Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About zillionlee
zillionlee
Path Finder
Member since:
07-24-2013
02-22-2021
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 07-24-2013 |
Activity Feed
- Karma Re: Is it possible to extract the name of the day and month from an event date field in the format dd/mm/yyyy? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How can I configure splunk to read dates in dd/mm/yyyy format? for MarioM. 06-05-2020 12:47 AM
- Karma Re: Timestamp parsed incorrectly for kristian_kolb. 06-05-2020 12:46 AM
- Posted Re: Count values in multivalue field encoded as a string on Splunk Search. 07-25-2019 02:25 AM
- Posted Re: Splunk SSO change - no longer works. on Security. 06-24-2015 06:57 PM
- Posted Re: Splunk DB Connect 1.1.4: Why am I getting error "java.sql.SQLException: The column "0" is not present in the result set"? on Monitoring Splunk. 06-01-2015 08:00 PM
- Posted Splunk DB Connect 1.1.4: Why am I getting error "java.sql.SQLException: The column "0" is not present in the result set"? on Monitoring Splunk. 05-26-2015 06:47 PM
- Tagged Splunk DB Connect 1.1.4: Why am I getting error "java.sql.SQLException: The column "0" is not present in the result set"? on Monitoring Splunk. 05-26-2015 06:47 PM
- Tagged Splunk DB Connect 1.1.4: Why am I getting error "java.sql.SQLException: The column "0" is not present in the result set"? on Monitoring Splunk. 05-26-2015 06:47 PM
- Posted Re: DB Connect 1.1.4: "Error validating dbmonTail for monitor..." trying to create a database input. on Monitoring Splunk. 05-26-2015 06:15 PM
- Posted Re: Row Limitation for PDF generation on Reporting. 11-19-2014 11:59 PM
- Posted Re: Event timestamp issue on Getting Data In. 09-28-2014 11:49 PM
- Posted Re: can i restore data from bad indexer with the disk damaged ? on Deployment Architecture. 03-21-2014 05:21 AM
- Posted can i restore data from bad indexer with the disk damaged ? on Deployment Architecture. 03-21-2014 12:33 AM
- Tagged can i restore data from bad indexer with the disk damaged ? on Deployment Architecture. 03-21-2014 12:33 AM
- Posted Re: Scheduled PDF generates incomplete report - some dashboard panels are missing on Reporting. 02-18-2014 05:48 AM
- Posted Re: Scheduled PDF generates incomplete report - some dashboard panels are missing on Reporting. 02-17-2014 06:54 AM
Topics I've Started
07-25-2019
02:25 AM
1)
| makeresults
| eval puppy_name = "Scout Windixie Spot Spot"
| eval name_count = mvcount(mvdedup(split(puppy_name," ")))
2) it looks like a list in python, I'm not sure splunk has a function that converts a list string directly into a multi-valued field, I recommend parsing it first with a regular expression, like this:
| makeresults
| eval puppy_name ="['Scout', 'Windixie', 'Spot','Spot']"
| rex field=puppy_name "'(?P[^']+)'" max_match=0
| eval name_count = mvcount(mvdedup(name))
Hope that helps
... View more
06-24-2015
06:57 PM
I'm getting the same question.The /debug/sso page looks OK.
I got some log in web_service.log
2015-06-24 09:46:44,231 ERROR [558b5d84381ca48350] auth:59 - getSessionKey - unable to login; check credentials
2015-06-24 09:46:44,232 WARNING [558b5d84381ca48350] decorators:207 - Could not authenticate user zillionlee via SSO. Does zillionlee have a matching splunk account with the same username?
But I have a user zillionlee in splunk.I have no idea.
... View more
06-01-2015
08:00 PM
Can anyone give me some help?Thanks a lot.
... View more
05-26-2015
06:47 PM
when i use dbx 1.1.4 ,i got an error
2015-05-26 11:44:39.901 dbx9174:ERROR:Scheduler - Error while reloading database input=dbmon-tail://BMS_noteobj/2
com.splunk.config.SplunkConfigurationException: Error validating dbmonTail for monitor=dbmon-tail://BMS_noteobj/2: The column "0" is not present in the result set with query = SELECT id,value,Dtime,No FROM his20150523
at com.splunk.dbx.monitor.DatabaseMonitor.validate(DatabaseMonitor.java:165)
at com.splunk.dbx.monitor.DatabaseMonitor.<init>(DatabaseMonitor.java:145)
at com.splunk.dbx.monitor.scheduler.Scheduler.loadDatabaseMonitor(Scheduler.java:216)
at com.splunk.dbx.monitor.scheduler.Scheduler.reloadDatabaseMonitor(Scheduler.java:196)
at com.splunk.dbx.monitor.DatabaseMonitoringManager$Reloader.run(DatabaseMonitoringManager.java:133)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
at java.util.concurrent.FutureTask.run(FutureTask.java:262)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:178)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:292)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.sql.SQLException: The column "0" is not present in the result set
at com.splunk.util.Utils$SQL.getIndexForColumn(Utils.java:1611)
at com.splunk.dbx.sql.type.impl.AbstractDatabaseType.findRisingColumnIndex(AbstractDatabaseType.java:370)
at com.splunk.dbx.monitor.impl.TailDatabaseMonitor.performValidation(TailDatabaseMonitor.java:173)
at com.splunk.dbx.monitor.DatabaseMonitor.validate(DatabaseMonitor.java:159)
... 11 more
the table is very simple, (no bigint ,id varchar,value varchar, dtime varchar), the "no" is Rising_Column. when I click the "save" button,it's no error. but when I edit the database-inputs again,the Rising_Column change to "0". It's quite puzzling to me. the database is MS SQLSERVER. Other table-inputs are normal, like (orderno bigint,id varchar value varchar )
so I guess maybe it's because "no" is ms sqlserver ODBC reserved keywords. site: msdn.microsoft.com/en-us/library/ms189822
If I cannot change the column name , how to solve the question?
thanks guys!
... View more
05-26-2015
06:15 PM
try to using the no-renaming column
... View more
11-19-2014
11:59 PM
You can configure $SPLUNK_HOME/etc/system/local/limits.conf file.
*[pdf]
max_rows_per_table = *
then,restart splunk.
also,you can find $SPLUNK_HOME/etc/system/README/limits.conf.spec file about this.
But,I must say that 100,000 rows are really huge.You should consider to reduce the size.
... View more
09-28-2014
11:49 PM
I think splunk doesn't pick the correct timestamp if as you say.Is it because the raw log has the same like string somewhere?
You can try to use the TIME_FORMAT property in $SPLUNK_HOME/etc/system/local/props.conf.
good luck 🙂
... View more
03-21-2014
05:21 AM
thanks a lot ,this is quite helpful.
... View more
03-21-2014
12:33 AM
I have 5 indexers,and one crushed with data partition damaged.As i know,forwarder data would be sent to these indexers randomly,(is this right ?) .So , can I restore data in the bad indexer possibly? Has SPLUNK a mechanism similar to the RAID5 ? Badly we don't have a backup index-data and even don't know which part of the data missed, please help me , thx a lot.
... View more
- Tags:
- index
02-18-2014
05:48 AM
yeah,you absolutely can contact them for help. hope them can fix this question.
... View more
02-17-2014
06:54 AM
i met the same question,too. do you use the 'single' pannel ?
Don't use the 'single' pannel ,it looks like no effect. try to use "table" pannel, even it has only one single value.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-22-2021
05:05 AM
|
