About ea7777777

ea7777777 · ‎10-20-2021

Hi, an old topic.. but I have exactly that poblem. Here my Inputs.conf [monitor://D:\daten\Splunk\Abgleich1] index = rbg_ff1_line_prodel_EPL1 sourcetype = rbg_ff1_line_prodel_EPL1_adjust_1 crcSalt = <SOURCE> followTail = 1 The actual process: An PLC creates and fills up an text file PLC writes very fast step by step 8 lines in the text file. Each line is an component. The writing process stops after each line and starts again with the next one. An universal forwarder grabs that text file. Now my problem: The PLC cannot write to the text file every 20-100 write cycles. Error code is "text file allready opened by another process" The reason for this is, that the universal forwarder is currently reading the file The proof of this is, as soon as I deactivate the UF, the PLC writes all data without any problems The UF does not block as long as it is only monitoring the file. But when it starts reading the file, it bocks the PLC to write on it. What options do I have to prevent this?

ea7777777 · ‎04-20-2020

Hello, a Universal Forwarder (7.0.1) is watches an textfile. The parameter are following: [default] host = RBD9EUFN [monitor://C:\ProgramData\Cognex\In-Sight\Splunk\Log_Cam] index = rbg_ff1_stand_allone_ant2 sourcetype = rbg_ff1_stand_allone_ant2_sourcetype crcSalt = <SOURCE> followTail = 1 The strange thing is, the sourcetype name changes itself! Why?

ea7777777 · ‎02-17-2020

Works fine! Thanks! Only change from my side was -> | streamstats count as Position by _time

ea7777777 · ‎02-14-2020

Hi, I´ve got this event -> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="FPPPPPPFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP" Each position of the pass value gives an pass or fail for one position (1..80 but can also be only 1..45). For example Pass="FPPF" says -> Position_1 = Fail Position_2 = Pass Position_3 = Pass Position_4 = Fail Now I want to buld an table to show which position has how much fails of all events. How to do this? One possibility could be to use mvexpand and build more events. For example, build from this -> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="FPPF" that events -> 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="1" 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="2" 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Pass" Position="3" 2020/02/14/16:12:28:872 MachineNumber="K003991_HT" Pass="Fail" Position="4" ...but how is it possible do do this? Or is there an other possibility to buld my table? Thanks!

ea7777777 · ‎10-04-2019

No, that solves not my problem. My problem ist, if my result shows only one column the display is ok. But if I get more as result the chart get´s pressed together. To rise only the high parameter is also not good, because than the timechart is for one column result to big and for ten column result to small. I need an autoresize of the timechart high.... Good display of one result. Bad display example of 4 results.

ea7777777 · ‎10-02-2019

Hi, I've got a timechart with different columns (depending on the search). If I don't get many columns, the high of the timechart is enough. If I get many columns results, the timechart high is not enough and all will be pressed together. So I tried to change the high automatically by the column results, but I don't know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results. Someone an Idea? <search> <query>Linie=$Token_Linie$ Antyp=$Token_Antyp$ | eval combined_field= Linie + " " + Antyp | eventstats count as "totalCount" by An | timechart count(totalCount) BY combined_field </query> <earliest>$Token_IO_NIO_Zeit.earliest$</earliest> <latest>$Token_IO_NIO_Zeit.latest$</latest> <done> <eval token="tokPanelHeight2">100*$XXXXXXX$</eval> </done> </search> <option name="height">$tokPanelHeight2$</option> Thx a lot!!!!!

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-02-2019

Online Status	Offline
Date Last Visited	‎10-20-2021 11:11 AM

Universal forwarder Sourcetype name changes itself

Build table by char position in string

Timechart automatic high resize

Re: does forwarders put a lock on a log file while...

Universal forwarder Sourcetype name changes itself

Re: Build table by char position in string

Build table by char position in string

Re: Timechart automatic high resize

Timechart automatic high resize