https://lukemurphey.net/https://lukemurphey.net/favicon.ico2015-12-10T19:54:35ZLukeMurphey.netSyndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=30782015-12-10T19:54:35ZLuke Murphey
<ul></ul><p>Monitoring logs using:</p>
<p>index=_internal sourcetype="syndication_modular_input"</p> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=30792015-12-10T20:19:14ZLuke Murphey
<ul></ul><p>The latest_date is based on the latest entry.</p> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=30802015-12-10T22:14:51ZLuke Murphey
<ul></ul><p><a class="external" href="https://answers.splunk.com/feed/questions.rss">https://answers.splunk.com/feed/questions.rss</a></p> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=30812015-12-10T22:19:09ZLuke Murphey
<ul></ul><p><strong>Observations:</strong>
*</p> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=30822015-12-10T22:22:03ZLuke Murphey
<ul></ul><p>Here is the search I have for listing the internal operation of the code:</p>
<pre>
index=_internal sourcetype="syndication_modular_input" | rex field=_raw "(?<action>((Skipping)|(Including)))" | table date latest_date title action count
</pre> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32832016-02-07T00:00:24ZLuke Murphey
<ul></ul><p>Some observations:</p>
<ul>
<li>I see the input indicating that items are included, but I don't see them</li>
</ul> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32842016-02-07T00:01:55ZLuke Murphey
<ul></ul><p>I'm seeing the following error:</p>
<pre>
Received event for unconfigured/disabled/deleted index=training with source="source::syndication://Splunk Answers" host="host::answers.splunk.com" sourcetype="sourcetype::SplunkTraining-Answers". So far received events from 1 missing index(es).
</pre> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32852016-02-07T00:24:45ZLuke Murphey
<ul></ul><p>Fixed the index issue.</p>
<p>Now monitoring for changes via:</p>
<pre>
index=_internal sourcetype="syndication_modular_input" | rex field=_raw "(?<action>((Skipping)|(Including)))" | search count>0 OR action=Including | table date latest_date title action count
</pre> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32862016-02-07T03:24:09ZLuke Murphey
<ul></ul><p>Table format of events:</p>
<pre>
sourcetype="syndication" | eval time=strftime(_time, "%a, %d %b %Y %T %z") | table time title author link
</pre> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32872016-02-07T03:30:54ZLuke Murphey
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>In Progress</i></li></ul> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=32902016-02-19T00:04:53ZLuke Murphey
<ul></ul><p>Wondering if this is an issue where the connection fails and this isn't communicated well.</p> Syndication Input - Bug #1134: Failure to import changed itemshttps://lukemurphey.net/issues/1134?journal_id=33112016-02-23T19:54:31ZLuke Murphey
<ul><li><strong>Status</strong> changed from <i>In Progress</i> to <i>Closed</i></li></ul>