Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kashnburn
kashnburn
Engager
Member since:
11-15-2019
11-02-2021
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 11-15-2019 |
Activity Feed
- Posted SEDCMD to remove text on Splunk Search. 06-17-2021 06:33 AM
- Posted Re: Logfile with multiple newlines splunk only grabs the first line on Splunk Search. 06-17-2021 06:26 AM
- Posted Logfile with multiple newlines splunk only grabs the first line on Splunk Search. 12-10-2020 10:07 AM
- Karma Re: Monitor Universal forwarder for Mahieu. 06-05-2020 12:46 AM
- Posted Unable to pass field as an argument to my macro on Knowledge Management. 11-18-2019 08:23 AM
- Tagged Unable to pass field as an argument to my macro on Knowledge Management. 11-18-2019 08:23 AM
- Tagged Unable to pass field as an argument to my macro on Knowledge Management. 11-18-2019 08:23 AM
- Tagged Unable to pass field as an argument to my macro on Knowledge Management. 11-18-2019 08:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-17-2021
06:33 AM
I'm trying to use SEDCMD to remove some text from a logfile. example data below, data to be removed in bold. Tried some different ways to do this but can't seem to get it to work correctly. 5722SS1 V5R4M0 060210 Messages in queue - WMSMSGQ Page 0001 MSGID SEV MSG TYPE SAP0157 30 INFO markout key WMSPIX8706200011450515323 2332615 870 810344313-24 has invalid data for field articleId value 810344313-24-6. Message id 414D5120514D5F4754575F513120202069C7445920DADA0F. MARKOUT870 QPGMR 040033 MS733C1 0000 06/28/17 11:01:29.968280 QPGMR SAP0157 30 INFO markout key WMSPIX8706200011450515334 2332563 870 810344313-24 has invalid data for field articleId value 810344313-24-6. Message id 414D5120514D5F4754575F513120202069C7445920DADA15. MARKOUT870 QPGMR 040034 MS733C1 0000 06/28/17 11:01:29.992920 QPGMR SAP0157 30 INFO markout key WMSPIX8706200011450515378 2332614 870 810344313-24 has invalid data for field articleId value 810344313-24-6. Message id 414D5120514D5F4754575F513120202069C7445920DADA2D. MARKOUT870 QPGMR 040038 MS733C1 0000 06/28/17 11:02:13.477976 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012405935623 2332314 874 810333491-36 has invalid data for field articleId value 810333491-36-9. Message id 414D5120514D5F4754575F51312020202C3C575920528D0F. MARKOUT874 QPGMR 113530 MS733C1 0000 07/05/17 14:32:35.621352 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012405935612 2332314 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C575920528D09. MARKOUT874 QPGMR 113529 MS733C1 0000 07/05/17 14:32:35.673248 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405793881 2332314 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C575920528D21. MARKOUT874 QPGMR 113532 MS733C1 0000 07/05/17 14:32:50.738224 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405825461 2332260 874 810343142-24 has invalid data for field articleId value 810343142-24-6. Message id 414D5120514D5F4754575F51312020202C3C575920528D27. MARKOUT874 QPGMR 113533 MS733C1 0000 07/05/17 14:32:50.744880 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405825471 2332260 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C575920528D2D. MARKOUT874 QPGMR 113534 MS733C1 0000 07/05/17 14:32:51.045448 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405825491 2332260 874 810325875-1- has invalid data for field articleId value 810325875-1-1. Message id 414D5120514D5F4754575F51312020202C3C575920528D39. MARKOUT874 QPGMR 113536 MS733C1 0000 07/05/17 14:32:51.467576 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405825501 2332260 874 810310457-4- has invalid data for field articleId value 810310457-4-4. Message id 414D5120514D5F4754575F51312020202C3C575920528D3F. MARKOUT874 QPGMR 113537 MS733C1 0000 07/05/17 14:32:51.831232 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405825521 2332290 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C575920528D4B. MARKOUT874 QPGMR 113539 MS733C1 0000 07/05/17 14:33:11.110064 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405869751 2332288 874 810344302-12 has invalid data for field articleId value 810344302-12-6. Message id 414D5120514D5F4754575F51312020202C3C575920528D63. MARKOUT874 QPGMR 113543 MS733C1 0000 07/05/17 14:33:25.359368 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405869761 2332288 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C575920528D69. MARKOUT874 QPGMR 113545 MS733C1 0000 07/05/17 14:33:25.714544 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405869771 2332288 874 810347257-32 has invalid data for field articleId value 810347257-32-1. Message id 414D5120514D5F4754575F51312020202C3C575920528D6F. MARKOUT874 QPGMR 113546 MS733C1 0000 07/05/17 14:33:26.018248 QPGMR SAP0157 30 INFO markout key WMSPIX8746200042405869801 2332288 874 810325875-1- has invalid data for field articleId value 810325875-1-1. Message id 414D5120514D5F4754575F51312020202C3C575920528D81. MARKOUT874 QPGMR 113549 MS733C1 0000 07/05/17 14:33:55.842720 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012405976081 2332257 874 810333491-36 has invalid data for field articleId value 810333491-36-9. Message id 414D5120514D5F4754575F51312020202C3C57592052D203. MARKOUT874 QPGMR 113715 MS733C1 0000 07/05/17 15:01:25.353112 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012405976103 2332300 874 810333491-36 has invalid data for field articleId value 810333491-36-9. Message id 414D5120514D5F4754575F51312020202C3C57592052D20F. MARKOUT874 QPGMR 113717 MS733C1 0000 07/05/17 15:01:25.358520 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012406002972 2332306 874 810333491-36 has invalid data for field articleId value 810333491-36-9. Message id 414D5120514D5F4754575F51312020202C3C57592052E909. MARKOUT874 QPGMR 113763 MS733C1 0000 07/05/17 15:10:56.760664 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012406029972 2332328 874 810333491-36 has invalid data for field articleId value 810333491-36-9. Message id 414D5120514D5F4754575F51312020202C3C575920531909. 5722SS1 V5R4M0 060210 Messages in queue - WMSMSGQ Page 0002 MSGID SEV MSG TYPE MARKOUT874 QPGMR 113863 MS733C1 0000 07/05/17 15:30:14.893848 QPGMR SAP0157 30 INFO markout key WMSPIX8746200012406030005 2332365 874 810314813-36 has invalid data for field articleId value 810314813-36-3. Message id 414D5120514D5F4754575F51312020202C3C57592053191B
... View more
Labels
- Labels:
-
field extraction
-
regex
06-17-2021
06:26 AM
I added a LINE_BREAKER to props.conf and added transforms.conf and it's working now. Thank you
... View more
12-10-2020
10:07 AM
I'm fairly new to splunk so please bare with me. I have a logfile that has multiple lines of data. However when I do my search I get mixed results. Here is an example logfile. Crashed Jobs for Thu Dec 10 12:05:01 EST 2020 in qa environment Job started @ 20201210120501 CustomerHistoryLoad_fixLoad_FileFix_PART call_SPBatchDetail_Web.Job_BatchDetailStartWebDeptRequirements EmployeeMasterPull get_ControlState_StoreCloseMonitor.Job_GetControlState_StrClsMon RunSeqBusinessEODLoad run_CustomerLoadSeq run_SalesLease_LoadSeq run_Vendor_CDP_DW_LoadExportSeq run_Vendor_POSLog_ExportSeq_Adhoc_Run run_WebApr_LoadSeq run_WebDeptRequirements_LoadSeq Seq_HRMS_AD_to_DW StoreCloseMonitorSeq Job ended @ 20201210121407 Here is my search - index=bli_datastage_crash_jobs_qa sourcetype=bli_datastage_crash_jobs | rex field=_raw "From:(?<Crashed>.*) To:(?<Job>.*)" The problem is I get multiple events instead of just one event. I suspect I have breaks (newlines) in this logfile but I can't seem to get all the lines included into a single event. Appears the data is getting indexed as separate events. Any advice on getting the data indexed as a single event would be greatly appreciated.
... View more
Labels
- Labels:
-
field extraction
-
regex
11-18-2019
08:23 AM
I'm fairly new to Splunk so I am having a hard time understanding how Splunk passes fields.
My search:
host=HMWVP* source="WMI:Service" Name=Audiosrv State!=Running
|table host Name State
|dedup host
|eval schedule_id = host
| maint_schedule_hours_check($schedule_id$)
My Macro:
[maint_schedule_hours_check(1)]
args = schedule_id
definition = join \
[| inputlookup schedule_hours.csv \
| search schedule_id = $schedule_id$ \
| schedule_local_time($schedule_id$) \
| eval day_of_week =strftime(current_time, "%w") \
| where day_of_week = calendar_day_of_week \
| eval current_date =strftime(current_time, "%m/%d/%y") \
| eval hours_startTime = current_date." ".start_time \
| eval hours_endTime = current_date." ".end_time \
| convert timeformat="%m/%d/%y %H:%M" mktime(*Time) \
| where current_time > hours_startTime \
| where current_time < hours_endTime \
| stats count as schedule_hours_count \
| eval is_maintenance_hours = if(schedule_hours_count>0,"true","false")]
errormsg = When calling ismaintenance_hours input param schedule_id must be provided
iseval = 0
validation = isnotnull($schedule_id$)
Any guidance or suggestions would be greatly appreciated.
Thank you
... View more
Labels
- Labels:
-
search macro
