About nls7010

nls7010 · ‎02-25-2022

I want to pick up logs from the same directory that have *.out and *.log in them, is there a way to create one monitor statement with a whitelist that would pick up *.log or *.out or can I use a selection at the end of the monitor like http://xxx/*.log/*.out?

nls7010 · ‎11-09-2021

This is the inputs from the app I created for the windows logs: [WinEventLog://Application] index = replicate3 disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=0 [WinEventLog://Security] index = replicate3 disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" renderXml=0 [WinEventLog://System] index = replicate3 disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=0 I created a special index for it, but it is not getting any results. I also have sent over the splunk TA for windows logs, but still nothing is coming in. The index was created successfully and the apps show on the client. What else am I missing.

nls7010 · ‎09-23-2021

This is an update from my client: To make sure I understand, you are asking if developer_app can be different values in a unique combination of hits per mydate+developer_app combinations, right (i.e. if I look in the event, can I have two developer apps in the event details)? They cannot be; for a single request, there can only be 1 developer app. I’m trying to get to a result set where I can say: I have 50 total calls to a service. 25 were from CC-R5-SITECORE-App and 25 were from CC-R5-IMP-SUPERUSER-App If I add developer_app as a group by parameter, I was thinking I would see the result above where I get a unique number of hits per combination of date+developer+app

nls7010 · ‎09-16-2021

sure, here is the raw data of one of the events: {"proxy_basepath":"/v1/customer/profile","responsecache_l1_count":null,"x-apigee.edge.execution.stats.request_flow_endtimestamp":1631811648373,"responsecache_executed":null,"apiproxy":"cc-cust-profile-01-v1","x-apigee.edge.is_policy_error":0,"client_id":"RfmkbZ3EI161T1MHfGaIlHKvDsgeXJZ2","responsecache_name":null,"client_sent_start_timestamp":1631811649200,"target_sent_start_timestamp":1631811648374,"x-apigee.edge.is_target_error":0,"client_received_start_timestamp":1631811648364,"x-apigee.intelligence.client_ip_postal":null,"target_sent_end_timestamp":1631811648374,"client_ip":"139.46.106.177","is_error":false,"x-apigee.edge.stats.steps":"{\"qtAPIQuota.0\":3,\"o2VerifyAccessToken.0\":2,\"repRegExProtect.0\":0}","id":"fq51wz403hod2kqjww3lqd0y","request_size":235,"developer_app":"CC-R5-SITECORE-App","x-apigee.intelligence.client_ip_header":"104.209.233.38","target_response_code":201,"apigee.edge.execution.fault_code":null,"apigee_sdk_client_sessionid":null,"virtual_host":"secure","x-apigee.edge.mp_host":"lcltcust1edgp06.duke-energy.com","apigee_sdk_client_requestid":null,"x-apigee.edge.execution.fault_flow_name":null,"sla":false,"responsecache_key":null,"x-apigee.intelligence.service":"{}","target_received_end_timestamp":1631811649199,"client_sent_end_timestamp":1631811649200,"target_host":"sapisugw-prd.duke-energy.com","request_uri":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","access_token":"okA4MFkAIEcVPaE4091YYvQEeRGX","proxy":"ProfilesProxyEndpoint","x-apigee.intelligence.client_ip_subdivision":null,"target_received_start_timestamp":1631811649198,"api_product":"CC-R5-BE-SC-Services-PROD","proxy_client_ip":"xxxxxxxxxxxx,"x-apigee.edge.dn.region":"dc-1","apigee_sdk_client_appname":null,"apigee_sdk_client_deviceid":null,"apigee.edge.execution.is_apigee_fault":0,"x-apigee.edge.target.latency.stats":"{\"targetList\":[{\"targetId\"😕"target://sapisugw-prd.duke-energy.com\",\"responseStatus\":201,\"latency\":824,\"isTLS\":true}]}","x-apigee.edge.stats.policy.execution":null,"target_url":null,"x-apigee.edge.execution.fault_flow_state":null,"useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36","proxy_pathsuffix":"/email/bp/retrieve","x-apigee.intelligence.client_ip_asn":null,"x-apigee.edge.execution.stats.request_flow_start_timestamp":1631811648371,"x_forwarded_for_ip":null,"response_size":1045,"cache_hit":null,"x-apigee.edge.execution.sense.action":null,"developer_email":"CC_APIGEE_REPORTING@duke-energy.com","x-apigee.edge.execution.fault_policy_name":null,"responsecache_source":null,"response_status_code":201,"request_verb":"POST","x-apigee.edge.true_client_ip":"104.209.233.38","apigee_sdk_client_orgname":null,"x-apigee.edge.execution.stats.response_flow_end_timestamp":1631811649199,"gateway_source":"message_processor","target":"Retrieve Primary BP from Email TargetEndpoint","x-apigee.intelligence.client_ip_country":null,"environment":"prod","client_received_end_timestamp":1631811648364,"target_ip":"xxxxxxxxx","organization":"cust","x-apigee.edge.execution.stats.response_flow_start_timestamp":1631811649199,"request_path":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","developer":"cust@@@BJeQzJGwIGzHXAop","target_basepath":"/sap/opu/odata/sap/ZDIG_SEARCH_BP_EMAIL_SRV/RequestSet","flow_resource":null,"x-apigee.intelligence.client_ip_city":null,"gateway_flow_id":"lcltcust1edgp06-123559-840635-44","apiproxy_revision":"12"}

nls7010 · ‎09-16-2021

There does not appear to be a specific field, so I'm thinking he is making this field at search:

nls7010 · ‎09-16-2021

nls7010 · ‎09-16-2021

This is what the customer responded: To make sure I understand, you are asking if developer_app can be different values in a unique combination of hits per mydate+developer_app combinations, right (i.e. if I look in the event, can I have two developer apps in the event details)? They cannot be; for a single request, there can only be 1 developer app. I’m trying to get to a result set where I can say: I have 50 total calls to a service. 25 were from CC-R5-SITECORE-App and 25 were from CC-R5-IMP-SUPERUSER-App If I add developer_app as a group by parameter, I was thinking I would see the result above where I get a unique number of hits per combination of date+developer+app

nls7010 · ‎09-16-2021

I will ask the client what he set up.

nls7010 · ‎09-16-2021

A client of mine is asking: I’m hoping you can help me with something. I am trying to analyze the volume to a particular Apigee endpoint so I have wrote the following query where I am grouping the stats by my calculated date value to see a day-wise view for a service that hit a particular backend. index="apigee-prod-cne" sourcetype="apigee_metrics" (apiproxy="cc-cust-profile-01-v1") target_host = "sapisugw-prd.duke-energy.com" proxy_pathsuffix = "/email/bp/retrieve" environment="prod" | dedup gateway_flow_id | spath request_verb | search request_verb != "OPTIONS"| eval yourdate = strftime(_time,"%D")| eval yourhour = strftime(_time, "%H")| eval yourmin=strftime(_time,"%M") | stats count(x-apigee.edge.execution.stats.request_flow_start_timestamp) as hits by yourdate What I’m not understanding is that when I add an additional parameter to group by (and changing none of my other conditions) that I suddenly see a spike in calls rather than a segmented number from the total? Can you help me to understand what I may be missing to properly evaluate traffic through our proxies?

nls7010 · ‎08-12-2021

I am getting an error after loading Splunk forwarder on a Linux server (this same load is on other Linux servers with no issues): 6a257470b sp:7ffeb4a673a0 error:0 in liboneagentproc.so[7fd6a2560000+84000] Aug 12 12:04:18 ladcivrnvpt03 kernel: traps: splunkd[66184] trap invalid opcode ip:7fd6a257470b sp:7ffeb4a673a0 error:0 in liboneagentproc.so[7fd6a2560000+84000] I run the ./splunk start --accept-license and it appears to start, but if you ps -eaf | grep splunk, nothing is started. No log files are generated in .../splunkforwarder/var/log/splunk for the splunkd process either.

nls7010 · ‎05-04-2021

Our sendemail function seems to have stopped working or is only working sporadically as it might send email the next day for an issue that occurred the day before or it may not send anything at all. Has anyone seen this before? We did in the past and edited the sendemail.py for that one, but this issue is brand new and we're seeing it in our 7.2.6 environment and in our 8.1.2 environment. We are a clustered environment.

nls7010 · ‎04-30-2021

We recently upgraded to version 8.1.2 Splunk and now our email alerts don't appear to be working. I had this issue in version 6.6.3, but had not seen it since then (we did upgrade to 7.2.6 before moving to 8.1.2--did not see the issue then either). I have looked at older logs that said to remove a few lines in the sendemail.py file and I found similar lines in the new sendemail and marked them out with a # sign, but it did not fix the issue. We are delaying our upgrade of the Production system until we solve this email issue. Any ass

nls7010 · ‎03-04-2021

When I go to the monitoring console and take a look at the forwarders, the console shows them as all missing yet our environment is receiving logs from many of them. I tried to rebuild it in the monitoring console, but it fails. Not sure how to get this fixed.

nls7010 · ‎02-19-2021

I am trying to upload documents from a user who's log files has multiple dots in the naming convention: The logs have a *.0.1.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20210218.000023-5644-5716.0.log in its file extension, would it be possible to use *.*.*.*.log instead? The logs have a *-20201218.105324-11260-11240.0.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20210209.145105-16220-11864.0.log in its file extension, would it be possible to use *.*.*.log instead? The logs have a *-20201218.105324-25876-14744.0.log in its file extension, would it be possible to use *.*.*.log instead? Is there a way to get all of these from .log to .*.*.*.log into Splunk using one monitoring stanza?

nls7010 · ‎12-11-2020

We just loaded an AIX server with a forwarder and we're getting can't write file "/.splunk/authToken_#####_8089: Permission denied We have loaded a number of servers with the splunkforwarder, but just started getting this message. We have a particular user to run the process and it has worked on other servers, but not these new ones. This is using Universal Forwarder 8.0.5. The process actually starts, but when you do ./splunk list monitor is when you get the can't write file. We have several more servers to load and would really like an assist here.

nls7010 · ‎12-03-2020

I have just acquired the Event Timeline Visualization application and loaded it on my Deployer and pushed it out to my search heads. Unfortunately not all the function is showing. Do I need to load this individually on all the search heads? I'm at a loss on how to get this out to them via the normal push from the Deployer to the search head cluster.

nls7010 · ‎08-12-2020

index=xxxx source="/esbplogsdir/prod/Enable/LOG_Maximo_LSI_Work/Maximo/LSI_IN_msg_prod.log" OR source="/esbplogsdir/prod/WS/LOG_Maximo_SmallWorld_IPICustomerInfo/Maximo/SmallWorld_IN_msg_prod.log" | rex "(?i).*? \\- (?P<FIELDNAME>[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+\\-[a-f0-9]+)(?= )" | rex "(?i):.*? \\- (?P<FIELDNAME>\\d+\\.\\d+)(?= )" | search "[ERROR]" OR "failed" |stats dc(FIELDNAME) as ERROR_TRANSACTION_COUNT by source | rename source as SOURCE This is the search, but if one or both sources have a 0 return, I want a line that lists the log file and a 0 to show in my table. How can I do this?

nls7010 · ‎08-10-2020

Where did you increase the open file size? Was it on the cluster master or on the client?

nls7010 · ‎08-07-2020

I am getting an error when trying to push my application from the Deployment server to the Cluster Master. This is the same for all the different apps that are listed in the deployment-apps directory. This has worked many times, but just started this issue. It was once fixed with the _internal being put in the _cluster/local/indexes.conf, but that is still there an I still get the issue. Failed to load app. Application=duke_nix_forwarder_inputs cannot be loaded, as path=/web/splunk/etc/deployment-apps/duke_nix_forwarder_inputs does not exist

nls7010 · ‎07-24-2020

I have been able to find searches for roles mapped to AD Groups, but I need to get the indexes those roles are allowed to use. I'm creating a search to assist in upgrading to a new system. This mapping will give me the relationships. I have used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but it only gives me the role and searchIndexes. I need to map it to AD groups too. Also, when I went to download that searches content, it did not download all the data. I also used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but what I really need is all three values: Role mapped to AD Group and role mapped to indexes in the same search.

nls7010 · ‎07-17-2020

This is a note my client sent: I can’t really use the logs from Splunk, because they are spotty.. Think I figured out why it’s missing data though. From our last meeting, they bumped up the transfer rate from 1024KBps to 2048KBps because the CE was generating too much data. However, the CE raw logs generate roughly about 75MB/Minute or 1.25MBps raw. Since Splunk does use compression at ~17%, the 2KBps gets you about 11KBps raw. The 1.25MBps is roughly 217.6KBps compressed. Hence, it gives you roughly 5% of the total logs. To support Openway and prevent dropping any logs, we need to set a conservative rate to handle 110MB/minute raw, which would be ~319KBps. We did set in the limits.conf to the 2048 mentioned above, but we're not certain how to set to a level the client needs.

nls7010 · ‎07-01-2020

This is the search: index=_internal source=*license_usage.log* type="Usage" earliest=-30d@d latest=@d idx=apcne | fields _time, pool, idx, b | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=24h | stats sum(b) as b by _time, pool, idx | stats sum(b) AS volume by idx, _time | stats avg(volume) AS avgVolume max(volume) AS maxVolume by idx | eval avgVolumeGB=round(avgVolume/1024/1024/1024,2) | eval maxVolumeGB=round(maxVolume/1024/1024/1024,2) | fields idx, avgVolumeGB, maxVolumeGB | rename avgVolumeGB AS "average" maxVolumeGB AS "peak" idx AS "Index"

nls7010 · ‎06-24-2020

I have been trying to put together a dashboard for my clients that shows their usage. The search I am still having issues with is for Average Daily ingest by index over 30 days. I want it to show just the average number. I have found searches that get me a distance, but none are specifically what I need.

nls7010 · ‎06-12-2020

I have tried putting the following in the props.conf file: NO_BINARY_CHECK = true and NO_BINARY_CHECK = 1 and CHARSET=AUTO But none of these worked. I did them in the props.conf file. But when I look at the splunkd.log file, the Splunk still thinks of the file as binary. How can I fix this?

nls7010 · ‎05-15-2020

The edit dashboard has the Schedule PDF Delivery grayed out. I am root and have all the permissions I believe I need, but it remains grayed out. I'm on version 7.2.6. I verified that at least admin had the schedule_search and admin_all_objects and it does and even restarted splunk, but the feature remains grayed out. Can anyone assist.

Posts	111
Solutions	2
Karma Given	0
Karma Received	0
Member Since	‎01-10-2014

Online Status	Offline
Date Last Visited	‎02-28-2022 01:22 PM

How to pick up files in a whitelist that have a di...

I am trying to bring in windows logs from a client...

Need search assist for a query that is not bringin...

Getting the following error when trying to start a...

sendemail function is not working

send email function does not seem to be working af...

Monitoring console showing all forwarders as missi...

How to ingest files with multiple dots in them

We just loaded an AIX server with a forwarder and ...

Trying to load the Event Timeline Visualization in...

How to pick up files in a whitelist that have a di...

I am trying to bring in windows logs from a client...

Re: Need search assist for a query that is not bri...

Re: Need search assist for a query that is not bri...

Re: Need search assist for a query that is not bri...

Re: Need search assist for a query that is not bri...

Re: Need search assist for a query that is not bri...

Re: Need search assist for a query that is not bri...

Need search assist for a query that is not bringin...

Getting the following error when trying to start a...

sendemail function is not working

send email function does not seem to be working af...

Monitoring console showing all forwarders as missi...

How to ingest files with multiple dots in them

We just loaded an AIX server with a forwarder and ...

Trying to load the Event Timeline Visualization in...

I need to bring back a zero value if my search doe...

Re: Heavy forwarder - HttpClientRequest

Deployment server not deploying apps to cluster ma...

I need a search to find mapping of roles to AD Gro...

Need assistance getting large data into Splunk

Re: I need to get the average daily GB usage per i...

I need to get the average daily GB usage per index...

I have a customer who's logs are coming out binary...

Need to schedule Dashboard for PDF delivery