About sgarcia

sgarcia · ‎02-17-2023

REPORTESDEBITACORAGRAL;;;;;;;;;; TotalMovimientos:;;;;;;;;;; ID;Usuario;Fecha/Horadecaptura;Tipodeoperacion;Clave;Emisor;Receptor;MediodeEntrega;Importe;Estado;TipodeError 1675816017182;DKXMMHA;07/Feb/202318:26hrs.;Logout;FinSesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK; 1675815710949;DKXMMHA;07/Feb/202318:21hrs.;Login;Ini.SesionUsr.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK; 1675814586855;SPEI;07/Feb/202318:03hrs.;AvisoTraspasoOK;2035;Sindefinicion;Sindefinicion;Sindefinicion;30,430,522.05;OK; 1675814481168;SPEI;07/Feb/202318:01hrs.;Act.delCat.Ins.;EnsesionInstituciones.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK; 1675814481200;SPEI;07/Feb/202318:01hrs.;Act.delCat.Cert.;EnsesionCertificados.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK; 1675814481231;SPEI;07/Feb/202318:01hrs.;Act.delCat.Nvls.;EnsesionNiveles.;Sindefinicion;Sindefinicion;Sindefinicion;0;OK;

sgarcia · ‎02-17-2023

Thank you, i try the configuration, and comeback as soon .

sgarcia · ‎02-15-2023

Hola comunidad I'm trying to configure the props file so that the following event starts from the third line: Currently, I am testing as follows: If I leave this setting, the timestamp of the first few lines will be taken from splunk, but it should take the timestamp of the lines with date. Regards

sgarcia · ‎08-04-2022

Thanks isoutamo

sgarcia · ‎06-14-2022

Hello everyone. I have set up a cluster of 3 search heads, I have the Serach Head 1 configured as captain, but it turns out that there are times that I do not see events in that same SH1 and SH2, this causes alerts that I have configured in my SH1 to activate, since they do not events are displayed on the SH1. What I have to do is change how SH3 is populated and the display of events is restored, temporarily solving the problem. After a while I find out that SH1 takes the role of captain again and again I can't view events on SH1. Why could it be happening? Regards.

sgarcia · ‎03-30-2022

Hello It was already solved, the props.conf file was configured and I could see the events reflected with the current date. Regards

sgarcia · ‎03-30-2022

Hello my friend It was already solved, the props.conf file was configured and I could see the events reflected with the current date. Regards

sgarcia · ‎03-23-2022

I have a device that is reporting to the splunk through syslog, that device first goes through an F5 and the F5 gives me the traffic to my heavy forwarders. The problem is that the year of the time stamp is out of date, the date when a server event is generated is 2022 and in the search head, I see it as 2017. I don't know if the problem is from the origin server at the syslog protocol level or in the transport layer or at the collection level within the splunk. This issue only occurs on 3 computers out of 10. I have reviewed the prop settings, but if I don't see the year in the source data, I will hardly be able to modify the timestamp. Regards

Posts	8
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎03-23-2022

Online Status	Offline
Date Last Visited	‎02-12-2024 04:24 PM

How to configure line breaker?

Why am I having Issues with search head cluster- n...

Problems with time stamp

Re: How to configure line breaker?

Re: How to configure line breaker?

How to configure line breaker?

Re: Why am I having Issues with search head cluste...

Why am I having Issues with search head cluster- n...

Re: Problems with time stamp

Re: Problems with time stamp

Problems with time stamp