Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About varad_joshi
varad_joshi
Communicator
Member since:
08-10-2015
09-15-2020
Community Statistics
| Posts | 84 |
| Solutions | 3 |
| Karma Given | 33 |
| Karma Received | 15 |
| Member Since | 08-10-2015 |
Activity Feed
- Posted Introducing Splunk DS to an existing Splunk environment on Installation. 09-15-2020 06:36 AM
- Posted How to remove search button below the panel and search capabilities as well on Dashboards & Visualizations. 08-17-2020 10:18 AM
- Karma Re: While trying to configure a Phantom server on Splunk 7.0.0 it says "Update in progress" and will not progress for orhiee. 06-05-2020 12:49 AM
- Karma Re: How do I auto-refresh a dashboard? for woodcock. 06-05-2020 12:49 AM
- Karma Re: Can Phantom be integrated with Splunk without Splunk ES being used? for hardikJsheth. 06-05-2020 12:49 AM
- Karma Re: After upgrading from Splunk DB Connect 1 to version 2, I set up a dbinput, but why does the status change from Enabled to Disabled? for davebrooking. 06-05-2020 12:48 AM
- Karma Re: After upgrading from Splunk DB Connect 1 to version 2, I set up a dbinput, but why does the status change from Enabled to Disabled? for jtrujillo. 06-05-2020 12:48 AM
- Karma Re: permission denied error while applying cluster bundle from cluster master to slave indexers for esix_splunk. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for Why are searches stuck at "finalizing job" after upgrade to 6.5.0?. 06-05-2020 12:48 AM
- Got Karma for How to roll all hot buckets from hot to warm?. 06-05-2020 12:48 AM
- Got Karma for Re: Where can I blog my Splunk experiences?. 06-05-2020 12:48 AM
- Got Karma for Re: Where can I blog my Splunk experiences?. 06-05-2020 12:48 AM
- Got Karma for Re: Where can I blog my Splunk experiences?. 06-05-2020 12:48 AM
- Got Karma for Re: After upgrading from Splunk DB Connect 1 to version 2, I set up a dbinput, but why does the status change from Enabled to Disabled?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-26-2017
01:46 AM
Pretty silly thing but tried clearing cache and cookies??
... View more
03-26-2017
01:24 AM
What you need is summary indexing. This can schedule the search at regular interval and save the results for you for end of the month.
Please go through the link in detail and you'll have the answer.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Usesummaryindexing
... View more
02-26-2017
01:08 AM
How to make Splunk Windows app work on Standalone Splunk instance?
I installed Windows add-on and Windows app on my machine but I do not see charts and graphs populated.
One of the requirements is to monitor all Windows services. How do I go ahead with this?
... View more
02-20-2017
02:06 AM
I am trying to configure the Splunk app for VMware and its not populating any data.
Can someone please help me with what goes where.
I have 1 SH and 1 Indexer.
I need to know where do I install Splunk app for VMware and where will the Add-on app will go.
I went through the video on YouTube as well. I'd rather prefer someone telling me here so that I have queries, I can post them.
... View more
02-16-2017
04:16 AM
I did this to get rid of $ and commas
| replace "$" with "" in "My Field" | replace "," with ** in "My Field"
And used your last line to add $ and commas again.
| eval "My Field" = "$".tostring('My field',"commas")
Only thing is, many of my values are now blank.
Only the amounts with total 3 digits are being populated. They won't have commas.
Any value above $999 i.e $1,000 is not getting populated.
... View more
02-16-2017
12:46 AM
I saw some answers already however did not find anything concrete so asking a new question.
I have a field where values are in USD, like $123,4.00.
I want to run addcoltotals on the field, and bring back the currency sign and commas once the operation is done.
I got rid of currency sign and commas using following:
| replace "$" with "" in | replace "," with ** in
Not sure if I need to use replace twice, using a comma didnt work for me so using replace command twice.
Now which would be the best way to get rid of $ and , signs and add the numbers. And then bring back those signs again.
... View more
02-09-2017
05:50 AM
This can be achieved by passing tokens. Check these 2 links:
http://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Tokens_available_for_email_notifications
http://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/EmailNotificationTokens
... View more
02-09-2017
05:36 AM
On the UF have you configured outputs.conf file to forward the data??
Please ensure you have inputs.conf and outputs.conf configured and your Splunk server is ready to receive the logs.
... View more
02-07-2017
01:13 AM
bleaf demo is available for partners only:
Once you are in partner portal-Certification-SE I
It's under Certification path - SE I 6.3 Cert STEP 3 Splunk Demo - Certification - SE I 6.3 Demo Package - Certification - SE I 6.3 - SPL for bLeaf
Hope that helps.
... View more
02-02-2017
04:42 AM
1 Karma
haha you beat me with few seconds there, and you posted the exact query. Yes, this should work for the OP.
... View more
02-02-2017
04:40 AM
How about this.
Convert them in epoch time and then do the selection with an IF clause. Select whichever is larger.
Just shared the logic, see if that works for you.
... View more
11-03-2016
11:49 PM
Splunk will detect if you configure it to detect.
Not sure if there is an inbuilt functionality but here is what I do.
Setup an search that checks for failed password on daily basis. Check for ids which are constantly appearing on daily basis for x number of times. If the pattern continues then you know if a hacker is trying to break into a particular id.
... View more
11-03-2016
11:36 PM
I would like to know the best practices to mask the data in a particular scenario.
I have 2 applications hosted on 2 different Linux servers which are sending logs to Splunk. Both the application owners also want to send their server related logs to Splunk so we decided to install TA for UNIX on the application servers.
Both the TA for UNIX are not sending information to Splunk and logs are being viewed in Splunk app for UNIX on SH.
Which are are best way to mask server1's information to be viewed by users of server2?
Usually we restrict users on app and index level, however its is just one app (Splunk app for UNIX) so I was wondering different ways to mask.
... View more
10-18-2016
10:20 PM
DB will have hundreds of records. Its difficult to compare fields and values 😞
... View more
10-13-2016
11:27 PM
I typed that too early..
Little search and I was able to find it.
index=_internal source=*metrics.log group=udpin_connections | dedup sourcePort
... View more
10-13-2016
11:21 PM
Thank you for this. If my Splunk is listening on UDP as well then will to show here?
I searched in my environment with 'index=_internal source=*metrics.log | top fwdType' and I got only uf and full. How do I get UDP as well?
... View more
10-13-2016
10:48 PM
Can you please try this -
Go to alert - Alert Mode - Select Once per search. -- This should restrict it to one alert per search.
THEN
The option below is Throttling.
Check that box for ' After triggering the alert, don't trigger it again for'
Mention the time after which next alert is about to run.
As @Somesoni2 mentioned, do not keep it for real time. Keep it to run every 5 minutes.
Change throttling value according to your run time and see if this helps.
... View more
10-13-2016
10:37 PM
3 Karma
I'd like to follow your Blog. Following this Question for now. Please post your blog URL once you start.
Cheers.
... View more
10-13-2016
10:31 PM
So my Db Conenct fetches the data from the database and dumps it in an index.
I upgraded DB Connect by installing v2 of DB Connect and ran those 3 awesome scripts to migration all the DBs and connections and identities.
Which is the way to ensure DB has not missed fetching any data during the upgrade phase.
... View more
10-06-2016
09:29 AM
Ah more and more folks reporting this as solution.
Thanks again for confirming.
@Splunk should definitely look into it. It's a pain to ask my 200 users to clear cache of their browser.
... View more
10-05-2016
10:45 PM
Thanks for the answer @sgarvin55 and thanks @polymorphic for confirming the solution.
A colleague of mine who was accessing the same Splunk instance never cleared browser cache. Still it started working for her.
I had cleared it though on my browser.
Still a strange solution if we need to ask all users to clear their browser cache in order to use 6.5 😄
... View more
10-05-2016
11:38 AM
Please vote this question then. Might make an impact.
... View more
10-05-2016
07:00 AM
Oh yes.. I missed mentioning that.. Infact all dashboard also works fine
... View more
10-05-2016
06:47 AM
What OS you are running? I see no mention of Win 7 while downloading executable.
Also I already heard it giving issues on Win 7 32 bit machines.
... View more
10-05-2016
04:29 AM
Hopefully someone will have a concrete answer.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-15-2020
10:35 AM
|
Karma from
Karma given to
