation Menu for Drainy. 06-05-2020 12:46 AM
- Karma Re: Search Progress Indicator for sideview. 06-05-2020 12:46 AM
- Karma Re: Search Progress Indicator for sideview. 06-05-2020 12:46 AM
- Karma Re: Search Progress Indicator for sideview. 06-05-2020 12:46 AM
- Karma Re: Export Excel Module for araitz. 06-05-2020 12:46 AM
- Karma Re: Splunk sub search for somesoni2. 06-05-2020 12:46 AM
- Karma Re: SPLUNK DB CONNECT - DB2 for btsay_splunk. 06-05-2020 12:46 AM
- Karma Re: Splunk DB Connect - DB2 - DBMON TAIL for btsay_splunk. 06-05-2020 12:46 AM
- Karma Re: Transaction using timestamp for richgalloway. 06-05-2020 12:46 AM
- Got Karma for Export Link. 06-05-2020 12:46 AM
- Got Karma for Pulldown Module. 06-05-2020 12:46 AM
- Got Karma for Pulldown Module. 06-05-2020 12:46 AM
- Got Karma for search based on logged in user id. 06-05-2020 12:46 AM
- Got Karma for search based on logged in user id. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
05-10-2017
04:05 PM
I have sporadic issues where not all the logs from application logs are getting forwarded to Splunk. I see gaps in logs when i search in Splunk.
(a) Is Splunk slow catching up with high log volume generated by application? If so, how can i prevent this?
(b) Could long XML or binary data in the logs cause some of these issues?
Appreciate your feed back.
... View more
- Tags:
- application
- forwarder
08-20-2015
09:32 AM
Hello,
I am trying to use this app to perform an e-directory ldap lookup based on user id. If I want to connect to ldap using anonymous bind, how do I do that? LDAP.conf file has no such provision. Any help is appreciated.
... View more
05-22-2015
08:09 AM
1 Karma
Thank you all for quick response. As acharlieh correctly pointed out that The issue appears to be subsearch result limit causing the numbers to go awry. I set a limit of 60000 (it is still ugly, but it seems to be working) and also changed the 'fields ThreadId' to 'table ThreadId' as per richgalloway suggestion.
index=datasummary1 ThreadId = "*" NOT [search index=datasummary2 | dedup ThreadId | table ThreadId | format maxresults=60000] | table ThreadId,EventDate,EventTime,status
i will explore the other suggestions mentioned in the post as my subsearch limit will definitely be more 60000 at some point.
Thanks again. You guys are awesome !
... View more
05-21-2015
09:07 AM
I have a query like this to llist thread from datasummary1 which does'nt exist in datasummary2. (something like this below). I am not getting accurate results. Any ideas where the issue is ?
if i run individual queries
datasummary1 ==> 220000
datasummary2 ==> 40000
the below query give me somewhere around 210000, where i am expecting 180000.
index=datasummary1 NOT [search index=datasummary2 | dedup ThreadId | fields ThreadId] | table ThreadId
... View more
- Tags:
- search
11-17-2014
08:59 AM
i have the same problem in windows version of splunk of 6.1 and 6.2 with trial version. I know there is additional space in that folder. I even uninstalled and reinstalled splunk to same as well as different folders. I changed the system settings limit. Nothing works. Any help.
... View more
11-11-2014
10:04 PM
Does this work for prefix wild card as well ? We have source types like UIT1_XXX_APPLICATION, UIT2_XXX_APPLICATION etc. The above command does'nt seem to be working.
... View more
05-22-2014
10:40 AM
1 Karma
I have a splunk query to combine 2 different results.
index=applogs sourcetype=appsource "performance metrics" | search "AvgRespTime" > 6| eval "Statistics" = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics" | eval "Statistics" = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics"
I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?
... View more
- Tags:
- append
- sub-search
03-19-2014
11:17 AM
main INFO TxnSummaryLogWriter - LOGTYPE=COMPRESSED, JSON_TXN_SUMMARIES H4sIAAAAAAAAANWbW4vaQBiG/8tcZyEzE 3O63Cil..../veCqx1ATmg4KJlgB5AT3rsDT2P+LFI2qwuOHP4C9fIIkZIyAAA=
main INFO TxnSummaryLogWriter - LOGTYPE=UNCOMPRESSED, JSON_TXN_SUMMARIES {"txnsummaries":[{"el":82,"cpu":15, "startTime":"2014-03-12T16:31:02","metadata":{"dummyParam":"foo0","DCN":"143"},"integrations":[{"cat":"JDBC","id":"fooDataSource","cnt":2,"el":17}
... View more
03-19-2014
10:53 AM
Thank You. The problem is the logs are not coming as zip file type. It will be in application.log which has both compressed and uncompressed data mixed together. Here is an example from the application.log. Based on the LOGTYPE=COMPRESSED, I can identify what type of data this event is. At the Index time, I want to be able to uncompress the data and index it. (I have added the rest of the details below.
... View more
03-18-2014
02:32 PM
I have few application which sends application logs in both compressed and uncompressed format. There is a log attribute which identifies what the format of the log data is, so I can create 2 different source types. At the indexing time, i need to uncompress the data(compress) and feed to splunk for further analysis.
Is it possible to uncompress the data at index time ? What is the recommended approach to do this ?
... View more
01-13-2014
09:40 AM
Yes. I got the same result with event_ts, how sort using _time helped.I managed to make it work by specifying "startwith" as well as with those sort as there are many similar transaction with same dcn. Thanks again.
index="someindex" | transaction dcn startswith="020"| eval "Response Time(Secs)" = round(duration,2) | eval "Event Time"=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename rcvd_dt as "Received Date" dcn as DCN | table "Event Time", "Received Date" , DCN, , "Response Time(Secs)" | sort -"Event Time"
... View more
01-09-2014
04:23 PM
I have the following query.
index="someindex" | sort +evnt_ts | transaction dcn,evnt_ts keepevicted="t"| table dcn,_time,evnt_ts
There are 15 events for each dcn. When I do 'transaction dcn', I get the results properly with evnt_ts grouped together. I need to results come in ascending time sequence as I want to use 'delta' command to find the time difference between each events. When I run the above query, the timestamp is always in reverse order (most recent time first). I even tried |reverse. Nothing works. Any luck.
... View more
01-08-2014
04:07 PM
which process is locking the state.xml and manifest file. It appears to be sporadic as well. I have the same issue. Unable to delete or modify the file to reset the state. I ended up cloning the db input and disable the old one. Appreciate your help.
... View more
01-06-2014
04:47 PM
Thanks. I tried that and was not successful. I am guessing it is because of the invalid timestamp format in the rising_column. will give it a shot.
Also, If I want to start pulling the data only after a certain date. Can I specify the SQL like this ?
SELECT * FROM CLM_EVNT {{WHERE EVNT_TS > "12-09-2013.00.00.00.0000" AND $EVNT_TS$ > ?}} ORDER BY EVNT_TS
Where EVNT_TS is the rising_column.
... View more
01-03-2014
03:59 PM
I am trying to setup a dbmon tail from a table running in DB2 ZOS and unsuccessful in getting it work. After enabling debug and looking at the dbx.log, it appears the query the application generates doesn't have schema name. Absence of schema will force the query to use the userid which makes the query. I either need to set the default schema (SET SCHEMA XXXXX and then fire the query) OR the query has to qualify the table name with the schema name. Incidentally looking at the dbquery command string, I see the query is passed with schema name and I could pull the data.
I tried to qualify the table name with schema when setting up Database Inputs (table name field) as DBCDB02.CLM_EVNT. Looking at the logs below, it looks the correct schema is parsed properly, however the query constructed by TailDatabaseMonitor doesn't have the schema.
2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Split table identifier=DBCDB02.CLM_EVNT to schema=DBCDB02 table=CLM_EVNT
2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Constructed SQL query from table name: "SELECT * FROM CLM_EVNT WHERE EVNT_TS > ? ORDER BY EVNT_TS"
Here is the snippet from the dbx.log (U12345 is the userid which is defined to connect to the db)
2014-01-03 17:15:12.984 dbx9210:DEBUG:Scheduler - Scheduling initial execution for input=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT]
2014-01-03 17:15:12.984 dbx9210:DEBUG:ExecutionSchedule - State transition from=PENDING to=WAITING
2014-01-03 17:15:12.984 dbx9210:DEBUG:ExecutionContext - Destroying execution context...
2014-01-03 17:15:12.984 dbx9210:INFO:ExecutionContext - Execution finished in duration=94 ms
2014-01-03 17:15:17.984 main:DEBUG:Scheduler - Timer for input=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT] nextExecution=5000 state=WAITING expired. Executing it now...
2014-01-03 17:15:17.984 main:DEBUG:ExecutionSchedule - State transition from=WAITING to=QUEUED
2014-01-03 17:15:17.984 dbx562:DEBUG:ExecutionContext - Initializing execution context with app.ctx=dbx and execId=dbx562
2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Running database monitor in own thread.
2014-01-03 17:15:17.984 dbx562:DEBUG:ExecutionSchedule - State transition from=QUEUED to=RUNNING
2014-01-03 17:15:17.984 dbx562:INFO:TailDatabaseMonitor - Executing database monitor=[dbmon-tail://DBCDB02/DBCDB02.CLM_EVNT]
2014-01-03 17:15:17.984 dbx562:DEBUG:XStreamStore - Initialized XStreamStore at C:\Program Files\Splunk\var\lib\splunk\persistentstorage\dbx\dfe3933a37ec54ded02fb7bcf7226e39\state.xml
2014-01-03 17:15:17.984 dbx562:DEBUG:XStreamStore - Loading state from XML file...
**2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Split table identifier=DBCDB02.CLM_EVNT to schema=DBCDB02 table=CLM_EVNT
2014-01-03 17:15:17.984 dbx562:DEBUG:TailDatabaseMonitor - Constructed SQL query from table name: "SELECT * FROM CLM_EVNT WHERE EVNT_TS > ? ORDER BY EVNT_TS"**
2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Fetching connection from factory...
2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Fetching connection from pool...
2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Activating database connection com.ibm.db2.jcc.b.b@1aecc3a for database=DBCDB02
2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Setting transaction isolation...
2014-01-03 17:15:17.984 dbx562:DEBUG:PooledConnectionFactory - Validating database connection for database=DBCDB02
2014-01-03 17:15:17.984 dbx562:DEBUG:Database - Executing database connection specific test query: SELECT CURRENT SQLID FROM SYSIBM.SYSDUMMY1
2014-01-03 17:15:18.046 dbx562:INFO:TailDatabaseMonitor - Applying latest tail.rising.column value=2013-12-18 06:11:30.996225
2014-01-03 17:15:18.093 dbx562:ERROR:TailDatabaseMonitor - Error while executing database monitor: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -204, SQLSTATE: 42704, SQLERRMC: U12345.CLM_EVNT
com.ibm.db2.jcc.c.SqlException: DB2 SQL error: **SQLCODE: -204, SQLSTATE: 42704, SQLERRMC: U12345.CLM_EVNT**
at com.ibm.db2.jcc.c.tf.e(tf.java:1680)
........
at com.ibm.db2.jcc.c.uf.executeQuery(uf.java:491)
at com.splunk.dbx.sql.Database.query(Database.java:257)
at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.performMonitoring(TailDatabaseMonitor.java:113)
... View more
01-03-2014
12:57 PM
Thank you for providing alternate solution. zOS DB2 doesn't like that "VALUES 1" query. For now I am not doing validation. Also after manually adding default.schema = XXXXX in local - database.conf, I am able to get past the issue and able to pull the tables. I will open up the case to document the issue, so it can be fixed in next release.
... View more
01-02-2014
03:23 PM
Here is overall log.
2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Validating database connection...
2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Executing test query: VALUES 1
2014-01-02 17:09:06.843 dbx1240:ERROR:Database - Database validation failed for database Database{name='database', databaseType=com.splunk.dbx.sql.type.impl.DB2@a23610, host='xxxx', port=xxxx, username='xxx', database='xxxx'}: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -142, SQLSTATE: 42612, SQLERRMC: null
..........
com.splunk.dbx.sql.Database.validateConnection(Database.java:479)
... View more
01-02-2014
03:21 PM
I am giving the correct database info. After enabling the logs to debug level. dbx.log shows the following. During validation, it is trying to execute a testquery and sending an invalid query. I tried to override the database.conf file with this sample testquery "testQuery = SELECT CURRENT SQLID FROM SYSIBM.SYSDUMMY1". It is not taking it. I wonder where this "VALUES 1" query is coming from ? Has anyone successfully tried and tested DB2 connectivity for this app ?
2014-01-02 17:09:06.812 dbx1240:DEBUG:Database - Executing test query: VALUES 1
... View more
01-02-2014
01:07 PM
1 Karma
I am trying to setup a DB Connection to DB2 which is running in zos. The connection seem to be successful. However I see the following exception when i try to save the settings. Any Idea what the issue is ? I am able to connect to this database using other db client tools like db2 connect, squirrel etc.
Encountered the following error while trying to save: In handler 'databases': Error validating database: com.ibm.db2.jcc.c.SqlException: DB2 SQL error: SQLCODE: -142, SQLSTATE: 42612, SQLERRMC: null
... View more
03-15-2013
03:37 PM
1 Karma
I need to build a dashboard to parse the json data and show it more like Tree Structure.What is the best way, I can build a data structure to be able to run custom queries. I tries use basic spath command as well as using jsontutils jsonkvrecursive command with limited success. Appreciate any help. Here is a sample json data.
{
"timings": {
"cat": "ROOT",
"el": 597086853,
"cpu": 256429000,
"subtimings": {
"find": {
"cat": "CODE",
"el": 500467225,
"cpu": 218036000,
"subtimings": {
"Find - buildMapperObjects": {
"cat": "CODE",
"el": 6585459,
"cpu": 3989000
},
"findBySubscriber": {
"cat": "CODE",
"el": 488985754,
"cpu": 211558000,
"subtimings": {
"findResponseObjects": {
"cat": "CODE",
"el": 515299,
"cpu": 328000
},
"findSubSqlParamSrc": {
"cat": "CODE",
"el": 1483307,
"cpu": 930000
},
"executeSPCall": {
"cat": "CODE",
"el": 152860617,
"cpu": 36395000,
"aggregates": {
"dataSourceCall": {
"cnt": 2,
"el": 22312142
}
}
}
}
}
}
}
}
}
}
... View more
11-05-2012
02:45 PM
I have a saved search which triggers an alert every hour on certain events. This works fine. However the "Link to results" shows incorrect url, It shows
"http://myhostname:8000...." whereas the correct link to the results is "http://myhostname/en-US/...". Based on several posts, I tried to update the "link hostname" under "email alert settings" thru splunk UI without success. Can I manually update the alert_actions.conf - hostname to "http://myhostname/en-US", so the email content shows correct URL ? Any help would be appreciated.
... View more
06-11-2012
12:52 PM
Thanks. This helps. However I need to restore the button back once the search is done. Can you tell me whether it is feasible and how much work it is.
... View more
06-11-2012
10:17 AM
Have you done any exercise to make it better in IE8 ? Asking the user base to go any of the other browsers might take a while. Is splunk recommendation is to move on to IE9 or other browsers ? I see the mainly on rendering part. Can turning off any IE8 settings will make any difference.
... View more
