All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Dear Team, I am an AppDynamics user in my Organization. We have installed the Database agent in our own server and the AppDynamics team installed the AppDynamics Front end in some server I guess. w... See more...
Dear Team, I am an AppDynamics user in my Organization. We have installed the Database agent in our own server and the AppDynamics team installed the AppDynamics Front end in some server I guess. we are able to see the DB Agents and Collectors and data in the AppDynamics, but the issue is we are able to see all the Agents (its Metrics, Policies etc)  of other agents in our Org.  This is inconvenient. 
Do hidden and depends panels count towards SVC usage if not displayed?
Hello, I have installed Splunk ITSI several times on various types of infrastructure, and I am observing this behavior for the first time. The latencies all have zero values as if they are not bein... See more...
Hello, I have installed Splunk ITSI several times on various types of infrastructure, and I am observing this behavior for the first time. The latencies all have zero values as if they are not being reported. I have adjusted the collection interval, but it hasn't made any difference. What I don't understand is that this issue concerns latencies of virtual machines, ESXi servers, and datastores, while all other KPIs are okay. Is it possible that Splunk cannot collect certain values even though others are being collected? Do you have any idea about the root cause of this error?  IT Service Intelligence Version : 4.17.0 Splunk Enterprise Version : 9.0.5
I am noticing that the eStreamer Client Add-On is generating a lot of logs and filling up my Enterprise Server. Is there any way to mitigate this? It looks like the app will write 1000 lines of cod... See more...
I am noticing that the eStreamer Client Add-On is generating a lot of logs and filling up my Enterprise Server. Is there any way to mitigate this? It looks like the app will write 1000 lines of code per file. Is there any way to set an overwrite or scavenge setting so it doesn't just keep filling up the disk infinitely?   root@thall-splunk02:/opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk# du -sh /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk/ 87G /opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk/ root@thall-splunk02:/opt/splunk/etc/apps/TA-eStreamer/bin/encore/data/splunk# ll total 90725612 drwx--x--- 2 root root 151552 Sep 18 02:06 ./ drwx--x--- 3 root root 4096 Sep 13 12:18 ../ -rw------- 1 root root 27279093 Sep 13 12:18 encore.1694621917.log -rw------- 1 root root 28232829 Sep 13 12:18 encore.1694621924.log -rw------- 1 root root 28304921 Sep 13 12:18 encore.1694621930.log -rw------- 1 root root 28368804 Sep 13 12:19 en ...     wc -l encore.1694630328.log 10000 encore.1694630328.log
I have an old stand alone search head with Enterprise security and I'm migrating to a new search head cluster. Now I have 2 enterprise securities running in parallel and i need to migrate incident_r... See more...
I have an old stand alone search head with Enterprise security and I'm migrating to a new search head cluster. Now I have 2 enterprise securities running in parallel and i need to migrate incident_reveiw to the new cluster to see the history of all incidents in one place so i can shut down the stand alone search head.
Hello! I am using Splunk Enterprise Security app and whenever I access Security Posture Dashboard, the panels for both Top Notable Events and Top Notable Event Sources,  are very small. I am only ab... See more...
Hello! I am using Splunk Enterprise Security app and whenever I access Security Posture Dashboard, the panels for both Top Notable Events and Top Notable Event Sources,  are very small. I am only able to see 2 or 3 events at most and have to scroll up and down within the panel to see the rest of events. Is there any way to modify the panel size so that all top notable events are displayed without having to scroll within the small panel area? In previous versions, this panel used properly display at least 10 events without having to use any type  of scrolling. Same issue happens with both chrome and microsoft edge browsers. Any help would be very much appreciated, Thanks!
Hi @gcusello  I need something like below  Name Common Check Tool Specific   Running Service Name Application Name in Control Panel     UF Splunk Forwarder UF How we can che... See more...
Hi @gcusello  I need something like below  Name Common Check Tool Specific   Running Service Name Application Name in Control Panel     UF Splunk Forwarder UF How we can check the presence of uf like Path etc.,    
hi @jroeser1404  i have the exact same issue, did you resolve this maybe?
Hi @jerrynandak, add nomv to the end: | makeresults | eval id=11, event_type="ack" | fields id event_type | append [ | makeresults | eval id=11, event_type="req" | fields id event_type ] | append... See more...
Hi @jerrynandak, add nomv to the end: | makeresults | eval id=11, event_type="ack" | fields id event_type | append [ | makeresults | eval id=11, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=11, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=11, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=11, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=13, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=11, event_type="req" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=13, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="ack" | fields id event_type ] | append [ | makeresults | eval id=12, event_type="req" | fields id event_type ] | stats values(event_type) AS event_type BY id | nomv event_type Ciao. Giuseppe
Hi guys, I need some help trying to rename a specific field on condition that the renamed field is associated with one or more separate fields.       Fields: Device_Name Device_Interfa... See more...
Hi guys, I need some help trying to rename a specific field on condition that the renamed field is associated with one or more separate fields.       Fields: Device_Name Device_Interface SomeField Pseudocode: <some query> | if(Device_Name="Value1" AND Device_Interface="Value2" AND SomeField>="NumberX") --> rename Value2 as "This String" | if(Device_Name="Value1A" AND Device_Interface="Value2A" AND SomeField<"NumberY") --> rename Value2A as "This Other String"        
You will need a closing parenthesis in the eval statement if you copy and paste this solution.  Thank you for the assist! | eval created=strptime(whenCreated, "%I:%M:%S %p, %a %m/%d/%y") | where cr... See more...
You will need a closing parenthesis in the eval statement if you copy and paste this solution.  Thank you for the assist! | eval created=strptime(whenCreated, "%I:%M:%S %p, %a %m/%d/%y") | where created>=relative_time(now(), "-48h")
Hi @gcusello  values() only stores distinct values. So, your solution gives the following output which doesn't match my expected result. 11 ack req 12 ack req 13 ack req
Hi @bapun18, yes, you can: create you text input and drag it into your panel. Ciao. Giuseppe
hi @AL3Z, the validation criteria is the presence both in the lookup and in the search results of each host. ciao. Giuseppe
Hi @jerrynandak, please try this: <your_search> | stats values(event_type) AS event_type BY id Ciao. Giuseppe
I have hundreds of thousands of events of this form. id event_type 11 ack 11 req 11 ack 12 req 11 req 12 ack 11 ack 13 req 12 req 12 req 11 req 12 ack 13 ack 12 ack 13 req How ca... See more...
I have hundreds of thousands of events of this form. id event_type 11 ack 11 req 11 ack 12 req 11 req 12 ack 11 ack 13 req 12 req 12 req 11 req 12 ack 13 ack 12 ack 13 req How can I create req-ack pairs of these events so that I can find the time difference between req and ack? Expected pairing: 11 req-ack, req-ack 12 req-ack, req-ack, req-ack 13 req-ack    
The Tenable TA only pulls in events with new information ( a new scan date, change in a field or status) each time it accesses the data. Once an item is pulled in, it doesn't pull it a second time. T... See more...
The Tenable TA only pulls in events with new information ( a new scan date, change in a field or status) each time it accesses the data. Once an item is pulled in, it doesn't pull it a second time. That means if you scan half of your devices on Monday and half of your devices on Tuesday, you need to search looking back 2 days to see all of your current data.  Once an individual finding has been pulled in, it doesn't grab the same item again unless there is a change.
You can start out doing this in Splunk. Expand on the configs you want to look for in the search below, and then after you've pulled all of the configs you care about from rest endpoints, run a searc... See more...
You can start out doing this in Splunk. Expand on the configs you want to look for in the search below, and then after you've pulled all of the configs you care about from rest endpoints, run a search for the keyword you're looking for in it.   You can find a list of configuration files here: https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Listofconfigurationfiles | rest/services/configs/conf-macros | eval config="macros" | append [| rest/services/configs/conf-lookups | eval config="lookups"] | append [| rest/services/configs/conf-savedsearches | eval config="searches"] You can add in views and such using other endpoints, like | rest /services/data/ui/views
Hi All i am struggling with a query and appreciate some help please i received the data on csv file - timestamp is today  i'm interested in 3 fields Account_No , Total and Order_Date My view look... See more...
Hi All i am struggling with a query and appreciate some help please i received the data on csv file - timestamp is today  i'm interested in 3 fields Account_No , Total and Order_Date My view looks like this: Account_No      Total       Order_Date 123                      15.00        1/01/2023 123                      35.00        15/02/2023 123                      45.00        19/02/2023 456                      15.00         1/01/2023 456                      50.00        25/01/2023 456                     10.00        19/02/2023   I'd like a view like this                             Account_No            Jan                Feb Total Sum         123                          15.00            80.00                              456                           65.00            10.00   My main issue is using the eval to change the date format that appears in the csv file from 01/01/2023 to read January 2023 or even just January will probably do for this exercise.  I've come up with this so far | eval Order_Date = replace(Order_Date,"01", "January") but firstly i see 06/January/2023 and not just January  my other issue is that if any other month has 01 in it (for example 01/07/2023 it appears like this January/07/2023) Any ideas? Also i started looking at stats list command to group all Account_Nos together  main search..... | fields Order_Date Account_No Total | stats list(Total) as Total by Account_No i am unable to figure out how to get the subtotals for each Account_No    Any pointers would be appreciated    Thank you                
Hello @cbhattad  I'm not sure if this is still of use to you but have you setup the private key as per the documentation? Regards, RCA