Hello @harsmarvania57, thanks for your reply but in this moment i dont have backend server access. Thanks and regards ... View more

Hello Niketnilay, thanks for your aswers, but I am looking for the installer for the mobile device and not the Add On for the Splunk application. I have already installed this one into my Splunk App and I am able to access some dashboards via some mobile device, but now I would like to access the existing Dashboards via others mobile device but I am not finding anymore the installer for IOS and ANDROID. ... View more

Hello Niketnilay, Many thanks for your post. I have used your CSS for SPAN and works fine. Just a question: I didnt understand the usage of the status indicator in your sample and about the depends="$awlaysHideStatusIndicatorPanel$"....really didnt got your point. Thanks, Pavan ... View more

Hello Niketnilay, any help? Thanks!! ... View more

Hello Azeemering, Below we have the props and transform files: PROPS. [sourcetype] TRUNCATE = 10000 DATETIME_CONFIG = LINE_BREAKER = (= User Time (Seconds) : \d+\n= \w{3} \d{2}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2} [A-Z]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false BREAK_ONLY_BEFORE_DATE = false TIME_PREFIX = = [A-Z][a-z]+\s TIME_FORMAT = %m/%d/%y %H:%M:%S %Z SEDCMD-applychange01=s/[\r\n]\s*[A-z]+.+//g SEDCMD-applychange02=s/(**+.)//g SEDCMD-applychange04=s/(+++.)//g SEDCMD-applychange05=s/(==+[\r\n]*)//g TRANSFORMS-set= setNullJob,setParsingJob TRANSFORM [setNullJob] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setParsingJob] REGEX = R3BRP#DECOUPLE_NFE DEST_KEY = queue FORMAT = indexQueue Then we have sample of log file that is being read by SPLUNK: =============================================================== = JOB : R3BRP#DECOUPLE_NFE[(0006 12/27/17),(0AAAAAAAAAAIO5A6)].CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01 = USER : tws 631/S/*ATHOCO/IBM/AUTOMATION_COORD_HORTOLANDIA/ = JCLFILE : / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a = Job Number: 64684184 = Wed 12/27/17 09:35:39 BRST +++ IBM Tivoli Workload Scheduler for Applications, method R3BATCH 8.5.0 (patchrev 1 - 16:42:24 Jun 13 2014) +++ is called with following parameters: +++ -t LJ -c R3BRP,SAPECCPINST1,ACSXTWS02 -n 172.22.8.248 -p 31111 -r 1961,1961 -s 0AAAAAAAAAAIO5A6 -d 20171227,1514332800 -l twsuser1 -o /amb/local/tws/sapeccpinst1/TWS/stdlist/2017.12.27/O64684184.0935 -j CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01,64684184 -- / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a +++ EEWO1031I The Tivoli Workload Scheduler home directory was found: ./.. +++ EEWO1027I The RFC connection is established: (1) +++ EEWO1023I Started the R/3 job at the following date and time: 12/27-09:35 : IFIPD_DECOUPLE_NFE, 09354300 Wed Dec 27 09:35:40 2017 +++ EEWO1007I The job status has been set to EXEC: IFIPD_DECOUPLE_NFE 09354300 +++ EEWO1006I Job status: IFIPD_DECOUPLE_NFE 09354300 FINISHED +++ EEWO1061I Job IFIPD_DECOUPLE_NFE with job ID 09354300 was executed on SAP application server XXXXXXXXXXX. +++ EEWO1048I Retrieving the joblog of a job:: IFIPD_DECOUPLE_NFE , 09354300 *** WARNING 914 *** EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 09354300. *** WARNING 904 *** EEWO0904W The program could not copy the joblog to stdout. *** WARNING 914 *** EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 09354300. +++ EEWO1012I BDC sessions are complete at: 12/27-09:36 : 0 +++ EEWO1017I The job completed normally at the following date and time: 12/27-09:36 = Exit Status : 0 = System Time (Seconds) : 0 Elapsed Time (Minutes) : 0 = User Time (Seconds) : 0 = Wed 12/27/17 09:36:18 BRST ... View more

Hello Azeemering, thanks for your return. However I can see that my events have only 33 lines. Actually i am reading log files that contains 33 lines each one, so my events will have only 33 lines. Dont understand the reason for the event cut into blocks of 1000 lines. My log file contains several dates/times, so I dont want to have the event cut in the timestamping. Thanks and regards, Danillo Pavan ... View more

Hello Niketnilay, Just noted that when I use "defaultTokenModel = mvc.Components.getInstance('submitted')", I got the error in the next line "defaultTokenModel.on("change:status_execucao", function(newTokenName, status_execucao, options)" because the variable defaultTokenModel is not yet setted. And when I use "defaultTokenModel = mvc.Components.getInstance('default')", i am not facing the issue however the tokens are not yet setted, so i am not able to retrieve the values. Probably it is happening because there is not enough time to load this code while the search is not yet finished. How I can do to load continue the execution of the code only when the search is finished? Thanks and regards, Danillo Pavan ... View more

Hi, yes I am using HTML with jQuery (splunk version 6.4). My HTML is similar to the one that you posted above. Not sure if the query is running correctly. Is there any way to ensure the value of the token? About the java script file, I need to retrieve the token value to display the value in a element that I have created using jquery/bootstrap... How can I get it? var status_execucao = document.getElementById('status_execucao'); Not working... ... View more

Hello Niketnilay, thanks for your support. I have tried to use the commands however it is appearing the error message: Uncaught TypeError: Cannot read property 'get' of undefined I have included the below dependencies: require(['jquery','splunkjs/mvc','backbone'], function($) { and the commands: var mvc = require("splunkjs/mvc"); var defaultTokenModel = mvc.Components.get("default"); ... View more

Original log file: =============================================================== = JOB : R3BRP#DECOUPLE_NFE[(0006 01/06/18),(0AAAAAAAAAAIROIP)].CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01 = USER : XXX 631/S/*ATHOCO/IBM/AUTOMATION_COORD_HORTOLANDIA/ = JCLFILE : / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a = Job Number: 47383116 = Sat 01/06/18 17:10:57 BRST +++ IBM Tivoli Workload Scheduler for Applications, method R3BATCH 8.5.0 (patchrev 1 - 16:42:24 Jun 13 2014) +++ is called with following parameters: +++ -t LJ -c R3BRP,SAPECCPINST1,ACSXTWS02 -n 172.22.8.248 -p 31111 -r 1971,1971 -s 0AAAAAAAAAAIROIP -d 20180106,1515196800 -l twsuser1 -o /amb/local/tws/sapeccpinst1/TWS/stdlist/2018.01.06/O47383116.1710 -j CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01,47383116 -- / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a +++ EEWO1031I The Tivoli Workload Scheduler home directory was found: ./.. +++ EEWO1027I The RFC connection is established: (1) +++ EEWO1023I Started the R/3 job at the following date and time: 01/06-17:11 : IFIPD_DECOUPLE_NFE, 17105901 Sat Jan 6 17:10:57 2018 +++ EEWO1007I The job status has been set to EXEC: IFIPD_DECOUPLE_NFE 17105901 +++ EEWO1006I Job status: IFIPD_DECOUPLE_NFE 17105901 FINISHED +++ EEWO1061I Job IFIPD_DECOUPLE_NFE with job ID 17105901 was executed on SAP application server XXXXX_YYYYYY_PPPPPPP. +++ EEWO1048I Retrieving the joblog of a job:: IFIPD_DECOUPLE_NFE , 17105901 WARNING 914 EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 17105901. WARNING 904 EEWO0904W The program could not copy the joblog to stdout. WARNING 914 EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 17105901. +++ EEWO1012I BDC sessions are complete at: 01/06-17:11 : 0 +++ EEWO1017I The job completed normally at the following date and time: 01/06-17:11 = Exit Status : 0 = System Time (Seconds) : 0 Elapsed Time (Minutes) : 0 = User Time (Seconds) : 0 = Sat 01/06/18 17:11:32 BRST Props file [logJobsSAP] TRUNCATE = 10000 MAX_EVENTS = 1000 SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = junkfood BREAK_ONLY_BEFORE_DATE = False DATETIME_CONFIG=CURRENT TRANSFORMS-set= setNullJob,setParsingJob Transform file: [setNullJob] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setParsingJob] REGEX = R3BRP#DECOUPLE_NFE DEST_KEY = queue FORMAT = indexQueue About the events, sometimes it is indexing all 33 lines, sometimes it is indexing 27 lines (truncating in line date) and sometimes it is indexing 14 lines(again in line date)... 27 lines: =============================================================== = JOB : R3BRP#DECOUPLE_NFE[(0006 01/13/18),(0AAAAAAAAAAIT7MZ)].CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01 = USER : tws 631/S/*ATHOCO/IBM/AUTOMATION_COORD_HORTOLANDIA/ = JCLFILE : / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a = Job Number: 5178738 = Sat 01/13/18 00:28:07 BRST +++ IBM Tivoli Workload Scheduler for Applications, method R3BATCH 8.5.0 (patchrev 1 - 16:42:24 Jun 13 2014) +++ is called with following parameters: +++ -t LJ -c R3BRP,SAPECCPINST1,ACSXTWS01 -n 172.22.8.248 -p 31111 -r 1978,1978 -s 0AAAAAAAAAAIT7MZ -d 20180113,1515801600 -l twsuser1 -o /amb/local/tws/sapeccpinst1/TWS/stdlist/2018.01.13/O5178738.0028 -j CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01,5178738 -- / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a +++ EEWO1031I The Tivoli Workload Scheduler home directory was found: ./.. +++ EEWO1027I The RFC connection is established: (1) +++ EEWO1023I Started the R/3 job at the following date and time: 01/13-00:28 : IFIPD_DECOUPLE_NFE, 00281001 Sat Jan 13 00:28:08 2018 +++ EEWO1007I The job status has been set to EXEC: IFIPD_DECOUPLE_NFE 00281001 +++ EEWO1006I Job status: IFIPD_DECOUPLE_NFE 00281001 FINISHED +++ EEWO1061I Job IFIPD_DECOUPLE_NFE with job ID 00281001 was executed on SAP application server XXXXXXXXXXXXXXX. +++ EEWO1048I Retrieving the joblog of a job:: IFIPD_DECOUPLE_NFE , 00281001 *** WARNING 914 *** EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 00281001. *** WARNING 904 *** EEWO0904W The program could not copy the joblog to stdout. *** WARNING 914 *** EEWO0914W An internal error has occurred. Either the joblog or the job protocol for the following job does not exist: Job name: IFIPD_DECOUPLE_NFE Job ID: 00281001. +++ EEWO1012I BDC sessions are complete at: 01/13-00:28 : 0 +++ EEWO1017I The job completed normally at the following date and time: 01/13-00:28 14 lines = JOB : R3BRP#DECOUPLE_NFE[(0006 01/13/18),(0AAAAAAAAAAIT7MZ)].CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01 = USER : tws 631/S/*ATHOCO/IBM/AUTOMATION_COORD_HORTOLANDIA/ = JCLFILE : / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a = Job Number: 36833578 = Sat 01/13/18 00:29:11 BRST +++ IBM Tivoli Workload Scheduler for Applications, method R3BATCH 8.5.0 (patchrev 1 - 16:42:24 Jun 13 2014) +++ is called with following parameters: +++ -t LJ -c R3BRP,SAPECCPINST1,ACSXTWS01 -n 172.22.8.248 -p 31111 -r 1978,1978 -s 0AAAAAAAAAAIT7MZ -d 20180113,1515801600 -l twsuser1 -o /amb/local/tws/sapeccpinst1/TWS/stdlist/2018.01.13/O36833578.0029 -j CL_S09_IFIPD_DECOUPLE_NFE_R3BRP_01,36833578 -- / -job IFIPD_DECOUPLE_NFE -user FF_PRO1 -i 23154800 -c a +++ EEWO1031I The Tivoli Workload Scheduler home directory was found: ./.. +++ EEWO1027I The RFC connection is established: (1) +++ EEWO1023I Started the R/3 job at the following date and time: 01/13-00:29 : IFIPD_DECOUPLE_NFE, 00291400 Sat Jan 13 00:29:11 2018 ... View more

Hi lmaclean, I have removed all the SEDCMD and all others properties just keeping the below configuration and it is still not working. Now of course it is bringing sometimes all the 33 lines (entire file) however sometimes it is being truncate in the date line: Props: [sourcetype] TRUNCATE = 10000 BREAK_ONLY_BEFORE=junkfood BREAK_ONLY_BEFORE_DATE = False DATETIME_CONFIG=CURRENT TRANSFORMS-set= setNullJob,setParsingJob ... View more

Hi @alemarzu, I have removed all the SEDCMD and all others properties just keeping the below configuration and it is still not working. Now of course it is bringing sometimes all the 33 lines (entire file) however sometimes it is being truncate in the date line: Props: [sourcetype] TRUNCATE = 10000 BREAK_ONLY_BEFORE=junkfood BREAK_ONLY_BEFORE_DATE = False DATETIME_CONFIG=CURRENT TRANSFORMS-set= setNullJob,setParsingJob ... View more

Sorry, @alemarzu. I didnt get your orientation.. ... View more

I have removed the BREAK_ONLY_BEFORE, but it still truncating the file...now executing the debug command, got the below result: UTO_KV_JSON = true BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = false CHARSET = UTF-8 DATETIME_CONFIG = EXTRACT-endTimeExecution = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\s+-\w+\s+\w+\w+\w+\s+-\w+\s+\w+\w+\d+\s+-\w+\s+\d+\s+-\w+\s+\w+\s+=\s+\w+\s+\w+:\s+\d+\s+=\s+\w+\s+\d+/\d+/\d+\s+\d+:\d+:\d+\s+\w+\s+=\s+\w+\s+\w+\s+:\s+\d+\s+=\s+\w+\s+\w+\s+(\w+)\s+:\s+\d+\s+\w+\s+\w+\s+(\w+)\s+:\s+\d+\s+=\s+\w+\s+\w+\s+(\w+)\s+:\s+\d+\s+=\s+\w+\s+\d+/\d+/\d+\s+(?P[^ ]+) EXTRACT-jobName = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\s+-\w+\s+(?P[^ ]+) EXTRACT-jobNumber = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\s+-\w+\s+\w+\w+\w+\s+-\w+\s+\w+_\w+\d+\s+-\w+\s+\d+\s+-\w+\s+\w+\s+=\s+\w+\s+\w+:\s+(?P\d+) HEADER_MODE = LEARN_SOURCETYPE = true LINE_BREAKER = (= User Time (Seconds) : \d+\n= \w{3} \d{2}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2} [A-Z]+) LINE_BREAKER_LOOKBEHIND = 100 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 128 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = NO_BINARY_CHECK = true SEDCMD-applychange01 = s/[\r\n]\s*[A-z]+.+//g SEDCMD-applychange02 = s/(**+.)//g SEDCMD-applychange04 = s/(+++.)//g SEDCMD-applychange05 = s/(==+[\r\n]*)//g SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = false TIME_FORMAT = %m/%d/%y %H:%M:%S %Z TIME_PREFIX = = [A-Z][a-z]+\s TRANSFORMS = TRANSFORMS-set = setNullJob,setParsingJob TRUNCATE = 10000 detect_trailing_nulls = false disabled = false maxDist = 100 priority = pulldown_type = true ... View more

Hello alemarzu, Actually the props file was edited in my last post. The correct SEDCMD is: "SEDCMD-applychange01=s/[\r\n]\s*[A-z]+.+//g" "SEDCMD-applychange02=s/(**+.)//g" "SEDCMD-applychange04=s/(+++.)//g" "SEDCMD-applychange05=s/(==+[\r\n]*)//g" It is missing the "\" in the last post. About the command debug, I executed it and got the below result: ANNOTATE_PUNCT = True AUTO_KV_JSON = true BREAK_ONLY_BEFORE = (= User Time (Seconds) : \d+\n= \w{3} \d{2}\/\d{2}\/\d{2}\d{2}:\d{2}:\d{2} [A-Z]+) BREAK_ONLY_BEFORE_DATE = True CHARSET = UTF-8 DATETIME_CONFIG = EXTRACT-endTimeExecution = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\ s+-\w+\s+\w+\w+\w+\s+-\w+\s+\w+\w+\d+\s+-\w+\s+\d+\s+-\w+\s+\w+\s+=\s+\w+\s+\w+:\s+\d+\s+=\s+\w+\s+\d+/\d+/\d+\s+\d+:\ d+:\d+\s+\w+\s+=\s+\w+\s+\w+\s+:\s+\d+\s+=\s+\w+\s+\w+\s+(\w+)\s+:\s+\d+\s+\w+\s+\w+\s+(\w+)\s+:\s+\d+\s+=\s+\w+\s+\w+\s+ (\w+)\s+:\s+\d+\s+=\s+\w+\s+\d+/\d+/\d+\s+(?P[^ ]+) EXTRACT-jobName = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\s+-\w+\s +(?P[^ ]+) EXTRACT-jobNumber = ^=\s+\w+\s+:\s+\w+\d+\w+#\w+\w+[(\d+\s+\d+/\d+/\d+),(\d+\w+)].\w+\w+\d+\w+\w+\w+\w+\d+\w+\d+\s+=\s+\w+\s+:\s+\w+\s+\d+/\w+/*\w+/\w+/\w+\w+\w+/\s+=\s+\w+\s+:\s+/\s+-\w+ \s+\w+\w+\w+\s+-\w+\s+\w+_\w+\d+\s+-\w+\s+\d+\s+-\w+\s+\w+\s+=\s+\w+\s+\w+:\s+(?P\d+) HEADER_MODE = LEARN_SOURCETYPE = true LINE_BREAKER = (= User Time (Seconds) : \d+\n= \w{3} \d{2}\/\d{2}\/\d{2}\d{2}:\d{2}:\d{2} [A-Z]+) LINE_BREAKER_LOOKBEHIND = 100 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 128 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = NO_BINARY_CHECK = true SEDCMD-applychange01 = s/[\r\n]\s*[A-z]+.+//g SEDCMD-applychange02 = s/(**+.)//g SEDCMD-applychange04 = s/(+++.)//g SEDCMD-applychange05 = s/(==+[\r\n]*)//g SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard SHOULD_LINEMERGE = false TIME_FORMAT = %m/%d/%y %H:%M:%S %Z TIME_PREFIX = = [A-Z][a-z]+\s TRANSFORMS = TRANSFORMS-set = setNullJob,setParsingJob TRUNCATE = 1000000 detect_trailing_nulls = false disabled = false maxDist = 100 priority = pulldown_type = true sourcetype = ... View more

Hello garethatiag, I have posted all log file, props file and transform file in some posts below yesterday. How can I execute this debug command on the btool props? I really dont know... ... View more

I have returned the configuration to TRUNCATE=1000 - still not working ... View more