Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gaurav_ramteke
gaurav_ramteke
Explorer
Member since:
08-08-2018
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 08-08-2018 |
Activity Feed
- Karma Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? for sudosplunk. 06-05-2020 12:49 AM
- Karma Re: How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) for efavreau. 06-05-2020 12:49 AM
- Posted Re: How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) on Dashboards & Visualizations. 09-11-2018 04:50 AM
- Posted How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) on Dashboards & Visualizations. 09-10-2018 08:20 AM
- Tagged How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) on Dashboards & Visualizations. 09-10-2018 08:20 AM
- Tagged How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) on Dashboards & Visualizations. 09-10-2018 08:20 AM
- Tagged How do I create a dashboard visualization that is single pane, 4 statuses? : (Stopping, Stopped, Starting, Started) on Dashboards & Visualizations. 09-10-2018 08:20 AM
- Posted Splunk TA for Solaris 11: spark version having error with one of the script hardwar.sh on All Apps and Add-ons. 09-06-2018 07:49 AM
- Tagged Splunk TA for Solaris 11: spark version having error with one of the script hardwar.sh on All Apps and Add-ons. 09-06-2018 07:49 AM
- Tagged Splunk TA for Solaris 11: spark version having error with one of the script hardwar.sh on All Apps and Add-ons. 09-06-2018 07:49 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 05:38 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 05:22 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 04:33 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 03:12 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:51 AM
- Posted Re: How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:36 AM
- Posted How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:32 AM
- Tagged How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:32 AM
- Tagged How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:32 AM
- Tagged How to use regex and format strings for an XML sample without using KV_MODE=XML? on Splunk Search. 08-10-2018 02:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-11-2018
04:50 AM
Thank you efavreau
This helped me and its working now its just me to play around the colors
Much Appreciate 🙂
... View more
09-10-2018
08:20 AM
Hi Guys,
Working on one PoC and week in search commands
After extracting fields i get four search strings as given below for an individual service status
index=* sourcetype=* service_status="*Core Stopping"
index=* sourcetype=* service_status="*Core Stopped"
index=* sourcetype=* service_status="*Core Starting"
index=* sourcetype=* service_status="*Core Started"
I want to create a dashboard (visualization of the service status) (Single pane 4 status): (Stopping, Stopped, Starting, Started)
please help
Thanks and Appreciated
... View more
09-06-2018
07:49 AM
Hi Guys, I have installed a universal forwarder on a Solaris server 11 and am looking to populate the default dashboard with the Solaris app.
There are few errors I can see in the splunkd.log and would appreciate if anyone can help to resolve the same
09-06-2018 16:13:54.253 +0300 INFO ExecProcessor - New scheduled exec process: /tmp/splunkforwarder/splunkforwarder/etc/apps/Splunk_TA_solaris11/bin/hardware.sh
09-06-2018 16:14:30.029 +0300 ERROR ExecProcessor - message from "/tmp/splunkforwarder/splunkforwarder/etc/apps/Splunk_TA_solaris11/bin/hardware.sh" awk: record `HARD_DRIVES c2d0:SUN...' too long
09-06-2018 16:53:55.323 +0300 INFO ExecProcessor - New scheduled exec process: /tmp/splunkforwarder/splunkforwarder/etc/apps/Splunk_TA_solaris11/bin/hardware.sh
09-06-2018 16:54:23.281 +0300 ERROR ExecProcessor - message from "/tmp/splunkforwarder/splunkforwarder/etc/apps/Splunk_TA_solaris11/bin/hardware.sh" awk: record `HARD_DRIVES c2d0:SUN...' too long
Please let me know if you need any other details on this regards
Thanks
Gaurav
... View more
08-10-2018
05:38 AM
Thanks nittala_surya,
It worked 🙂
However, just for my knowledge is it mandatory to use "| spath" to extract the fields while we are using transformation - REGEX and FORMAT in configuration files? OR it should format the _raw events (parse)the data using props and transforms? please suggest
... View more
08-10-2018
05:22 AM
hi nittala_surya,
Same error please
Search string used
index=* sourcetype="dreamcrusher" | rex field=_raw "^\s*<([^>])>([^<\/])" | spath
Error string
Error in 'rex' command: The regex '^\s*<([^>])>([^<\/])' does not extract anything. It should specify at least one named group. Format: (?...).
The search job has failed due to an error. You may be able view the job in the Job Inspector.
... View more
08-10-2018
04:33 AM
index=* sourcetype="dream" | rex field=_raw "^\s*<([^>])>([^<\/])"
Getting error like as given below in the search
Error in 'rex' command: The regex '^\s*<([^>])>([^<\/])' does not extract anything. It should specify at least one named group. Format: (?...).
The search job has failed due to an error. You may be able view the job in the Job Inspector.
... View more
08-10-2018
03:12 AM
Thanks, I have tried and no fields were extracted
For you to know i am using splunk enterprise on windows 10
... View more
08-10-2018
02:51 AM
extracting all the fields using multivalues
... View more
08-10-2018
02:36 AM
<Interceptor>
<AttackCoords>-80.03107887624853,25.351308629611</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>6</Infiltrators>
<Enforcer>Assured</Enforcer>
<ActionDate>2013-11-03</ActionDate>
<ActionTime>04:40:00</ActionTime>
<RecordNotes>Infiltrators:
Savanna Carrera,
Gregoria Farías,
Julina Abeyta,
Mariquita Alonso,
Urbano Briseño,
Victoro Montano </RecordNotes>
<NumEscaped>3</NumEscaped>
<LaunchCoords></LaunchCoords>
<AttackVessel>Raft</AttackVessel>
</Interceptor>
<Interceptor>
<AttackCoords>-80.33045250710296,24.93574264936793</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>9</Infiltrators>
<Enforcer>Pompano</Enforcer>
<ActionDate>2013-05-04</ActionDate>
<ActionTime>04:22:00</ActionTime>
<RecordNotes></RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords>-80.30497342463124,24.07890526980327</LaunchCoords>
<AttackVessel>Rustic</AttackVessel>
</Interceptor>
<Interceptor>
<AttackCoords>-79.94720757796837,24.82172611548247</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>12</Infiltrators>
<Enforcer>Barracuda</Enforcer>
<ActionDate>2013-01-01</ActionDate>
<ActionTime>05:22:00</ActionTime>
<RecordNotes>Infiltrators:
Cristian Caballero,
Vicenta Olivares,
Leonides Cintrón,
Ascencion Betancourt,
Alanzo Arenas,
Primeiro Sánchez,
Serena Monroy,
Madina Mojica,
Consolacion Cordero,
Faqueza Serrano,
Grazia Quesada,
Ivette Partida </RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords></LaunchCoords>
<AttackVessel>Rustic</AttackVessel>
</Interceptor>
... View more
08-10-2018
02:32 AM
Hi,
I want to use REGEX and FORMAT strings for an xml sample as given without using KV_MODE=xml
So i am trying to use different regex to get hold of parsing fields but failing
Please find the sample log for your reference and help
<Interceptor>
<AttackCoords>-80.03107887624853,25.351308629611</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>6</Infiltrators>
<Enforcer>Assured</Enforcer>
<ActionDate>2013-11-03</ActionDate>
<ActionTime>04:40:00</ActionTime>
<RecordNotes>Infiltrators:
Savanna Carrera,
Gregoria Farías,
Julina Abeyta,
Mariquita Alonso,
Urbano Briseño,
Victoro Montano </RecordNotes>
<NumEscaped>3</NumEscaped>
<LaunchCoords></LaunchCoords>
<AttackVessel>Raft</AttackVessel>
</Interceptor>
<Interceptor>
<AttackCoords>-80.33045250710296,24.93574264936793</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>9</Infiltrators>
<Enforcer>Pompano</Enforcer>
<ActionDate>2013-05-04</ActionDate>
<ActionTime>04:22:00</ActionTime>
<RecordNotes></RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords>-80.30497342463124,24.07890526980327</LaunchCoords>
<AttackVessel>Rustic</AttackVessel>
</Interceptor>
<Interceptor>
<AttackCoords>-79.94720757796837,24.82172611548247</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>12</Infiltrators>
<Enforcer>Barracuda</Enforcer>
<ActionDate>2013-01-01</ActionDate>
<ActionTime>05:22:00</ActionTime>
<RecordNotes>Infiltrators:
Cristian Caballero,
Vicenta Olivares,
Leonides Cintrón,
Ascencion Betancourt,
Alanzo Arenas,
Primeiro Sánchez,
Serena Monroy,
Madina Mojica,
Consolacion Cordero,
Faqueza Serrano,
Grazia Quesada,
Ivette Partida </RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords></LaunchCoords>
<AttackVessel>Rustic</AttackVessel>
</Interceptor>
Props.conf
[dreamcrusher]
LINE_BREAKER = (\<Interceptor\>)
TIME_PREFIX = <ActionDate>
TIME_FORMAT = %Y-%m-%d<\/ActionDate>[\r\n]\t+<ActionTime>%H:%M:%S
SHOULD_LINEMERGE = false
MAX_DAYS_AGO = 2500
SEDCMD-aremoveheader = s/\<\?xml.*\s*\<dataroot\>\s*//g
SEDCMD-bremovefooter = s/\<\/dataroot\>//g
REPORT-f = dream_attack
KV_MODE = none
transforms.conf
[dream_attack]
REGEX = (?m)^[^<]+.(.*?)\>([\S\s]*?)\<(?=[^\s])
FORMAT = $1::$2
Please suggest to me why am I failing?
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
