About ranjitbrhm1

ranjitbrhm1 · ‎05-15-2018

Good Day all, I have a query, I am uploading a CSV regularly onto splunk. Since its uploaded in a random time, splunk time does not apply here. The CSV actually have a field which has all the dates in them in DD-MM-YYYY format. My intention is to make a dashboard which is able to filter based on weeks 1-4 for events. Is there a method to determine what week the dates fall under i.e 4/01/2017 falls to week one, 10/4/2017 falls in week 2 etc? I know it might be a long shot, but is this a possibility?

ranjitbrhm1 · ‎05-14-2018

Im pretty sure this is not exactly the solution but try turning on the "Store a local copy" for lets say 5 minutes to verify that data is actually injecting into your heavy forwarder. then also login to the splunk console and then try telnetting into the receiving indexer's receiver port to make sure its not a network issue. Normally if there is some errors, there used to be a popup complaining that the receiver downstream is not receiving data and the data flow is stopped or something down the line like that. If both of the things are working fine then it might be something else.

ranjitbrhm1 · ‎05-14-2018

Ping the hostname perhaps on a terminal? It resolves by itself.

ranjitbrhm1 · ‎05-13-2018

Just like i said earlier, login to splunk, go to indexes, select an index that you dont really need and change the size. It will force a delete. Lets say one index is around 300 GB of space. You can change it to lets say 250 GB and force a delete of some data.

ranjitbrhm1 · ‎05-13-2018

Hello All, I want to write something that shows a single value with the below data Customer M 5 Units Customer N 15 Units Customer O 52 Units Customer P 54 Units Customer W 522 Units Customer Q 51 Units I want to see who is my biggest customer here. Obviously my biggest customer is W. But is there a way where i can show the biggest customer name on my dashboard? Like Biggest customer - "Customer W" I dont need to know any other details, Just the biggest customer name. Thanks

ranjitbrhm1 · ‎05-12-2018

This is classic disk full scenario. Go to splunk console and type df -l to verify what exactly is going on. If splunk is the one filling up space, one quick way to release space will be to go to your indexes in splunk and reduce the size of the indexes of unwanted indexes which will force a delete of excess data from your unwanted indexes. Long time solution will of course be to buy more storage and re assessing your retention policy. Also like above mentioned, increasing the free disk space might help based on how full your drive is.

ranjitbrhm1 · ‎05-08-2018

I eventually figured out what exactly was wrong here. I was spinning up VM's left and right with the default settings. So one settings which didn't occur to me was the hostname itself. So when i finished spinning up all the new servers, All the servers had the same hostname with different IP's. So according to the documentation, If UF's are not given a specific username during installation, then they will "Calculate" a hostname by themselves. Sooo when all the different servers with different IP addresses but the same hostname for splunk UF and the base server host name (In my case i left this as ubuntu which is the default settings for ubuntu server) connects to the forwarder this is what happens. Everything will work as normal but they will not get listed on screen. SO lets say 1 server with hostname Ubuntu connects to the DF, then it shows and when the second connects, the first one disappear and the second one appears. Sometimes 2 servers appears together but never more. I think its the way splunk is built. It dissects servers based on hostname and UF hostname and not with IP address. If this strange thing occurs to any of you fellow splunkers, then just check the hostnames first. I guess this kind of things only happens in lab environment. But still, Good to know information. /R

ranjitbrhm1 · ‎05-08-2018

I am configuring a splunk 7.1 with the latest universal forwarder. Now something very very weird is happening. When i come to the forwarder management page there is at most 2 clients listed on the page. And every time i refresh 1-2 clients come list on screen then disappear. I was for ever checking what is going on with my clients and why they are not connecting with my splunk instance. But whats happening is i can actually see all the apps getting deployed on to ALL the clients irrespective of the clients being listed on the forwarder manager or not. Is this a bug or something im doing wrong? I have a splunk 6.5 running concurrently and it is listing all the forwarders normally. The second image ive attached actually lists the clients on the filter tab. So basically i selected them and splunk forwarded apps as default. So thats whats confusing me the most. Its all working. BUT nothing gets listed on screen.

ranjitbrhm1 · ‎04-30-2018

Good Day splunkers. I have a query where i want to calculate the number of times a name came on the field, the average times the name was used and the percentage of the name in the field. (The below is truncated for understanding) splunkd 12,786 1.1% Apache#1 12,094 1.041% splunk-perfmon 11,788 1.015% java#3 11,684 1.006% rotatelogs 11,452 0.986% svchost#4 11,409 0.982% perl 11,078 0.954% emagent 10,821 0.931% Tomcat7 10,309 0.887% splunk-regmon 10,274 0.884% If the field values were numeric I could have counted and summed and created the avg. but when the field value names like above how do I go forward? I have done something similar once with eval but I can't seem to figure this out. Thanks

ranjitbrhm1 · ‎04-28-2018

Maybe im just bad in mathematics. but why does splunk docs always take the count of events and then the avg of events (stats count(events) | stats avg(events) instead of stats avg events directly? can someone please explain the logic to me?

ranjitbrhm1 · ‎04-23-2018

Think i read something else. I understand now. Thanks.

ranjitbrhm1 · ‎04-23-2018

Hello All, Im a bit confused with the installation of a UF on the windows machine. According to the documents, there are 2 methods to install splunk UF. One with the local account and one with the domain account. Now, My question is lets say im setting it up on a "web server" , Should i select local account or domain account to pull the web server logs, in this case the iis logs. Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password? Is it like i have a server and there are multiple people logging on to that "specific server" also if i install it as a domain user, will it not collect the system logs by default? Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?

ranjitbrhm1 · ‎04-18-2018

Thanks for the answer. I am pulling down the json using a curl script and put a continuous monitor in place for this to be injested on to the splunk instance.

ranjitbrhm1 · ‎04-18-2018

Hello All, Im a newbie to JSON and have pretty much no knowledge in programming. Can someone please assist in splitting the following json into diffrent events (split events). I have removed some details from JSON in compliance with the community rules, and rest of it is pretty much just dummy data. { "STATUS":"OK", "todo-items":[ { "id":17223591, "canComplete":true, "comments-count":0, "description":"", "has-reminders":false, "has-unread-comments":false, "private":2, "content":"Map Indexed Data of Windows Servers to Windows Infrastructure App", "order":2000, "project-id":353705, "project-name":"IT18-03-IT Dashboarding System", "todo-list-id":1533948, "todo-list-name":"Phase Two", "tasklist-private":true, "tasklist-isTemplate":false, "status":"new", "company-name":"TECIT", "company-id":103131, "creator-id":316954, "creator-firstname":"3333", "creator-lastname":"33333", "completed":false, "start-date":"20180325", "due-date-base":"20180415", "due-date":"20180415", "created-on":"2018-02-21T05:53:40Z", "last-changed-on":"2018-03-29T11:41:56Z", "position":2000, "estimated-minutes":0, "priority":"", "progress":0, "harvest-enabled":false, "parentTaskId":"17223590", "lockdownId":"806894", "tasklist-lockdownId":"806894", "has-dependencies":2, "has-predecessors":0, "hasTickets":false, "timeIsLogged":"0", "attachments-count":0, "responsible-party-ids":"317122,316954", "responsible-party-id":"317122,316954", "responsible-party-names":"Projects T.|3333.", "responsible-party-type":"Person", "responsible-party-firstname":"33333", "responsible-party-lastname":"3333", "responsible-party-summary":"You + 1 other", "predecessors":[ ], "parent-task":{ "content":"Customization - Infrastructure Log Monitoring / HW", "id":"17223590" }, "canEdit":true, "viewEstimatedTime":true, "canLogTime":false, "userFollowingComments":false, "userFollowingChanges":false, "DLM":0 }, { "id":17223405, "canComplete":false, "comments-count":1, "description":"", "has-reminders":false, "has-unread-comments":false, "private":2, "content":"fdfdfdfdfdfd", "order":2000, "project-id":353705, "project-name":"asdf", "todo-list-id":1533948, "todo-list-name":"Phase Two", "tasklist-private":true, "tasklist-isTemplate":false, "status":"new", "company-name":"asdasd", "company-id":103131, "creator-id":316954, "creator-firstname":"3333", "creator-lastname":"333333", "completed":false, "start-date":"20180227", "due-date-base":"20180408", "due-date":"20180408", "created-on":"2018-02-21T04:42:49Z", "last-changed-on":"2018-03-29T10:34:36Z", "position":2000, "estimated-minutes":0, "priority":"", "progress":0, "harvest-enabled":false, "parentTaskId":"17223403", "lockdownId":"806894", "tasklist-lockdownId":"806894", "has-dependencies":2, "has-predecessors":0, "hasTickets":false, "timeIsLogged":"0", "attachments-count":0, "responsible-party-ids":"221525", "responsible-party-id":"221525", "responsible-party-names":"3333A.", "responsible-party-type":"Person", "responsible-party-firstname":"3333", "responsible-party-lastname":"Al33i", "responsible-party-summary":"3333A.", "predecessors":[ ], "parent-task":{ "content":"Work Package 3", "id":"17223403" }, "canEdit":false, "viewEstimatedTime":true, "canLogTime":false, "commentFollowerSummary":"You + 2 others", "commentFollowerIds":"221525,316954,317122", "userFollowingComments":true, "userFollowingChanges":false, "DLM":0 },

ranjitbrhm1 · ‎04-16-2018

Im an absolute idiot. I figured it out

ranjitbrhm1 · ‎04-16-2018

I didn't have the vendor sales and the secure log files, Thanks for that. But on the accesslogs its missing that one field 'Price' of each product. Most of that course is based on or around the price tag where we have to calulate the price of products and so on and so forth. So im looking for that specific log file.

ranjitbrhm1 · ‎04-16-2018

Hello All Splunkers, I was wondering if someone have a dummy data for the access-combined source type. I am looking for that data that the trainers use when they train in Splunk coursers. The reason i need it is because i just finished the advanced searching and reporting course and i want to study the concepts using my splunk server. I got a dummy data but it lacks the sale_price value in it. Most of the questions are built on or around that field and im finding it difficult to learn without that field. Is there someone who have the original dummy data that they use for the courses here? I know its the same data that they use from fundamentals 1 all the way till consultant. thanks

ranjitbrhm1 · ‎04-11-2018

As always your help and suggestions are most appreciated. I will spin up a splunk server and a couple of clients and test this out. I myself have a couple of concepts that i need testing as well. Thanks /R

ranjitbrhm1 · ‎04-11-2018

Thanks for the answer @niketnilay as always. I really appreciate it. But my main problem is on which %SPLUNK_HOME%\etc\system\local\inputs.conf do i make the changes to ? the app that i use to deploy the inputs.conf to the UF's. The heavy forwarders inputs or the indexers input. Thats the question that is boggling me. I tried sending out this change via the DMC on to the UF's but it does not have any effect it seems. My inputs.conf file is as below [WinEventLog://Application] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest index = winevents [WinEventLog://Security] checkpointInterval = 5 current_only = 0 disabled = 1 start_from = oldest index = winevents blacklist = 5156|5157|5158 [WinEventLog://System] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest index = winevents [WinEventLog://ForwardedEvents] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest index = winevents [perfmon://Windows__Processor] counters = * instances = _Total interval = 10 object = Processor index = winevents [perfmon://Windows__Memory] counters = Available Bytes interval = 10

ranjitbrhm1 · ‎04-11-2018

Hello All, I have a distributed system where i have a heavy forwarder collecting traffic from the UF's and forwarding events to the indexer. I have a DMC which is on another server. Currently im getting bombarded with 5156 and 5157 error messages from windows security. Ive read somwhere that i can blacklist the values on inputs.conf. Can someone please let me know on which inputs.conf file on which server i have to do the blacklist on? Alternatively is there any other method to control this constant flow of data?

ranjitbrhm1 · ‎04-11-2018

This is proper. Thanks @niketnilay for taking effort in writing the query for me. Thanks

ranjitbrhm1 · ‎04-10-2018

Thank you all for the suggestions. I wrote a query very similar to @p_gurav answer index="bsg" | eval deadline_epoch=strptime(task_deadline,"%m/%d/%Y")| eval end_epoch=strptime(task_end_date,"%m/%d/%Y") |eval diffrence=(end_epoch-deadline_epoch) |eval p_status=round((diffrence)/86400,0) | fillnull value=pending| stats count(eval(p_status>0)) as on_time, count(eval(p_status<0)) as delayed, count(eval(p_status=pending)) as deffered by Project_Title But my challenge now is on the pie its not showing the delayed and on time correctly and deffered split by project name. My sample data looks like this. I uploaded it off a CSV that we created, Project_Title Project_Manager task_start_date task_end_date task_deadline Tasks project_start_date project_end_date project_completed_date Splunk Implementation Imran 2/2/2018 4/1/2018 3/2/2018 Install os 2/2/2018 3/5/2018 Splunk Implementation Imran 2/2/2018 4/1/2018 3/2/2018 Assign host name 2/2/2018 3/5/2018 Splunk Implementation Imran 2/2/2018 4/1/2018 3/2/2018 Assign IP address 2/2/2018 3/5/2018 Splunk Implementation Imran 2/2/2018 4/1/2018 3/2/2018 Install splunk 2/2/2018 3/5/2018

ranjitbrhm1 · ‎04-10-2018

Hello Guys, I have a query. I want to show the following data as pie where the pie visualisation should have a count of -ve value, +ve value and values showing pending with the projects to which they are attached to. Below is the data tabled. 30 Trendmicro implementation 30 Trendmicro implementation Pending Trendmicro implementation Pending Trendmicro implementation Pending Trendmicro implementation -18 Trendmicro implementation -18 Trendmicro implementation -18 Trendmicro implementation -18 Trendmicro implementation 426 Mcafee installation 426 Mcafee installation 426 Mcafee installation Pending Mcafee installation -37 Mcafee installation -37 Mcafee installation -37 Mcafee installation -37 Mcafee installation So ideally for me the pie chart would be having 3 slices where +ve values are 1 piece, --ve value is 1 piece and pending is also 1 pie. Is there a method where we can visualise the data?

ranjitbrhm1 · ‎04-10-2018

absolute spot on. But during that time instead of now() i actually converted _time back to epoch and then followed the remaining step. But your answer is 100% correct. Thanks

ranjitbrhm1 · ‎04-09-2018

Hello All, I am trying to injest into splunk a CSV which has a field called "Project End Date" and the field is in this format 11/7/2017 i.e dd/mm/yy. I am trying to find out how many days since the project is outstanding or how many days for the project to be completed. Project_Title Project_Manager Task Start Date Task End Date Tasks Project Start Date Project End Date Splunk Implementation user 2/2/2018 3/2/2018 Install os 2/2/2018 1/5/2018 Splunk Implementation user 2/2/2018 install universal forwarder in two linux 2/2/2018 1/5/2018 So basically i would need to subtract the project end date from the current date to see how many days the project is pending or how many days the project still have? thanks

Posts	70
Solutions	3
Karma Given	13
Karma Received	1
Member Since	‎03-07-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

sourcetype not applying eval and field alias

Movement of buckets in an indexer cluster

Comparing fields in searches to find common values

Issues after upgrading Splunk Enterprise security ...

SED command on props

help with breaking events from router

Why are feeds occasionally failing to download to ...

How to migrate an index from a single instance to ...

need line breaking for the following data generate...

IS IIS and Apache logs of any use in enterprise se...

How to convert field date into week values?

Re: Why did my heavy forwarder stopped forwarding ...

Re: How to find IP address of a host reporting in ...

Re: Splunk Dispatch issue: Why is the monitoring c...

How to write a query to show the top performer (Si...

Re: Splunk Dispatch issue: Why is the monitoring c...

Re: splunk enterprise 7 acting very wierd

splunk enterprise 7 acting very wierd

How to calculate average and percentage for fields...

Average command vs count and average command

Re: Options on installing universal forwarders on ...

Options on installing universal forwarders on "Win...

Re: How to split the following JSON into different...

How to split the following JSON into different eve...

Re: Splunk dummy data from classes

Re: Splunk dummy data from classes

Splunk dummy data from classes

Re: getting bombarded with windows security error ...

Re: getting bombarded with windows security error ...

getting bombarded with windows security error code...

Re: Pie charting data below

Re: Pie charting data below

Pie charting data below

Re: Subtract date from todays date to find status ...

Subtract date from todays date to find status of t...