Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Saaral
Saaral
New Member
Member since:
09-06-2018
01-25-2022
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-06-2018 |
Activity Feed
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 01:12 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:51 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:29 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:08 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:08 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:06 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 12:05 PM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 11:47 AM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-11-2018 08:00 AM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-07-2018 07:03 AM
- Posted Re: Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-06-2018 11:14 AM
- Posted Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-06-2018 08:45 AM
- Tagged Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-06-2018 08:45 AM
- Tagged Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-06-2018 08:45 AM
- Tagged Why does BREAK_ONLY_BEFORE work only for some events? on Splunk Dev. 09-06-2018 08:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
09-11-2018
12:51 PM
The Data flow is from Deployment server to the heavy forwarder to the indexers.
... View more
09-11-2018
12:29 PM
Oops! I applied that as well.Below is the one that is in the server and still not working as I expected.
[empath_app_log]
pulldown_type = 1
SEDCMD-backslash=s/\//g
TRUNCATE = 0
BREAK_ONLY_BEFORE = (?m){\W+name
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = json
KV_MODE = json
category = Structured
SHOULD_LINEMERGE = true
NO_BINARY_CHECK = true
... View more
09-11-2018
12:08 PM
Above the sample log that is not being parsed .I pulled it from the splunk UI
... View more
09-11-2018
12:08 PM
{"name":"utterance.service logger","level":30,"severity":"info","time":"host":"","hostname":"","category":"application","clientCorrelationId":"","userId":"","moduleName":"DisplayUtterancesFsModule","source":"angular","client":"AgentDesktop","type":"application","msg":"utterance does not exist","logId":""}{"name":"utterance.service logger","level":30,"severity":"info","time":,"host":"","hostname":"","category":"application","clientCorrelationId":"","userId":"","moduleName":"","source":"angular","client":"AgentDesktop","type":"application","msg":"utterance does not exist","logId":""}
... View more
09-11-2018
12:06 PM
This is what we deployed last night and only the events starting with newline is being parsed while the events merged together in single line is not being parsed.
... View more
09-11-2018
12:05 PM
[empath_app_log]
pulldown_type = 1
SEDCMD-backslash=s/\\//g
TRUNCATE = 0
BREAK_ONLY_BEFORE = \{\W+name
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = json
KV_MODE = json
category = Structured
SHOULD_LINEMERGE = true
NO_BINARY_CHECK = true
... View more
09-11-2018
11:47 AM
Hi Surya- The solution thatyou provided yesterday works only for the events starting with new line.For the events are merged in a single line,it does not work.Will the above stanza work for thos merged events within a single line too?
... View more
09-11-2018
08:00 AM
Hi Surya
We tried most of all the suggestions that you provided but nothing looks to be working.Only few events are being parsed and most of the events are not.But the SED command that I am applying works for all the events.The Regex is not working for all the events.I have not used the LINe BREAKER though.Will it work ?
... View more
09-07-2018
07:03 AM
Hi Surya
Thanks! I will try to implement it ! Also could you let me know what regex can be applied to the below log sample to break at the name field?
{\"name\":\"\",\"level\":,\"severity\":\"info\",\"time
... View more
09-06-2018
11:14 AM
Thanks! But how my stanza worked for one event and it is not working for another event. Why it was not working for all the events with the same pattern? Also in the regex you provided, I want to break only at name and at the braces before that.Will this break the event at the field name?
... View more
09-06-2018
08:45 AM
I have applied regex in the heavy forwarders as below. But this works only for few events and a lot of events are not getting parsed with the regex in BREAK_ONLY_BEFORE.
pulldown_type = 1
SEDCMD-backslash=s/\//g
TRUNCATE = 0
BREAK_ONLY_BEFORE = {\”name\”
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = json
KV_MODE = json
category = Structured
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
Sample logs as below.
{\"name\":\"\",\"\":,\"severity\":\"info\",\"time\":,\"host\":\"\",\"hostname\":\"\",\"\":\"\",\"\":\"UNKNOWN CORRELATION\",\"userId\":\"UNKNOWN USER\",\"moduleName\":\"\",\"\":\"a\",\"client\":\"AgentDesktop\",\"type\":\"application\",\"msg\":\"\",\"\":\"\"}{\"name\":\"\",\"level\":30,\"\":\"info\",\"time\":,\"host\":\"\",\"hostname\":\"\",\"\":\"\",\"clientCorrelationId\":\"\",\"userId\":\"UNKNOWN
For some events the same stanza in heavy forwarder works, but for others, it does not work. Can someone let me know what could be wrong?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-25-2022
07:37 PM
|
