Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gkapitany
gkapitany
Explorer
Member since:
10-03-2019
11-14-2022
Community Statistics
| Posts | 9 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-03-2019 |
Activity Feed
- Got Karma for Re: Map command maxsearches unexpected behavior. 06-05-2020 12:50 AM
- Posted Re: json gets truncated on Getting Data In. 01-02-2020 05:24 AM
- Posted Re: json gets truncated on Getting Data In. 01-02-2020 05:00 AM
- Posted Re: json gets truncated on Getting Data In. 12-31-2019 10:17 AM
- Posted Re: json gets truncated on Getting Data In. 12-30-2019 07:43 AM
- Posted json gets truncated on Getting Data In. 12-27-2019 10:45 AM
- Tagged json gets truncated on Getting Data In. 12-27-2019 10:45 AM
- Tagged json gets truncated on Getting Data In. 12-27-2019 10:45 AM
- Posted Re: Help extracting alphanumeric string after matching pattern on Splunk Search. 10-07-2019 10:47 AM
- Posted Re: Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 12:40 PM
- Posted Re: Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 10:46 AM
- Posted Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 07:38 AM
- Tagged Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 07:38 AM
- Tagged Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 07:38 AM
- Tagged Map command maxsearches unexpected behavior on Splunk Search. 10-03-2019 07:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
01-02-2020
05:24 AM
Hi rvaglid,
I ran the suggested eval on a few entries and the truncation position is not consistent:
11170
12231
13721
11331
Like I mentioned above it doesn't appear that the truncation occurs due to length but rather a character sequence.
... View more
01-02-2020
05:00 AM
Hi,
No , there isn't any log record about truncation due to length. The reason I set TRUNCATE = 0 was to eliminate any potential issue due to length. The intent is to set it to 30000 once I figure out why it gets truncated.
All error messages are like the one below but with different values:
ERROR JsonLineBreaker - JSON StreamId:18294845293918380307 had parsing error:Unexpected character while looking for value: 'r' - da
ta_source="/opt/splunk/vne2splunk/log.json", data_host="splmx1.sample.com", data_sourcetype="_json"
Some logs are parsed correctly like the one below:
{
"audit": "16489",
"hostScore": "0",
"name": "to8pt.sample.com",
"macAddress": "",
"os": "OS Undetermined",
"vulnerabilities": "1",
"netbiosName": "",
"application": {
"": "port - 5040",
"id: 6119 Application: DCE/MS RPC Endpoint Mapper Interface (TCP) description: DCE/MS RPC Endpoint Mapper Interface. parent: 165": "port - 135",
"id: 165 Service: DCE/MS RPC over TCP description: Microsoft RPC (Remote Procedure Call) over TCP is used by many services, including: DHCP Manager, DNS Administration, WINS Manager, Exchange Client/Server, Exchange Administrator and RPC. Third party applications, such as Symantec/Veritas BackupExec, may also make use of it. protocol: tcp transport: n/a parentid: n/a": "port - 135",
"id: 8037 Service: IPv4 Layer 4 description: Generic Layer 3 / Layer 4 RAW socket access. protocol: ip transport: n/a parentid: n/a": "port - 0"
},
"timeStamp": "2020-01-02 00:03:56",
"ipAddress": "172.16.25.32",
"id": "4128157",
"network": "INT - Transports"
}
The only difference is that the "application " object varies in length. One example I have is in Splunk gets truncated at 14,532 character, but the original json has 15,071 characters.
This leads me to believe that the issue is related to some character sequence but not sure which one.
... View more
12-30-2019
07:43 AM
I've tried also a few alternate line breakers with no success:
LINE_BREAKER = ([\r\n]+)(\x7B(\x22))audit
LINE_BREAKER = ([\r\n]+)(\x7B)audit
LINE_BREAKER = ([\r\n]*)(?={)
no line breaker and INDEXED_EXTRACTIONS = json
Below is the beginning of the json (truncated here to keep the post clean)
{"audit":"16463","hostScore":"0","name":"to8pt.sample.com","macAddress":"","os":"OS Undetermined",
... View more
12-27-2019
10:45 AM
Valid json gets truncated for some reason. Below is the props.conf file:
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
BREAK_ONLY_BEFORE = ^\x7B
LINE_BREAKER = ([\r\n]+)(\x7B)
SHOULD_LINEMERGE = false
DATETIME_CONFIG = CURRENT
Any suggestions?
... View more
10-07-2019
10:47 AM
search .. |rex field=_raw ".REGISTER_NOT_FOUND\s+productId\s+(?\w+)."
... View more
10-03-2019
12:40 PM
1 Karma
I found and alternate solution based on another post. I had to update the transforms.conf file with:
[networks]
default_match = NONE
match_type = CIDR(cidrBlock)
check_permission = true
filename = networks.csv
The query below returns the results I was trying to get with map search:
index=stats_summary dest_ip=172.*
| dedup src_ip dest_ip
| lookup networks cidrBlock as dest_ip OUTPUT cidrBlock as dmatch
| where dmatch != "NONE"
| table src_ip dest_ip
... View more
10-03-2019
10:46 AM
I'm trying to get all src_ip for which the dest_ip in in one of the network ranges listed in network.csv. The lookup table consist of about 90 cidr ranges.
... View more
10-03-2019
07:38 AM
I have the search below:
index=stats_summary dest_ip=172.*
| dedup src_ip dest_ip| map maxsearches=100 search="| inputlookup networks.csv
| eval dip=$dest_ip$
| eval sip=$src_ip$
| eval dm=if(cidrmatch(cidr,$dest_ip$),1,0)
| where dm == 1
| table * "
| table sip dip
The first search returns about 20K records. The lookup table has about 90 records. If I set the maxsearches to 100 then the search returns zero records. If I set maxsearches to 3500 then I get about 100+. According to the documentation, maxsearches controls how many times the map search iterates over each record from the first search. Any ideas on what I'm doing wrong?
... View more
