Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About robertosegantin
robertosegantin
Path Finder
Member since:
03-22-2018
04-14-2022
Community Statistics
| Posts | 32 |
| Solutions | 3 |
| Karma Given | 3 |
| Karma Received | 6 |
| Member Since | 03-22-2018 |
Activity Feed
- Got Karma for Re: SplunkJS Search Manager collect twice same event. 04-14-2022 06:38 AM
- Karma Re: Transaction starts with ends with for woodcock. 03-30-2021 01:49 AM
- Got Karma for Re: SHOULD_LINEMERGE from HEC props.conf. 10-29-2020 03:27 AM
- Got Karma for SHOULD_LINEMERGE from HEC props.conf. 10-29-2020 03:27 AM
- Posted Re: SHOULD_LINEMERGE from HEC props.conf on Splunk Enterprise. 10-29-2020 01:59 AM
- Posted SHOULD_LINEMERGE from HEC props.conf on Splunk Enterprise. 10-28-2020 10:01 AM
- Tagged SHOULD_LINEMERGE from HEC props.conf on Splunk Enterprise. 10-28-2020 10:01 AM
- Karma Re: Error in splunkd.log: Breaking event because limit of 256 has been exceeded for yannK. 10-27-2020 06:23 AM
- Karma Re: Export to csv on click of button for gaurav_maniar. 09-17-2020 01:03 AM
- Got Karma for Forwarder stop reads monitored logs after restart. 06-05-2020 12:50 AM
- Got Karma for Re: SplunkJS Search Manager collect twice same event. 06-05-2020 12:49 AM
- Got Karma for Re: Uncaught Error: Already have instance with id: in splunk. 06-05-2020 12:48 AM
- Posted Re: base64 decoding in search on Splunk Search. 08-23-2019 01:58 AM
- Posted Re: send to nullqueue events which have more than 100 lines on Getting Data In. 08-22-2019 08:04 AM
- Posted Re: send to nullqueue events which have more than 100 lines on Getting Data In. 08-19-2019 01:16 AM
- Posted Re: send to nullqueue events which have more than 100 lines on Getting Data In. 08-07-2019 06:30 AM
- Posted send to nullqueue events which have more than 100 lines on Getting Data In. 08-06-2019 01:11 AM
- Tagged send to nullqueue events which have more than 100 lines on Getting Data In. 08-06-2019 01:11 AM
- Tagged send to nullqueue events which have more than 100 lines on Getting Data In. 08-06-2019 01:11 AM
- Posted Forwarder stop reads monitored logs after restart on Getting Data In. 10-26-2018 06:41 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-29-2020
01:59 AM
1 Karma
To be more clear I update the events indexed: I need to merge all these events received via HEC. If I read these events in a classical way, via log reading, with a more simple configuration, Splunk is able to merge them: I hope that is not a limit about HEC method. Thanks
... View more
10-28-2020
10:01 AM
1 Karma
On Kubernetes environment there is installed Fluentd Splunk plugin which sends to Heavy Forwarder, via HEC, the standard output application logs. The standard output application logs are not structured and I'm not able to apply line merge to them. My input.conf is: [http://k8s_hec] disabled = 0 index = em_events source = em_metrics token = aaaaaaaa-bbbb-cccc-dddd-fffffffffff Fluentd defined many sourcetypes, and all custom applications sourcetypes end with "app"; for example: kube:container:goofy-app kube:container:donald-duck-app So I defined these two configurations in props.conf inside my HF, but I'm not able to merge events: [kube:container:*-app] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=30 disabled=false TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N TIME_PREFIX=^ MAX_EVENTS=1024 [source::k8s_hec] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=30 disabled=false TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N TIME_PREFIX=^ MAX_EVENTS=1024 Someone can help me?
... View more
Labels
- Labels:
-
configuration
08-22-2019
08:04 AM
Hi @DavidHourani,
found the golden path! 😄
[my_sourcetype]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=45
disabled=false
LINE_BREAKER =(<\/s:Envelope>)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4Q
TIME_PREFIX=(<\/s:Envelope>[\r\n]+)?[
TRUNCATE=3000
Thanks for your help!
... View more
08-19-2019
01:16 AM
Hi @DavidHourani,
sorry for late replay.
The problem is that "TRUNCATE" and "TRANSFORMS" seem to work on single line, and they work before "SHOULD_LINEMERGE", which is true by default.
In this way, when Splunk merges 150 xml lines into one event, the "TRUNCATE" and "TRANSFORMS" option work on single line, which has less than 100 lines (is only one!) and is less than 5000 byte
Have I done some mistake?
Thanks!
... View more
08-07-2019
06:30 AM
Hi @DavidHourani ,
thanks for your answer.
I tried:
== props.conf ==
[my]
CHARSET = UTF-8
KV_MODE = xml
MAX_EVENTS = 100000
MAX_TIMESTAMP_LOOKAHEAD = 28
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4Q
TIME_PREFIX = ^[
category = Custom
disabled = false
pulldown_type = true
TRANSFORMS-nullqueue_more_than_100_lines = nullqueue_more_than_100_lines
== transforms.conf ==
[nullqueue_more_than_100_lines]
REGEX = (.*(\n|\r)){100,}
DEST_KEY = queue
FORMAT = nullQueue
But it does not send events with more than 100 lines to nullqueue.
I also tried with TRUNCATE=5000, but is does not work, too
Cheers,
Roberto
... View more
08-06-2019
01:11 AM
I have an XML file which has events made by many rows.
I would like to send to null queue the events which have more than 100 rows.
How can I do that?
... View more
10-26-2018
06:41 AM
1 Karma
Hi to all,
I have several Forwarders on Windows that monitor more than 20k items each (folder and logs inside them).
In total I'm monitoring more than 200k logs.
This is my inputs.conf deployed on those forwarders:
[monitor://c:\FirstFolder\Log\service\System\20*\PROXY\...]
disabled = false
index=my_index
sourcetype=proxy
alwaysOpenFile=1
[monitor://c:\\FirstFolder\Log\service\System\20*\00*\*.log]
disabled = false
index=my_index
sourcetype=process
alwaysOpenFile=1
[monitor://c:\\FirstFolder\Log\service\System\20*\00*.log]
disabled = false
index=my_index
sourcetype=device
alwaysOpenFile=1
[monitor://c:\\FirstFolder\Log\service\System\20*\ERROR_*.log]
disabled = false
index=main
sourcetype=error
alwaysOpenFile=1
When I restart the forwarders, they does not monitor anymore the files that the forwarders read before, even if the log files will be written after the restart.
... View more
10-10-2018
01:28 AM
I've found the solution:
on cluster environment, the app uses only local configuration ignoring the default ones!
... View more
10-09-2018
07:50 AM
Hello,
I downloaded the TA-prtg app on my PC with Splunk Free edition and it works!
Unfortunately, when I deploy it on Splunk Enterprise distributed Environment, via Deployment Server, Splunk returns the error "Search Factory: Unknown search command"
Which is the right deply or configuration?
Regards
... View more
09-18-2018
02:12 AM
I'm on Splunk Enterprise 6.6.1.
I run this search
| makeresults
| eval _time=now()
| bucket span=1d _time
| eval value=1
| sistats avg(value) as value by _time
But I'm not able to save its result to summary index.
I've also tried to run it inside a report, which I've run it manually, but I obtained the same behaviour.
Why?
... View more
07-16-2018
04:07 AM
On my test environement I configured and index like this:
[prove_di_cold]
homePath = /root/splunk_hot/prove_di_cold/db
coldPath = /root/splunk_cold/prove_di_cold/colddb
thawedPath = /root/splunk_cold/prove_di_cold/thaweddb
maxWarmDBCount=1
maxDataSize = 1000
maxHotSpanSecs = 40
frozenTimePeriodInSecs = 100
rotatePeriodInSecs = 60
bucketRebuildMemoryHint = 0
coldToFrozenDir = /root/splunk_frozen/prove_di_cold
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair = 1
enableTsidxReduction = 0
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
But splunk never copy any data from hot/warm path to cold or freeze path
Have you got any other information about it?
Thanks
... View more
05-29-2018
01:08 AM
2 Karma
@niketnilay, I used you advice to invert the solution: via javascript I set the search defined on SimpleXML.
dashboard:
<dashboard script="test.js">
<init>
<set token="fake">1</set>
<set token="ricerca">-1</set>
</init>
<search>
<query>
$ricerca$
</query>
<done>
<eval token="fake">now()</eval>
</done>
</search>
<label>foo</label>
<row>
<panel>
<html>
<div id="popup_mail_tipologia"/>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=test sourcetype="testsource" | eval fake=$fake$ | fields - fake</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
test.js
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
"splunkjs/mvc/timerangeview",
'splunkjs/mvc/simplexml/ready!'
], function (_, $, mvc, TableView, TimeRangeView) {
var epoch = (new Date).getTime();
var DropdownType = require("splunkjs/mvc/dropdownview");
var dropdownTypeEvent = new DropdownType({
id: "DropdownType" + epoch,
default:
"",
el: $("#popup_mail_tipologia")
}, {
tokens: true
}).render();
var choices = [{
label: "1",
value: "1"
}, {
label: "2",
value: "2"
}
];
splunkjs.mvc.Components.getInstance("DropdownType" + epoch).settings.set("choices", choices);
dropdownTypeEvent.on('change', function (properties) {
var o=splunkjs.mvc.Components.getInstance("DropdownType" + epoch)
save_search = _.template(
'| makeresults ' +
'| eval myfield="x" ' +
'| eval myFiledFromEvent="<%- ev %>" ' +
'| collect index=test sourcetype="testsource"', {
ev: o.val()
});
var defaultTokenModel = mvc.Components.get("default").set("ricerca", save_search);
var submittedTokenModel = mvc.Components.getInstance('submitted').set("ricerca", save_search);
});
});
... View more
05-22-2018
02:48 AM
@niketnilay, sorry for lat answer.
I'm attaching simpleXML code and Javascript code.
When I change the dropdown, it runs a search which collects data into an index.
Unfortunately it collects twice the same event.
As you can see there no complex elaboration
On Splunk 6.6.1 running it on a SH which is in cluster.
Let me know if need more information
Thanks for your help
This is simpleXML:
<dashboard script="js/test.js">
<init>
<set token="fake">1</set>
</init>
<label>foo</label>
<row>
<panel>
<html>
<div id="popup_mail_tipologia"/>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=test sourcetype="testsource"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
Javscript code:
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
"splunkjs/mvc/timerangeview",
'splunkjs/mvc/simplexml/ready!'
], function (_, $, mvc, TableView, SearchManager, TimeRangeView) {
var SearchManager = require("splunkjs/mvc/searchmanager");
var ricerca = '| makeresults ';
var idsearchManagerEvent = "ack_events";
var searchManagerEvent = new SearchManager({
id: "ack_events",
autostart: "false",
search: "*",
cache: "true",
timeout: 60,
enable_lookups: "true"
});
var epoch = (new Date).getTime();
var DropdownType = require("splunkjs/mvc/dropdownview");
var dropdownTypeEvent = new DropdownType({
id: "DropdownType" + epoch,
default:
"",
el: $("#popup_mail_tipologia")
}, {
tokens: true
}).render();
var choices = [{label: "1", value: "1"}, {label: "2", value: "2"}
];
splunkjs.mvc.Components.getInstance("DropdownType" + epoch).settings.set("choices", choices);
dropdownTypeEvent.on('change', function (properties) {
save_search = _.template(
'| makeresults ' +
'| eval myfield="x" ' +
'| eval myFiledFromEvent="<%- ev %>" ' +
'| collect index=test sourcetype="testsource"', {
ev: "yy"
});
console.log(save_search);
searchManagerEvent.settings.unset("search");
searchManagerEvent.settings.set("search", save_search);
searchManagerEvent.startSearch();
});
});
screenshot:
... View more
05-16-2018
07:56 AM
Hi to all,
I'm on Splunk Enterprise 6.6.1.
On a dashboard I've defined an HTML button which launch a javascript SearchManager to collect some data to an index.
Unfortunately it collects the data twice.
var idsearchManagerEvent = "ack_events" + id_random;
var searchManagerEvent = new SearchManager({
id: "ack_events" + id_random,
autostart: "false",
search: "| stats count | eval checked_by=Foo | collect index=my_index sourcetype=my_sourcetype ",
timeout: 60,
enable_lookups: "true"
});
If I check the index "my_index", I find two events identically which are written by the same javascript event.
Someone knows if this is a bug o a misconfiguration?
... View more
05-16-2018
06:09 AM
1 Karma
Hi,
the solution that I've found is to create randomically the id.
This workaround can be used for all Splunk Javascript object
For example:
var epoch=(new Date).getTime();
var Dropdown = require("splunkjs/mvc/dropdownview");
var dropdown = new Dropdown({id: "Dropdown"+epoch,
default: "",
el: $("#mydiv")
}).render();
... View more
05-14-2018
03:19 AM
I have Splunk Enterprise 6.6.1 and I've got the same issue.
Until I have the solution, I've found this workaround:
index=splunkmetrics sourcetype=queries
| fields _raw
| KV
Which Splunk version are you using?
... View more
05-10-2018
06:30 AM
In my Splunk Enterprise environment, I have many real-time searches to monitor many servers ad web applications.
Every real-time searches process about 10k events, over 5m or 10m window, and their results are displayed on a dashboard which is checked by many people and many wallboards.
Unfortunately, in last days, often the real-time searches became frozen, indeed the dashboard is not updated automatically and I have to kill and restart the processes under "Activity > Jobs"
On _internal index, or others, I'm not able to find any error or a particular warning.
Does someone have any idea how to debug this behavior?
... View more
04-16-2018
01:09 AM
@niketnilay, I've corrected some mistakes that I did, and now it works correctly.
Note that the field extracted from the last "table" inside the subsearch MUST BE "search".
So now this is my working search:
| makeresults
| eval a=80
| eval b=60
| eval result=if(
[| inputlookup conf_lookup.csv
| where servizio_nome="MY SERVICE"
| eval search=condition_KO
| table search],1,0)
Is it possibile to make something like this?
| makeresults
| eval a=80
| eval b=60
| eval service="MY SERVICE"
| eval result=if(
[| inputlookup conf_lookup.csv
| where servizio_nome="$service$"
| eval search=condition_KO
| table search],1,0)
Thanks
... View more
04-13-2018
06:43 AM
I tried to semplify your solution.
This works:
| makeresults
| eval a=1
| eval b=2
| eval result=if(
[| makeresults
| eval data="search=a<b"
| rename data as _raw
| extract pairdelim=,kvdelim="="
| table search],1,0)
But unfortunately I am on the following scenario, which does not work:
| makeresults
| eval a=1
| eval b=2
| eval c="a<b"
| eval result=if(
[| makeresults
| eval data="search=".c
| rename data as _raw
| extract pairdelim=,kvdelim="="
| table search],1,0)
... View more
04-13-2018
01:02 AM
Hi to all,
I would like to define a dynamic condition into a lookup, which uses the fields defined inside a search, ad evaluate it into a search.
[my_lookup.csv]
service,condition
my_service,a>b
This is what would like to do:
| inputlookup my_lookup.csv
| eval a=3
| eval b=4
| eval result=if(condition,1,0)
Thanks!
... View more
04-05-2018
12:24 AM
All configurations defined here are correct.
In my case Splunk does not parse correctly the props.conf because the source type that I want to process overrides, by a transforms, another one.
Given that Splunk reads once a props.conf, it does not process the source type which overrides the first
Check this case: https://answers.splunk.com/answers/636220/what-are-the-precedence-of-stanza-and-option-in-pr.htm
... View more
04-05-2018
12:19 AM
I tried also with source based stanza, but it does not work.
So Splunk read props.conf only once.
... View more
04-04-2018
06:21 AM
Hi all,
I'm monitoring a set of logs using Splunk input.
By default they have the sourcetype "others-sourcetype" and using a transform I generate, for some of them, the source type "my-sourcetype" which is generated dinamically.
Splunk reads "others-sourceytpe" props.conf stanza and it applies only "TRANSFORMS-sourcetype_override", which change correctly the sourcetype "others-sourceytpe" into "my-sourcetype", but it ignore all other configurations: LINE_BREAKER , SEDCMD-blfRemover and so on.
Also, even if Splunk change "others-sourceytpe" into "my-sourcetype" it does not use again props.conf to read "my-sourcetype" stanza, so Splunk doesn't apply any event manipulation options
Can you help me to understand which is the precedence of the props.conf stanzas and options?
props.conf:
[others-sourcetype]
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
CHARSET = UTF-8
disabled = false
TRUNCATE = 100000
LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d+\s+\w+)
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 24
SEDCMD-blfRemover = s/\x0A//g
SEDCMD-acrRemover = s/\x0D//g
TRANSFORMS-giorno=add_giorno
TRANSFORMS-sourcetype_override = others-sourcetype_logs_override
category = Custom
pulldown_type = 1
[my-sourcetype]
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
CHARSET = UTF-8
disabled = false
TRUNCATE = 100000
LINE_BREAKER = ([\r\n]+)(?=\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d+\s+\w+)
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%4N
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 24
SEDCMD-blfRemover = s/\x0A//g
SEDCMD-acrRemover = s/\x0D//g
TRANSFORMS-anno = anno
transforms.conf:
[others-sourcetype_logs_override]
REGEX = \/home\/user\/Desktop\/(.*)\/.*.log
SOURCE_KEY = MetaData:Source
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype
[add_giorno]
REGEX = (?<giorno>^\d\d\d\d-\d\d-\d\d)
FORMAT = giorno::$1
WRITE_META = true
[anno]
REGEX = (?<anno>^\d\d\d\d)
FORMAT = anno::$1
WRITE_META = true
[mese]
REGEX = (?<mese>^\d\d\d\d-\d\d)
FORMAT = mese::$1
WRITE_META = true
... View more
03-30-2018
05:57 AM
I've just found that "my_sourcetype" is generated dynamically by a transform: before I've got "others_sourcetype" and, after the transform, Splunk overwrite "others_sourcetype" with "my_sourcetype"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-14-2022
12:13 PM
|
