Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gut1kor
gut1kor
Explorer
Member since:
11-17-2022
02-16-2023
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 11-17-2022 |
Activity Feed
- Posted How to increase transaction command output limit and always fetch latest transactions? on Splunk Search. 02-16-2023 06:10 AM
- Tagged How to increase transaction command output limit and always fetch latest transactions? on Splunk Search. 02-16-2023 06:10 AM
- Tagged How to increase transaction command output limit and always fetch latest transactions? on Splunk Search. 02-16-2023 06:10 AM
- Tagged How to increase transaction command output limit and always fetch latest transactions? on Splunk Search. 02-16-2023 06:10 AM
- Tagged How to increase transaction command output limit and always fetch latest transactions? on Splunk Search. 02-16-2023 06:10 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-18-2022 04:18 AM
- Tagged Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-18-2022 04:18 AM
- Tagged Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-18-2022 04:18 AM
- Karma Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? for emallinger. 11-18-2022 04:16 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:34 AM
- Tagged Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:34 AM
- Tagged Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:34 AM
- Karma Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? for emallinger. 11-17-2022 04:09 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 04:08 AM
- Posted Re: How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 03:29 AM
- Posted How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 01:15 AM
- Tagged How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 01:15 AM
- Tagged How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 01:15 AM
- Tagged How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 01:15 AM
- Tagged How to format json event data so that it can be written to a json log and then successfully indexed by Splunk? on Getting Data In. 11-17-2022 01:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-16-2023
06:10 AM
Hi Team, I have events being pushed to HTTP event collector 24/7. In my dashboard I query and format the events using transaction command based on a field traceparent. It's working fine, but the report is only showing 4999 transactions. Is it a limit set on the Splunk server? Where are these limits set and are there any guidelines to increase it without impacting server performance negatively? I also observed that if by 10AM in a day I got 4999 transactions then the new transactions which came after 10AM are not displayed by the query. I have to change the timer to 'last 60 min', 'last 15 min' etc to get the latest ones. Even if my query hits the top line limit of 4999, how to make sure that those 4999 transactions are the latest (from the time the query is executed) and not the old ones? Like if run the query at 2PM, I want to get those 4999 transactions from 2PM down till 11AM etc. How to achieve that? Thank you.
... View more
Labels
- Labels:
-
stats
-
transaction
11-18-2022
04:18 AM
Hi Ema, thank you very much, I really appreciate your help. I will try this and let you know.
... View more
11-17-2022
04:34 AM
Hi Ema, If the host is part of event data then it's only showing it as 'extracted_host' and original host name (of log file) is picked up as 'host' parameter. The use case is that transaction flow happens across multiple applications. So all applications emit these events and some will be routed to through a queuing mechanism before written to a central log file and some will be pushed through HEC. So it's a must that we extract this hostname from event for tracking purpose. I will read about this alias creation and try.
... View more
11-17-2022
04:08 AM
@emallinger thank you very much, as you said I have moved the date and host fields to event part and wrote the json to log file and now Splunk could extract timestamp and other fields as usual. For host in event data it's showing extracted_host. I guess if I don't find any solution to make Splunk use this parameter as actual host for the event, I probably need to tweak my dashboard query; something like if extracted_host exists in the event then I will use it's value otherwise default host value.
... View more
11-17-2022
03:29 AM
Hi Ema, thank you very much. I will try this and post the results. If we want the hostname as well in the event data, is it possible to make Splunk use it?
... View more
11-17-2022
01:15 AM
Hi Team, I am new here and would like to find a way to tackle this problem. I have structured json events that I am able to push to http event collector and create dashboards. However, if I save the same json event data to a logfile and use the forwarder then Splunk is unable to extract the fields. My sample json event is below. {"time":1668673601179, "host":"SAG-13X8573", "event": {"correlationid":"11223361", "name":"API Start", "apiName":"StatementsAPI", "apiOperation":"getStatements", "method":"GET", "requestHeaders": {"Accept":"application/json", "Content-Type":"application/json"}, "pathParams": {"customerID":"11223344"}, "esbReqHeaders": {"Accept":"application/json"} } } if I post this to http event collector I am able to see the fields correctly like below. If I save the same json data to a log file and forwarder sends this data to Splunk, it couldn't parse the data properly. All I see is like below. The event fields are not extracted properly including the timestamp. Should I format the json data in any other way before writing it to log file? Or any other configurations need to be done to make it work? Pls let me know. Thank you
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-16-2023
10:01 AM
|
