Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sathiyasun
sathiyasun
Explorer
Member since:
10-27-2014
12-03-2024
Community Statistics
| Posts | 54 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 10-27-2014 |
Activity Feed
- Posted AWS VPC Flow logs getting ingested non-human readable format on Getting Data In. 12-03-2024 07:52 AM
- Posted TIME_PREFIX on Getting Data In. 04-12-2024 09:24 AM
- Posted How do i re-ingest data from a particular source? on Security. 11-15-2023 08:51 AM
- Tagged How do i re-ingest data from a particular source? on Security. 11-15-2023 08:51 AM
- Karma Re: _time is 6hrs behind but the event time is real time. for richgalloway. 11-15-2023 06:01 AM
- Posted _time is 6hrs behind but the event time is real time. on Security. 11-14-2023 09:35 AM
- Tagged _time is 6hrs behind but the event time is real time. on Security. 11-14-2023 09:35 AM
- Posted Extract jSON formated data on Splunk Search. 10-31-2023 01:47 PM
- Posted Splunk SaaS licensing usage ovetime per index. on Splunk Search. 08-07-2023 03:11 PM
- Tagged Splunk SaaS licensing usage ovetime per index. on Splunk Search. 08-07-2023 03:11 PM
- Posted In Splunk SaaS Cloud, how would I get daily data ingest volume by indexes? on Installation. 07-26-2023 06:35 AM
- Posted How to mask the indexed data in Splunk cloud? on Getting Data In. 05-22-2023 01:53 PM
- Posted How do I ignore few keyword contained events at forwarder not to send? on Getting Data In. 05-12-2023 09:53 AM
- Posted How to set GMT +1 timezone in props? on Getting Data In. 04-10-2023 10:08 AM
- Posted What configuration should I add to parse all the 20+ data sources in a server? on Getting Data In. 02-22-2023 03:21 PM
- Tagged What configuration should I add to parse all the 20+ data sources in a server? on Getting Data In. 02-22-2023 03:21 PM
- Posted Searches getting queued on Splunk Enterprise. 12-29-2022 08:09 AM
- Tagged Searches getting queued on Splunk Enterprise. 12-29-2022 08:09 AM
- Posted How to have html tags displayed as text in alert? on Alerting. 12-27-2022 07:47 AM
- Posted Event mismatch to different forwarding servers? on Splunk Search. 10-27-2022 06:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-27-2018
12:03 PM
Have been getting "Could not use srptime to parse timestamp from Token TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382 , Failed to parse timestamp defaulting to file modtime. Please advice.
Log:-
INFO:SESSION TOKEN = DD215569A74FB06F5BC0C966CF60AD86:2018-08-27 14:28:06,382
INFO:REQUEST:2018-08-27 14:28:15,000
INFO:
<web:CreateRecord>
Props.conf
[ wsa:splunkalert:log ]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)(\w+\:\w+\s\w+\s\=\s\w+\:\d+\-\d+\-\d+\s\d+\:\d+\:\d+\,\d+)
MAX_TIMESTAMP_LOOKAHEAD=30
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false
TIME_FORMAT= %H-%m-%d %H:%M:%S,3N
TIME_PREFIX=\s
disabled=false
pulldown_type=true
... View more
08-22-2018
07:48 AM
Thanks it works!!!
... View more
08-21-2018
08:36 AM
My custom script writes log in /opt/splunk/var/log/splunk/script.log.
I want the log to be indexed in _internal but have to define a customized sourcetype for the log to write in a proper linebreak. Please let me know how to define sourcetype for the _internal data.
... View more
07-15-2018
07:42 PM
When I try to run the python script have been getting the below error. Please advice. Also, trying to configure the threatconnect app but not luck if you have any steps please share that one as well. Thanks.
[spladmin@Splunklab bin]$ ./tc_report.py
Traceback (most recent call last):
File "./tc_report.py", line 11, in
import splunk.Intersplunk
ImportError: No module named splunk.Intersplunk
[root@Splunklab ~]# whereis python
python: /usr/bin/python /usr/bin/python2.7 /usr/lib/python2.7 /usr/lib64/python2.7 /etc/python /usr/include/python2.7 /usr/share/man/man1/python.1.gz
[root@Splunklab ~]# yum list python
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos, subscription-manager
Installed Packages
python.x86_64 2.7.5-68.el7 @rhel-7-server-rpms
Uploading Enabled Repositories Report
Loaded plugins: product-id, subscription-manager
... View more
06-25-2018
02:20 PM
When I configured log file monitoring it worked only on that day till 11:59PM and then no events are getting indexed. Please recommend.
In splunkd.log have been getting the message.
06-25-2018 17:12:21.197 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
06-25-2018 17:12:31.201 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-2018.05.11.gz'.
Inputs.conf
[monitor:///opt/amz/xyz/logs/sap/prod1/cbc/xyz_3.0.log-*]
whitelist = OrderFulfillment_3.0.log-\d{4}.\d{2}.\d{2}
disabled = false
index = main
sourcetype = sap
initCrcLength = 256
... View more
10-19-2017
08:40 AM
===This was my customized menu bar but its not getting added. I don't why the xml is get getting posted here in site.
... View more
10-19-2017
08:04 AM
I tried to add the "Trac" menu bar but its not getting added.
... View more
10-18-2017
12:49 PM
We added the new view name in default.xml file and restarted Splunk but the new menu bar (view name) is not getting added to the app menu bar. Please advise.
search_view="search" color="#65A55">
========>Customized view name.(For some reason was not able to post the complete .xml )
... View more
09-05-2017
08:07 AM
06-27-2017
09:58 AM
Still no luck. Changed to IP but still when it load the web routing to default host name.
... View more
06-27-2017
07:52 AM
When i click on the view results I want the IP address to open the Splunk web not the default host name.
In an triggered email "view results" when I click on I want Splunk web to open with IP based link not the default host name based link. Please find the attached "gif" for ref and let me know how to change it. Thanks.
... View more
03-17-2017
08:04 AM
Yes, we have the same props config in Indexer as well. Here the issue is the same props is working data from some of fw's data but it not working on some fw's.
... View more
03-16-2017
01:28 PM
props.conf
[log1]
BREAK_ONLY_BEFORE = \w+\s+\w+\s+\d+\s+\d+\:\d+\:\d+\s+\w+\s+\d+
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
Below is my sample event, we need to break line after the first line.
Wed Mar 15 10:17:32 CDT 2017 ---------break the line
Config Path= /etc/httpd/conf/httpd.conf
Certificate Location= /etc/httpd/conf.d/com/com.crt
notBefore=Jul 6 00:00:00 2016 GMT
notAfter=Jul 6 23:59:59 2017 GMT
subject= /C=US/postalCode=00000/ST=Confgtyre/L=Norwalk/street=123 ABC Avenue/O=XYZ Services/OU=World Headquarters/OU=Issued through XYZ Services E-PKI Manager/OU=InstantSSL/CN=services.xYZ
issuer= /C=GB/ST=Greater Missouri/L=Salford/O=COMODO CA Limited/CN=DO XYZ Organization Validation Secure Server PA
I have written the regular expression to break the line but its not doing it.
\w+\s+\w+\s+\d+\s+\d+\:\d+\:\d+\s+\w+\s+\d+
... View more
02-06-2017
11:22 AM
Hi,
I want to use a search which is running in paid app called "pinger" to my own app called "XYZ"
Is there any way to do this ?
Thanks.
... View more
02-06-2017
07:19 AM
I guess that is the issue.. I am using Splunk 6.3.1.. Thanks. Let me try to upgrade it and see if that works for me .
... View more
02-06-2017
07:15 AM
I am using Splunk 6.3.1.. do you think that could be an issue here ?
... View more
02-03-2017
02:25 PM
so here is my search :
index=* sourcetype=xyz source=pp iso_direction="outgoing" *0210*
| eval Error_Count=if(de39_response_code!=00,"true","false")
| table _time de39_response_code Error_Count
| streamstats count by Error_Count
Current result :
_time de39_response_code Error_Count count
2017-01-30 09:57:26.505 05 true 1
2017-01-30 09:56:37.142 05 true 2
2017-01-30 09:55:52.728 05 true 3
2017-01-30 09:55:40.469 05 true 4
2017-01-30 09:49:19.215 00 false 1
2017-01-30 09:49:10.167 05 true 5
2017-01-30 09:42:49.599 05 true 6
2017-01-30 09:30:32.162 05 true 7
2017-01-30 09:54:41.951 05 true 8
So when i am trying to use the command : reset_on_change=true its give me error invalid argument and doesn't reset the count
Expected result :
index=* sourcetype=xyz source=pp iso_direction="outgoing" *0210*
| eval Error_Count=if(de39_response_code!=00,"true","false")
| table _time de39_response_code Error_Count
| streamstats count by Error_Count reset_on_change=true
_time de39_response_code Error_Count count
2017-01-30 09:57:26.505 05 true 1
2017-01-30 09:56:37.142 05 true 2
2017-01-30 09:55:52.728 05 true 3
2017-01-30 09:55:40.469 05 true 4
2017-01-30 09:49:19.215 00 false 1
2017-01-30 09:49:10.167 05 true 1
2017-01-30 09:42:49.599 05 true 2
2017-01-30 09:30:32.162 05 true 3
2017-01-30 09:54:41.951 05 true 4
any help?
... View more
07-06-2016
12:32 PM
I was using DM and a app to restart all the forwarders at once but it stopped working
Click on restart then save its not restarting the FW's. Please advice.
... View more
- Tags:
- splunk-enterprise
04-06-2016
03:39 PM
1 Karma
How to match keywords to identify in a field using regex.
Our requirement is to capture the keywords that are (Liquor OR Casino OR Gambling OR Adult) which comes in a field.
... View more
03-03-2016
08:20 AM
Here is the thing, I have all the files in forwarder location and want to monitor when the file was created and how long its sitting in the directory.
ls -ltr output --don't want to index the content in the files.
Please let me know how to index the files names and details(ls -lh) details in to splunk,
... View more
03-02-2016
01:46 PM
I want to monitor only files that are 3 hours old in a particular directory and DON'T want to index content of the files. Also, monitor the size of the files.
I want to set up alert for files in a directory that are more than 3 hour old and with size more than 200KB. Please let me know the possibilities.
... View more
02-09-2016
02:08 PM
We are trying to index the inode details for alerting on its usage. df -i. Please let me know how to index inodes details using splunk/SA-nix.
... View more
01-27-2016
09:20 AM
We have report that is scheduled once in a month to run and it emails the report, but here we have an issue in getting reports in the email.
When I check the triggered jobs, the job is successful, but the email is not delivering.
In the attachment we included pdf and csv. Approx size of the files between 20kb to 50kb on each attachment.
ERROR sendemail:378 - Connection unexpectedly closed: [Errno 104] Connection reset by peer while sending mail to
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-03-2024
11:13 AM
|
