Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About a508184
a508184
Explorer
Member since:
11-24-2018
04-12-2022
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 11-24-2018 |
Activity Feed
- Karma Re: Parsing not working as expected for venkatasri. 04-12-2022 07:58 PM
- Karma Re: Parsing not working as expected for VatsalJagani. 04-12-2022 07:58 PM
- Posted Parsing not working as expected on Splunk Search. 04-05-2022 07:52 PM
- Posted Re: Count the Error, Info and Warnings on Deployment Architecture. 12-26-2018 03:58 AM
- Posted Re: Count the Error, Info and Warnings on Deployment Architecture. 12-24-2018 07:22 AM
- Posted Re: Count the Error, Info and Warnings on Deployment Architecture. 12-24-2018 07:21 AM
- Posted Count the Error, Info and Warnings on Deployment Architecture. 12-24-2018 05:39 AM
- Tagged Count the Error, Info and Warnings on Deployment Architecture. 12-24-2018 05:39 AM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-24-2018 12:21 AM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-17-2018 07:00 AM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 08:39 PM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 07:19 AM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 06:09 AM
- Posted Re: I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 05:31 AM
- Posted I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 03:42 AM
- Tagged I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port) on Splunk Search. 12-16-2018 03:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
04-05-2022
07:52 PM
New to splunk, need your help. Data: 4/5/2022 9:02 PM | Audit | hi user | something.MoveFiles | Copied File from C:\hello.txt to server/something.txt 4/5/2022 9:02 AM | Audit | hi user | something.MoveFiles | Copied File from D:\reportsSuccess\_CMS.txt to \\server_CMS.txt 12/15/2022 10:02 PM | Audit | hi user | something.MoveFiles | Copied File from D:\reportsSuccess\_CMS.txt to \\server_CMS.txt 4/4/2022 5:00 AM | Audit | hi user | FileSplitter.ProcessFiles | Started Processing : ID 4/4/2022 5:00 AM | Audit | hi user | FileSplitter.ProcessFiles | Started Processing 4/4/2022 5:00 AM | Audit | hi user | FileReader.FileReader | FileReader for D:\reportsInput\tsst.TXT initilized 4/4/2022 5:00 AM | Audit | hi user | something.something. 11/4/2022 5:00 AM | Audit | hi user | something.something. 10/4/2021 5:00 AM | Audit | hi user | something.something. 12/15/2022 is taking as 2/15/22. Below is the props.conf am using it. SHOULD_LINEMERGE=true LINE_BREAKER=([/r/n]*)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M TZ=EST TIME_PREFIX =^ BREAK_ONLY_BEFORE=[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M Can you please help me to get the correct parsing? Thanks in advance.
... View more
12-24-2018
07:22 AM
Thanks for your response Rich.
Same Log is
"12-15 20:22:55,671 ERROR - logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 connect fail XXX:XXX Connection refused (Connection refused)"
"12-15 20:22:55,671 Info- logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 Connected
Currently am using below search.
index = bla source="" Field2= host=* |top 1 Field2 by source, host |rename Field2 as Status, host as HOST
Filed2 is ERROR, INFO or WARN
Output am getting at present is:
source↕ HOST↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100.000000
Expected Output i need is similar to:
Source↕ HOST↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100 Error 0 0 Warn 0 0
... View more
12-24-2018
07:21 AM
Thanks for your response Renjith.
Same Log is
"12-15 20:22:55,671 ERROR - logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 connect fail XXX:XXX Connection refused (Connection refused)"
"12-15 20:22:55,671 Info- logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 Connected
Currently am using below search.
index = bla source="" Field2= host=* |top 1 Field2 by source, host |rename Field2 as Status, host as HOST
Filed2 is ERROR, INFO or WARN
Output am getting at present is:
source↕ HOST↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100.000000
Expected Output i need is similar to:
Source↕ HOST↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕ Status↕ count↕ percent↕
app/log.txt ServerName INFO 95 100 Error 0 0 Warn 0 0
... View more
12-24-2018
05:39 AM
Am very new to splunk, i need a query to get the count and percentage of Error, Info and Warnings in a table.
Error, Info and Warnings filed is already extracted.
Thanks in advance team.
Thanks,
Nithin Setty
... View more
- Tags:
- splunk-enterprise
12-24-2018
12:21 AM
Thanks Renjith for your help.
... View more
12-17-2018
07:00 AM
Thanks a lot for your help Renjith.
It works, but i cant achieve the below scenario
I need to display the error in the Dashboard until its fixed or success STATS status code 1-423 for first query and 6-904 for the second query.
First Query - Success Code 1-423 and Error Code 1-426
index=asg sourcetype=prd_asg_app_logs source=*
|rex field=_raw "(?\d-\d{3})"
|rex field=_raw "(?DDC\w+-\w+)"
|stats latest(Status) as Status , latest(_raw) as _raw by Process
|where Status="1-426"
First Query - Success Code 6-904 and Error Code 6-908
index=asg sourcetype=prd_asg_app_logs source=*
|rex field=_raw " (?\d-\d{3})" |rex field=_raw "fmapp1/(?\w+/\w+)"
| stats latest(Status) as Status , latest(_raw) as _raw by Process
|where Status="6-908" |where isnotnull(Process)
Need your help in combining both the queries which matches scenario.
... View more
12-16-2018
08:39 PM
Yeah - they are extracted fields, however the below query is working for me for two different scenarios.
index=asg sourcetype=prd_asg_app_logs source=*
|rex field=_raw " (?\d-\d{3})" | rex field=_raw " (?DDC\w+-\w+)"
| stats last(Status) as Status , last(_raw) as _raw by Process, source
|where Status="6-908"
index=asg sourcetype=prd_asg_app_logs source=* NOT ("fmq" "dbWriter*")
|rex field=_raw " (?\d-\d{3})" |rex field=_raw "fmapp1/(?D\w+/\w+)"
|table Process Status source _raw
|where Status="6-908" |where isnotnull(Process)
Could you please help in combining both the queries?
Thanks,
Nithin Setty
... View more
12-16-2018
07:19 AM
Below is different senario,
Here for error its 6-908 stats status code will be returned for the f1/DC1/PRD03 counters.
12-15 17:25:02,318 ERROR - logs/stats/stats1 12-15,17:25:01.397 ios13 6-908 0 2 Stats create alert DDlag2 f1/DC1/PRD03 value 1544916240000
Counters = f1/DC1/PRD03 Field2 = ERROR Field4 = 6-908 0 2 Log_Time = 12-15 17:25:02,318 detailed_logs = Stats create alert DDlag2 applog/PRD03 value 1544916240000 host = source = /applogs/log.txt sourcetype = prd_asg_app_logs
Success stats status code is 6-904 for the f1/DC1/PRD03 counters.
12-15 21:29:05,289 INFO - logs/stats/stats1 12-15,21:29:00.214 ios13 6-904 0 4 Stats clear alert DDlag2 f1/DC1/PRD03 value 8270
Counters = f1/DC1/PRD03 Field2 = INFO Field4 = 6-904 0 4 Log_Time = 12-15 21:29:05,289 detailed_logs = 4 Stats clear alert DDlag2 f1/DC1/PRD03 value 8270 host = source = /applogs/log.txt sourcetype = prd_asg_app_logs
Above and below senario needs to be incudle in the same dashboard.
... View more
12-16-2018
06:09 AM
Here is the sample logs
12/15/18
8:25:13.860 PM
"12-15 20:25:13,860 INFO - logs/app/fmapp1 12-15,20:24:52.019 ios11 1-423 0 4 DDC3-2 connected XXX:XXX".
Field2 = INFO Field4 = 1-423 0 4 Log_Time = 12-15 20:25:13,860 detailed_logs = 4 DDC3-2 connected XXX:XXX . host = servername source = /applog/log.txt sourcetype = prd_asg_app_logs
12/15/18
8:22:55.671 PM
"12-15 20:22:55,671 ERROR - logs/app/fmapp1 12-15,20:22:32.734 ios55 1-426 0 2 DDC1-4 connect fail XXX:XXX Connection refused (Connection refused)"
Field2 =ERROR Field4 = 1-426 0 2 Log_Time = 12-15 20:22:55,671 detailed_logs = DDC1-4 connect fail XXX:XXX Connection refused (Connection refused) host = servername source =/applogs/log.txt sourcetype = prd_asg_app_logs
... View more
12-16-2018
05:31 AM
Hi Renjith -
Thanks for your reply. Yes i can't exact the process, because log format differs for different process ID's.
Also, i need to display the error in the Dashboard until its fixed or success STATS status code (1-423).
Thanks,
Nithin Setty
... View more
12-16-2018
03:42 AM
Hi -
Need to create a Splunk dashboard for an application.
Am very new to Splunk and doesn't have any Splunk experts within my organization, so need your help.
Sample log format:
12-15 20:22:55,671 ERROR - logs/app/applog 1-426 DC1-4 connect fail host:port Connection refused (Connection refused)
12-15 20:25:13,860 INFO - logs/app/applog 1-423 DC1-4 connected host:port
Time = 12-15 20:25:13
Status = INFO
Log Path = logs/app/applog
Stats Status = 1-426
Process = DC1-4 and DC1-4
Whenever apps is having issues connecting to other sources, it throws an error message with the stats status 1-426 for the particular process DC1-4. Once its fixed then INFO (Success) message will be printed in the logs with the stats status - 1-423 for the particular process DC1-4.
Requirement:
- I need to display the error message (DC1-4 connect fail host:port Connection refused (Connection refused)) in a column until logs have the info message (DC1-4 connected host:port)
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-12-2022
11:24 PM
|
