Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About auraria1
auraria1
Path Finder
Member since:
07-18-2018
05-07-2021
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 07-18-2018 |
Activity Feed
- Got Karma for Re: Can I use regex within an IF statement?. 06-26-2022 11:54 PM
- Posted Microsoft Cloud Services post app upgrade for 8.0 no longer collecting logs on All Apps and Add-ons. 05-07-2021 06:39 AM
- Posted Re: Can you help me come up with a brutal but clever Date and Time Parsing? on Getting Data In. 10-03-2018 07:50 AM
- Posted Re: need help with eval query on Splunk Search. 07-20-2018 06:37 AM
- Posted Re: need help with eval query on Splunk Search. 07-20-2018 06:26 AM
- Posted Re: need help with eval query on Splunk Search. 07-20-2018 06:21 AM
- Posted Re: Transaction very slow on Splunk Search. 07-20-2018 06:05 AM
- Posted Re: Transaction very slow on Splunk Search. 07-20-2018 05:36 AM
- Posted Re: how to hide an emtpy value field on Security. 07-20-2018 05:31 AM
- Posted Re: need help with eval query on Splunk Search. 07-20-2018 05:05 AM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-20-2018 04:15 AM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 12:54 PM
- Posted Re: UF not connected with DS on Splunk Cloud Platform. 07-19-2018 12:43 PM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 12:33 PM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 12:22 PM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 12:20 PM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 11:57 AM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 11:45 AM
- Posted Re: ERROR TcpOutputProc - LightWeightForwarder/UniversalForwarder not configured. Please configure outputs.conf. on Deployment Architecture. 07-19-2018 11:25 AM
- Posted Re: Why am I getting null values when applying multivalue commands on a transaction field? on Splunk Search. 07-19-2018 11:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
05-07-2021
06:39 AM
Running into a strange issue where after upgrading my Heavy Forwarder to 8.1.3 and subsequently the Microsoft Cloud Services app to a supported version(4.1.2 and have tried 4.1.1) it is no longer collecting logs. Giving a subscription id cannot be found error. I've re-setup the account and the authentication works fine(I've tested by changing a number or letter in the tenant ID and threw a error) in the configuration tab. I've tried using both the Object ID and the Application ID and it gives these errors: mscs_api_error.APIError: "status=404, error_code=SubscriptionNotFound, error_msg=The subscription '7f3c89aa-1767-429f-ade2-8f38d67426b3' could not be found." mscs_api_error.APIError: "status=404, error_code=SubscriptionNotFound, error_msg=The subscription 'cbe4be6e-142f-4c52-acaf-92671bd8c6e4' could not be found." Any ideas?
... View more
Labels
- Labels:
-
troubleshooting
10-03-2018
07:50 AM
I think you may be on the right track by breaking down the values.
| rex field=MyInconsistentDateTimeField "^(?[\d]+)\/.*"
| rex field=MyInconsistentDateTimeField "^[\d]+\/(?[\d]+)\/.*"
| rex field=MyInconsistentDateTimeField "^[\d]+\/[\d]+\/(?[\d]+)\/.*"
| rex field=MyInconsistentDateTimeField ".(?[\d]+):."
| rex field=MyInconsistentDateTimeField ".:(?[\d]+)."
| fields MyInconsistentDateTimeField, day1, month1, year1, hour1, minute1
check that and see if it grabbed the right values, from that you can build on it as you need.
... View more
07-20-2018
06:37 AM
Is subject in it's own field? if not this makes it a bit more difficult.
You can create a subject field using the following:
| rex field=_raw "Subject:\s(?.*)Content-Type" | stats count by Subject | sort - count
If so it'll make searching wayyyyyy easier, you can add this to a field extraction so this is done by splunk.
In regards to your other question, are you specifically looking for only emails with fw: Order Inquiry as a subject to compare number of emails coming in? Or all subjects?
... View more
07-20-2018
06:21 AM
Wait I think I misunderstood the original question, is the issue that the regex isn't matching properly?
Is that why you're having issues with the hardcoded regex?
Can you provide 2-3 example email subjects so I can take a look and see why it isn't working?
... View more
07-20-2018
06:05 AM
gotcha, is there anything else that you can filter on that you're specifically looking for in the main search?
Also you can remove the parens around the PERF_TYPE OR search. Don't think that'll make a difference though.
Are these going to a specific index you can filter on? Generally doing index and sourcetype/host is faster.
... View more
07-20-2018
05:36 AM
Can you move the search eventcount=2 status=SUCCESS into the main query or is that info dictated by the transaction?
That should help speed due to the fact you'll be transacting more logs, then performing a search on that.
Searching is a lot less resource intensive than transaction, so if you limit the amount of results prior it should help the transaction speed as well.
Does that make sense?
... View more
07-20-2018
05:31 AM
There's a couple of ways to go about this depending on how you want to view the data.
If you simply want to only show results from a field that are not null it's as simple as:
index=your_index field!="NULL"
Another way is
index=your_index field="*"
However if you're trying to make a table that won't work for you, you can use fillnull to change the value to empty
| fillnull value="empty" field1
For multiple fields you have to do multiple fillnull statements such as:
| fillnull value="empty" field1
| fillnull value="empty" field2
| fillnull value="empty" field3
Then once you have that you can filter based on the value of empty in that field.
Does that help? Or could you give a bit more detail on what you're trying to do.
... View more
07-20-2018
05:05 AM
Wouldn't it be easier to just do a where modifier and by stats?
Try the below, this will create a new field called subject, count based on the subject name, and show only results with more than 2 events.
source=* dest_port=25
| rex field=src_content max_match=0 "(?PSubject: Fw: Order Inquiry)"
| stats count by Subject
| where count > 2
... View more
07-20-2018
04:15 AM
You're welcome! there is nowebui on the forwarder.
... View more
07-19-2018
12:54 PM
That wouldn't effect the outputs.conf issue.
Comment this out in the outputs.conf:
from this:
[tcpout-server://12.34.342.87:9997]
to this:
[tcpout-server://12.34.342.87:9997]
And try again.
... View more
07-19-2018
12:43 PM
Able to ping between the troubled host and the DS?
Can you check netstat on both machines/tcpdump to see what's going on with the networking side of things?
... View more
07-19-2018
12:33 PM
I would just change ownership to all the files and folders as it can cause issues in the future in the splunkforwarder directory.
Did the bracket and the disabled = 0 fix the issue or is it still persisting?
... View more
07-19-2018
12:22 PM
Good call,
@ahmemohs03 I'd run a chown on the entire directory for the dedicated splunk user,
chown splunk:splunk -R /opt/splunkforwarder/
Swap out splunk for the user running splunk.
... View more
07-19-2018
12:20 PM
It doesn't hurt.
After that try starting the forwarder again and let me know.
... View more
07-19-2018
11:57 AM
as @patilsonali1729 please post the btool debug output.
Under [tcpout:default-autolb-group]
add:
disabled = 0
This shouldn't be an issue however.
Also add the close bracket ( ] )to
so this
[tcpout-server://12.34.342.87:9997
to this
[tcpout-server://12.34.342.87:9997]
^This is also not needed as you specified the server and the output in the default autolb group.
... View more
07-19-2018
11:45 AM
When you created your outputs.conf where did you place the file?
Should be:
/directory to splunk/splunkforwarder/etc/system/local/outputs.conf
Be sure it says outputs.conf and not output.conf.
... View more
07-19-2018
11:25 AM
Both need to be running for logs to be indexed.
I'd try restarting the forwarder:
/directory to splunk/splunkforwarder/bin/splunk stop
/directory to splunk/splunkforwarder/bin/splunk start
Then check the splunkd logs, let me know if that fixes the issue.
Quick tip on troubleshooting and splunkd logs, rename the log to splunkd1 before starting the splunk forwarder and increase the number everytime so it creates a fresh log and you can compare the two.
... View more
07-19-2018
11:05 AM
If I'm understanding the question right, you're trying to have the field that contains the value of either 0 or 1 return like a true/false statement?
If so I do an eval statement:
| eval value1 = case(value==1,"true","false")
Then chart based on value1.
If you're trying to only show events if a user has a 1 associated to it, I'd honestly just add:
NOT 0
Or,
value!="0" OR value="1"
Is that what you're looking for?
... View more
07-19-2018
10:54 AM
Is this your first time starting this splunk forwarder?
I've add issues after running accept license where I need to stop the splunk instance and re-start it on versions 7.1 and above.
... View more
07-19-2018
10:46 AM
No problem, glad I could help.
Evals can be a bit tricky, always a fun time working through those switches.
... View more
07-18-2018
12:26 PM
1 Karma
The way I do it is with match.
| eval output = if(match(Object,"regex goes here"),"false", "empty")
Or something along those lines.
Does that make sense or help?
... View more
07-18-2018
12:20 PM
This has already been answered but you can also use the replace function.
| eval time=replace(AUDIT_CREATED_TS, ":","/")
This will replace the colons in that field with forward slashes and place the output into a field called time.
... View more
