About chrkohm

chrkohm · ‎02-09-2022

Hi @gcusello, thanks for your quick answer! I removed the parenthesis but that dosen´t change anything. Still no results. I shrieked the example extreamly down. So it looks like the actual two searches dosen´t make any sense. But I use the subsearch to identify the devices that have a specific element mountet and than I like to search only with this devices in an other index for other results. Greetings Chris

chrkohm · ‎02-08-2022

Hello! I'm struggling with the time ranges within my query. I have two indexes (anonymized) index=documentation contains the information which element is mounted in a device. index= eor contains events for devices Now I'm trying to search only for events in the index=eor for devices that contain the element=COB for the last xx time range So I tried to set the time range for the sub search like this: index=eor name IN (*) status IN (*) [ search index= documentation earliest=1 latest=now() | search element = COB | table devices ] | table a, b, c, d But I'm getting no results. If I set the time picker let's say to a time range, there are the last events in the documentation index, I'm getting results... Greetings Chris

chrkohm · ‎08-07-2020

chrkohm · ‎08-06-2020

ok, but I can´t name every file.log because there are thousands...

chrkohm · ‎08-06-2020

I think "match" is here the problem. Because the QuickRef Guide says: splunk-quick-reference-guide.pdf match(X,Y) Returns if X matches the regex pattern Y. match(field, "^\d{1,3}\.\d$") Did you tried: |search Targed_Account_Name IN ($locked_out$) or |search Targed_Account_Name=$locked_out$

chrkohm · ‎08-06-2020

Hi, I have several log files that I´m "batch indexing". for example: file01.log file02.log file03.log file04.log Now I´m searching if an field equals an value like State=4 And now I just want to do another search that searches only in this source-files where the State was 4. I tried this: index=test sourcetype=XY State=4 | stats count by source |map search="search index=test sourcetype=XY source=$source$ |stats values(cpu) by _time " but I´m getting no results. If I run the first search without the map section, I´m getting the source-files as an List

chrkohm · ‎07-05-2020

./splunk stop ./splunk clean kvstore --local ./splunk start Solves the issue for me.

chrkohm · ‎07-05-2020

Hi Guys, I´m facing an issue with the KV Store. The Status of the KV Store stands still on Starting: This member: backupRestoreStatus : Ready disabled : 0 guid : 987EAE0D-F75D-401C-B21F-4E640CBC9019 port : 8191 standalone : 1 status : starting The mongod.log says: I ACCESS [main] permissions on /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key are too open I already have set the permission on chmod 400 to the /mongo/splunk.key, but it still shows this message after restarting splunk 2020-07-06T05:34:24.156Z E - [rsSync] Assertion: 17322:write to oplog failed: DocTooLargeForCapped: document doesn't fit in capped collection. size: 124 storageSize:209715200 src/mongo/db/repl/oplog.cpp 150 2020-07-06T05:34:24.156Z F - [rsSync] terminate() called. An exception is active; attempting to gather more information 2020-07-06T05:34:24.164Z F - [rsSync] DBException::toString(): Location17322: write to oplog failed: DocTooLargeForCapped: document doesn't fit in capped collection. size: 124 storageSize:209715200 Actual exception type: mongo::error_details::throwExceptionForStatus(mongo::Status const&)::NonspecificAssertionException 0x55738d1dee21 0x55738d1de805 0x55738d2d36e6 0x55738d367b39 0x55738d2d3085 0x55738d370083 0x55738d3708d7 0x55738c05cdd1 0x55738bd33ee4 0x55738bd3468f 0x55738bcb0c4c 0x55738d2ee8a0 0x7fdfa06c4724 0x7fdfa0403e8d ----- BEGIN BACKTRACE ----- {"backtrace":[{"b":"55738AF1E000","o":"22C0E21","s":"_ZN5mongo15printStackTraceERSo"},{"b":"55738AF1E000","o":"22C0805"},{"b":"55738AF1E000","o":"23B56E6","s":"_ZN10__cxxabiv111__terminateEPFvvE"},{"b":"55738AF1E000","o":"2449B39"},{"b":"55738AF1E000","o":"23B5085","s":"__gxx_personality_v0"},{"b":"55738AF1E000","o":"2452083"},{"b":"55738AF1E000","o":"24528D7"},{"b":"55738AF1E000","o":"113EDD1","s":"_ZN5mongo4repl26ReplicationCoordinatorImpl19signalDrainCompleteEPNS_16OperationContextEx"},{"b":"55738AF1E000","o":"E15EE4","s":"_ZN5mongo4repl8SyncTail17_oplogApplicationEPNS0_22ReplicationCoordinatorEPNS1_14OpQueueBatcherE"},{"b":"55738AF1E000","o":"E1668F","s":"_ZN5mongo4repl8SyncTail16oplogApplicationEPNS0_22ReplicationCoordinatorE"},{"b":"55738AF1E000","o":"D92C4C","s":"_ZN5mongo4repl10RSDataSync4_runEv"},{"b":"55738AF1E000","o":"23D08A0"},{"b":"7FDFA06BC000","o":"8724"},{"b":"7FDFA0317000","o":"ECE8D","s":"clone"}],"processInfo":{ "mongodbVersion" : "3.6.17-SERVER-42525-splunk", "gitVersion" : "226949cc252af265483afbf859b446590b09b098", "compiledModules" : [], "uname" : { "sysname" : "Linux", "release" : "4.4.180-94.97-default", "version" : "#1 SMP Tue Jun 11 08:19:03 UTC 2019 (c0632f4)", "machine" : "x86_64" }, "somap" : [ { "b" : "55738AF1E000", "elfType" : 3 }, { "b" : "7FFF26F76000", "path" : "linux-vdso.so.1", "elfType" : 3 }, { "b" : "7FDFA12C3000", "path" : "/lib64/libresolv.so.2", "elfType" : 3 }, { "b" : "7FDFA0FE2000", "path" : "/opt/splunk/lib/libcrypto.so.1.0.0", "elfType" : 3 }, { "b" : "7FDFA1669000", "path" : "/opt/splunk/lib/libssl.so.1.0.0", "elfType" : 3 }, { "b" : "7FDFA0DDE000", "path" : "/lib64/libdl.so.2", "elfType" : 3 }, { "b" : "7FDFA0BD6000", "path" : "/lib64/librt.so.1", "elfType" : 3 }, { "b" : "7FDFA08D9000", "path" : "/lib64/libm.so.6", "elfType" : 3 }, { "b" : "7FDFA06BC000", "path" : "/lib64/libpthread.so.0", "elfType" : 3 }, { "b" : "7FDFA0317000", "path" : "/lib64/libc.so.6", "elfType" : 3 }, { "b" : "7FDFA14DA000", "path" : "/lib64/ld-linux-x86-64.so.2", "elfType" : 3 }, { "b" : "7FDFA164B000", "path" : "/opt/splunk/lib/libz.so.1", "elfType" : 3 } ] }} mongod(_ZN5mongo15printStackTraceERSo+0x41) [0x55738d1dee21] mongod(+0x22C0805) [0x55738d1de805] mongod(_ZN10__cxxabiv111__terminateEPFvvE+0x6) [0x55738d2d36e6] mongod(+0x2449B39) [0x55738d367b39] mongod(__gxx_personality_v0+0x2B5) [0x55738d2d3085] mongod(+0x2452083) [0x55738d370083] mongod(+0x24528D7) [0x55738d3708d7] mongod(_ZN5mongo4repl26ReplicationCoordinatorImpl19signalDrainCompleteEPNS_16OperationContextEx+0x511) [0x55738c05cdd1] mongod(_ZN5mongo4repl8SyncTail17_oplogApplicationEPNS0_22ReplicationCoordinatorEPNS1_14OpQueueBatcherE+0xC04) [0x55738bd33ee4] mongod(_ZN5mongo4repl8SyncTail16oplogApplicationEPNS0_22ReplicationCoordinatorE+0x13F) [0x55738bd3468f] mongod(_ZN5mongo4repl10RSDataSync4_runEv+0x11C) [0x55738bcb0c4c] mongod(+0x23D08A0) [0x55738d2ee8a0] libpthread.so.0(+0x8724) [0x7fdfa06c4724] libc.so.6(clone+0x6D) [0x7fdfa0403e8d] ----- END BACKTRACE ----- Could please someone help me with this?

chrkohm · ‎06-30-2020

Hi, I'm trying to setup a DNS lookup following the instructions her: https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/Configureexternallookups#External_looku... But there is no external_lookup.py in the $SPLUNK_HOME/etc/system/bin/ Is there a chance to get the external_lookup.py anywhere else? I´m running Splunk Enterprise 8.0.4 on an SLES 12

chrkohm · ‎06-30-2020

Hi, I'm trying to setup a DNS lookup following the instructions her: https://docs.splunk.com/Documentation/Splunk/8.0.4/Knowledge/Configureexternallookups#External_lookup_example But there is no external_lookup.py in the $SPLUNK_HOME/etc/system/bin/ Is there a chance to get the external_lookup.py anywhere else? I´m running Splunk Enterprise 8.0.4 on an SLES 12

chrkohm · ‎05-19-2020

Hi, I´m trying to lookup different csv-files depending on an field-Value. But it seems to be a problem for the lookup command to handle an variable as lookup-csv-file. index=yxz | search model="123" | eval lookupfile=case(model == 123, "123_lookup.csv", model == 456, "456_lookup.csv", model == 789, "789_lookup.csv") | lookup lookupfile ErrorCode I´m getting this Error Message: Error in 'lookup' command: Could not construct lookup 'lookupfile, ErrorCode'. See search.log for more details. Can someone help me with this?

chrkohm · ‎12-11-2019

Hi, I still have an issue here. So I decided to delete the sourcetype and the fieldextraction an the monitored inputs. Then I created (per Webinterface) the fieldextraction and called it: xml_extract with this as entry `property\sname="(.+)"\svalue="(.+)"\s\/> $1::$2` Then I set up the monitored input and created the sourcetype with the settings above. But the fields are still not extracted....

chrkohm · ‎12-09-2019

Hi dindu, Thanks for your quick response! I´m traying Method 3, but I´m struggling creating the transforms.conf. I`ve created the transforms.conf in this folder: /opt/splunk/etc/apps/myApp/local/transforms.conf but it dosen´t seams to work. Also I can not see the transformation in the Splunk GUI under the Menueentry Fieldtransformations. Is it right that in the format is only one colon? Or should there two colos? :: **transforms.conf** [extract_xml] regex=property\sname="(.+)"\svalue(.+)\s\/> format=$1::$2

chrkohm · ‎12-09-2019

Hello everyone, I´m new to splunk and I´m facing some problems to get my data onboarded. In this case i´m trying to observe an xml-logfile in this format: <?xml version="1.0" encoding="UTF-8"?> <logstore type="de.123.456.logstore.ABCLogstore" name="Horst" path="/mnt/111/Data/01_Driver/Horst" status="sync end"> <properties> <property name="autosync" value="true" /> <property name="synctime" value="1440" /> <property name="lastsync" value="2019-12-09T11:16:12" /> <property name="nextsync" value="2019-12-10T11:16:28" /> </properties> </logstore> I´m trying to extract some fields which are stored as attributes and the corresponding values which are also stored as attributes. Example: <property name="nextsync" value="2019-12-10T11:16:28" /> Field: nextsync Value: 2019-12-10T11:16:28 and so on. Does anyone have an idea how to do this? I tryed this, but in this case I´m getting the name and the values seperated: [Logstore_XML] DATETIME_CONFIG = CURRENT KV_MODE = xml LINE_BREAKER = (<logstore>) MUST_BREAK_AFTER = \</logstore\> NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TRUNCATE = 0 pulldown_type = 1 FIELDALIAS-rootfields = logstore.properties.property{@name} as PropertyID logstore.properties.property as ProperyValue Thanks Chris

Posts	14
Solutions	2
Karma Given	3
Karma Received	0
Member Since	‎12-09-2019

Online Status	Offline
Date Last Visited	‎02-11-2022 12:22 AM

Why am I not receiving results for different tim...

use source within map command

KV Store switching from failed to starting and sta...

external_lookup.py is missing

external_lookup.py is missing

Different lookup csv depending on field value

XML Extract multiple attributes as Key and Value

Re: Different time ranges for subsearch and main s...

Why am I not receiving results for different tim...

Re: use source within map command

Re: use source within map command

Re: Why does my token in my search query not work?

use source within map command

Re: KV Store switching from failed to starting and...

KV Store switching from failed to starting and sta...

external_lookup.py is missing

external_lookup.py is missing

Different lookup csv depending on field value

Re: XML Extract multiple attributes as Key and Val...

Re: XML Extract multiple attributes as Key and Val...

XML Extract multiple attributes as Key and Value