Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About junshi
junshi
Explorer
Member since:
04-23-2012
04-29-2021
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-23-2012 |
Activity Feed
- Posted Re: Microsoft Azure Add on for Splunk no longer pulling event hub data on All Apps and Add-ons. 04-29-2021 06:13 AM
- Got Karma for Re: Microsoft Azure Add on for Splunk no longer pulling event hub data. 04-29-2021 01:23 AM
- Posted Re: Microsoft Azure Add on for Splunk no longer pulling event hub data on All Apps and Add-ons. 02-18-2021 07:52 AM
- Posted Microsoft Azure Add on for Splunk no longer pulling event hub data on All Apps and Add-ons. 01-28-2021 11:29 AM
- Posted Re: Timezone and Timestamp modification at search/report time? on Getting Data In. 05-23-2019 02:28 PM
- Posted Re: Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 10:46 AM
- Posted Re: Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 10:03 AM
- Posted Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 08:31 AM
- Tagged Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 08:31 AM
- Tagged Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 08:31 AM
- Tagged Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 08:31 AM
- Tagged Is there a way to export results to multiple CSVs with a fixed number of events per file? on Getting Data In. 01-12-2016 08:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
04-29-2021
06:13 AM
You can get to the setting within the App. Simply click on the INPUTS tab, then select your (EventHub) input. Click EDIT. The Max Batch settings are at the bottom of the window!
... View more
02-18-2021
07:52 AM
1 Karma
Found the solution, the number of eventhub events had increased and the default settings for the Microsoft Azure Add-on App were no longer able to keep up. I increased the setting for "Max batch Set Iterations" from 100 to 1000. I then checked the eps for this source and saw a 50% increase. After a few days, the logs finally caught up and we are now pulling logs in a timely manner.
... View more
01-28-2021
11:29 AM
Logs have been working fine until this week, now I get the error: ERROR pid=15289 tid=MainThread file=base_modinput.py:log_error:307 | _Splunk_ Error getting event hub data for hub: insights-logs-signinlogs, resource: 3. Detail: The service was unable to process the request; please retry the operation. For more information on exception types and proper exception handling, please refer to http://go.microsoft.com/fwlink/?LinkId=761101 TrackingId:abe05384f2aa4f528eaad64feccc1e53_G8, SystemTracker:gateway5, Timestamp:
ErrorCodes.InternalServerError: The service was unable to process the request; please retry the operation. For more information on exception types and proper exception handling, please refer to http://go.microsoft.com/fwlink/?LinkId=761101 TrackingId:abe05384f2aa4f528eaad64feccc1e53_G8, SystemTracker:gateway5, Timestamp: Also seeing these errors around the same time: ERROR pid=48797 tid=MainThread file=base_modinput.py:log_error:307 | _Splunk_ Error getting event hub data for hub: insights-logs-auditlogs, resource: 2. Detail: ('Connection aborted.', BadStatusLine("''",)) This is happening for multiple hubs? Azure App v2.1.0 Spunk v7.3.3 @jconger !
... View more
Labels
- Labels:
-
troubleshooting
05-23-2019
02:28 PM
This was my spin on things to allow for the switch from daylight savings, we also run this as a macro:
| eval day=strftime(_time, "%j")
| eval myDateFormat="%Y-%m-%d %H:%M:%S.%3Q"
| eval TimeDisp=strftime(_time,myDateFormat." %Z")
| eval myTzName=if(day >= 68,if(day <= 306,"CDT","CST"),"CST")
| eval local_time=strftime(2*_time-strptime(strftime(_time,myDateFormat." ".myTzName),myDateFormat." %Z"),myDateFormat)." ".myTzName
| fields - _time TimeDisp myDateFormat myTzName
... View more
01-12-2016
10:46 AM
Tweaked your search:
| gentimes start=-1 | eval sno=mvrange(0,60) | table sno | mvexpand sno | eval from=sno*1000+1 | eval to=(sno+1)*1000 | map [search your search to export | eval sno=1 | accum sno | where sno>=$from$ AND sno<=$to$ | fields - sno | outputcsv Result.$from$"-".$to$]
This seems to work, thanks again!
... View more
01-12-2016
10:03 AM
Nice, I was playing with the eval command but in a different approach. Very nice!
... View more
01-12-2016
08:31 AM
I have a search that returns around 60,000 results in a straight table format:
field1, field2
I need to export this via CSV to another system, that only accepts 1000 lines per CSV.
Is there a way to export these results to multiple CSV's, capped at 1000 events per CSV?
example:
results1.csv (1-1000)
results2.csv (1001-2000)
resultsn.csv (n...)
Note: I cannot split based upon time, as we are running a daily stats, then de-duping these results, before export.
I am also trying to avoid running multiple searches for each 1000 events!
Thanks all!!!
... View more
