About krylov

krylov · ‎10-06-2021

Good afternoon! I have a XPRT_002_SYSAT-41777_202110020712.csv file. After some time, exactly the same XPRT_002_SYSAT-41777_202110020712.csv file appears in my directory, with exactly the same content, but with a different modification time. In this case, the system indexes all events from this file twice and I have duplicates. I know that they can be filtered by means of dedup _raw, but it is not my way because it very strongly worsens search performance. Are there any other ways to configure indexing based on file changes rather than name and size, and if they match, do not index again? Tried: crcSalt = <SOURCE> CHECK_METHOD = modtime

krylov · ‎06-16-2020

The question isn't longer relevant. The problem solved by the procedure described in this ask https://community.splunk.com/t5/Knowledge-Management/After-upgrading-to-6-5-0-KV-Store-will-not-start/td-p/234713

krylov · ‎06-15-2020

Good afternoon! After upgrade to version 8.0.4.1 from 8.0.1 KV Store status failed. Failed to start KV Store process. See mongod.log and splunkd.log for details. 15.06.2020, 21:12:09 KV Store changed status to failed. KVStore process terminated.. 15.06.2020, 21:12:08 KV Store process terminated abnormally (exit code 14, status exited with code 14). See mongod.log and splunkd.log for details. ./splunk show kvstore-status This member: backupRestoreStatus : Ready disabled : 0 guid : A5CBF13E-6100-40DA-8C51-541893E5A0A0 port : 8191 standalone : 1 status : failed /data/splunk/var/log/splunk/mongod.log 2020-06-16T05:25:17.315Z W CONTROL [main] net.ssl.sslCipherConfig is deprecated. It will be removed in a future release. 2020-06-16T05:25:17.323Z F NETWORK [main] The provided SSL certificate is expired or not yet valid. 2020-06-16T05:25:17.323Z F - [main] Fatal Assertion 28652 at src/mongo/util/net/ssl_manager.cpp 1214 2020-06-16T05:25:17.323Z F - [main] ***aborting after fassert() failure /data/splunk/var/log/splunk/splunkd.log ERROR KVStoreAdminHandler - An error occurred. ERROR KVStorageProvider - An error occurred during the last operation ('replSetGetStatus', domain: '15', code: '13053'): No suitable servers found (`serverSelectionTryOnce` set): [connection closed calling ismaster on '127.0.0.1:8191'] ERROR KVStoreIntrospection - failed to get introspection data Could you help me figure out how to fix this? Thanks in advance!

krylov · ‎01-19-2020

Thanks! It really works.

krylov · ‎01-17-2020

Good afternoon! I need to do the following: 1. Using a search result that finds the last timestamp in a certain time interval, add it to another search № 2 index=status beamID=1 | stats latest(statustime) 2. Real-time search: index = status beamID=1 time = "result of search №1" | stats count(eval(terminalStatus="normal")) as NORMAL count(eval(terminalStatus="critical")) as CRITICAL count(eval(terminalStatus="pending-registration")) as PENDING-REGISTRATION count(eval(terminalStatus="unknown")) as UNKNOWN count(eval(terminalStatus="minor")) as MINOR count(eval(terminalStatus="major")) as MAJOR count(eval(terminalStatus="activationFailed")) as ACTIVATIONFAILED by beamID Is it possible to do this? Thanks in advance!

krylov · ‎05-18-2017

Thanks you! It really works

krylov · ‎05-17-2017

I want exclude fields bar and baz with all their values before indexing. I have CSV log: foo,bar,baz abc,123,456 abcd,234,567 abcd,456,567 bcd,345,678 How I can do it? Thanks in advance!

Posts	7
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎05-17-2017

Online Status	Offline
Date Last Visited	‎10-07-2021 05:58 AM

Problem with indexing the same filename

KV Store status failed after upgrade to 8.0.4.1?

Using latest timestamp in another search

Filter csv logs before indexing

Problem with indexing the same filename

Re: KV Store status failed after upgrade to 8.0.4....

KV Store status failed after upgrade to 8.0.4.1?

Re: Using latest timestamp in another search

Using latest timestamp in another search

Re: Filter csv logs before indexing

Filter csv logs before indexing