About thambisetty

thambisetty · ‎08-20-2014

i have 3 indexers, 1 master node ,1 search head. i have configured email alerts on search head.

thambisetty · ‎08-20-2014

If PDF Report Server app is being used on a remote machine, set URL above. For example, https://remoteserver:8089/ - Leave blank to use a local PDF server (status page). Does not affect integrated PDF generation. reprotServerURL port 8000 or 8089 can u confirm this please...

thambisetty · ‎08-20-2014

yes, getting error but unable to paste it over here: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number while sending mail to: thambisetty.balaji@wipro.com

thambisetty · ‎08-19-2014

[email] mailserver = example.domain.com:port reportServerURL = use_ssl = 1 from = example@domain.com auth_username = example@domain.com auth_password = $1$qQW8E5cFZ2xL this is alert_actions.conf

thambisetty · ‎08-17-2014

no, i have used my company's username and password still it is not working..

thambisetty · ‎08-16-2014

could u tell me how did u configured email settings?

thambisetty · ‎08-16-2014

Hi Everyone, I am working in splunk distributed environment. i want to schedule pdf and make alerts so that have to configure email settings. In the email settings provided my exchange server and port also. i am confusing what to give username and password in email settings can anyone tell me how to do that please..

thambisetty · ‎08-16-2014

if i change the bundle configuration from master node,what about the data indexed already.

thambisetty · ‎08-05-2014

yes exactly..i have clustered environment.

thambisetty · ‎08-05-2014

Hi everyone, I am working on Splunk clustered environment, where i have 3 indexers,1 search head, and 1 head. Now i am facing the problem with low disk space. i configured index in index.conf in head node. my index is replicating in 3 indexers. if want to change index path in every indexer. what should i do please help me on this. now i have given path D://splunkdb/indexname. my index resides on D drive in every indexer. now i want to move this to F: drive in each indexer.

thambisetty · ‎07-06-2014

Hi, I am getting the logs from SBG,but splunk couldnt able to index those logs. I need to index those logs. I did field extraction for first 3 fields are common in every event. The main problem is The next fields depend up on the 3rd field that is action. Now i want to extract those fields and i need to name it for search purpose. below are the example events. 1> jul 7 04:02:01 wipro-blr-out01 ecelerity: 1404685921|cb5bdd57-f792c6d000001154-e6-53b9ce619b84|ACCEPT|203.91.221.85:50090 2> Jul 7 04:02:01 wipro-blr-out01 ecelerity: 1404685921|cb5bdd57-f792c6d000001154-e7-53b9ce61f951|IRCPTACTION|oceane-ias@orange.com|annotate 3>Jul 7 04:02:01 wipro-blr-out01 bmserver: 1404685921|cb5bdd57-f792c6d000001154-e7-53b9ce61f951|VERDICT|oceane-ias@orange.com|content_300|default|legal disclaimer if u see above events fisrt 3 fields are common so i named it. Now i want name the rest of fields by using following search. index=main sourcetype=ec_sbg_outbound action=accept----- now i will get all the events of action=accept it has only one field after action so i need to name for that field. like that i have to do all the action types.. please help me in advance thanks.....

thambisetty · ‎06-25-2014

now i want to remove that which i added to monitor earlier. May i konw how to do that.again i will add to monitor as u said

thambisetty · ‎06-25-2014

Hi, I have installed splunk forwarder on linux which is having symantec Brightmail Gateway. and i tried to forward the data from that machine to splunk indexer that forwarder sending data only one file under the folder. The path which i have given while adding the monitor: '/var/log/mail/symantec/inbound' under the inbound i want to read everything which has extension of type '.gz' i am getting error that is "parameter should be in this format '-parameter value' " while try to give the path like '/var/log/mail/symantec/inbound/*.gz' can anyone tell me why its happening like that please.......

thambisetty · ‎06-19-2014

Thank u soooo much. it worked.

thambisetty · ‎06-19-2014

I tried that one by that also im getting only BLR-DC-09$ I want to remove only - values from that field. your query is wrong..

thambisetty · ‎06-19-2014

for hyphen?

thambisetty · ‎06-19-2014

Thanks. Im not in office. may I know why that format..

thambisetty · ‎06-19-2014

Hi I have data like below in the Active Directory. Account Name - L-15485 D-5486 BLR-DC-09$ Here is my query; | search "Account Name"="-" showing Output: BLR-DC-09$ but actual output to be expected: L-15485 D-5486 BLR-DC-09$ Note: I read splunk document for -(hyphen) it says - for match any character. Now my question is how to escape that one as it works.

thambisetty · ‎06-19-2014

Thanks for ur immediate response. I tried that one but it is showing different src_IPs. The src_IPs not at all related to result of sub search.

thambisetty · ‎06-19-2014

and one more thing. by using transaction how many events can you search. I have 10000000 events in one index

thambisetty · ‎06-19-2014

Hi [index=main host=syslog status="deny"| top src_IP | table src_IP ]:::::this is my sub search. and it will produce top 10 src_IPs like below. 10.0.0.0 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 10.0.0.5 10.0.0.6 10.0.0.7 10.0.0.8 10.0.0.9 Now I want to check the status where status="start" OR status="accept" for the above src_IPs in the same index and host. Please help me in this.. Thanks in advance.

thambisetty · ‎06-19-2014

endswith=EventCode=4624 is taking but statswith=EventCode=4625 not taking.

thambisetty · ‎06-17-2014

Thanks for your quick response.but its not working

thambisetty · ‎06-17-2014

No I am not going to count of failure logins. I want Source _IP User if he succeed after more than 3 consecutive failures.

thambisetty · ‎06-17-2014

if I do | transaction Source_Address. It will group the events by source_address fine.but my question is different you too understood.

Posts	1134
Solutions	129
Karma Given	54
Karma Received	362
Member Since	‎03-27-2014

Online Status	Offline
Date Last Visited	3 weeks ago

Microsoft Office 365 Reporting Mail Add-on for Spl...

tenable add-on dest missing values

SPLUNK ES Notable Event Closure

Issue while downloading logs

Search is not running from JS

how to apply these trained data models to actual D...

getting econnreset error while trying to fetch azu...

Where does collect command indexes its result?

Query on Splunk certification

Is anyone using SPLUNK MLTK for windows events?

Re: How to configure email settings in search head

Re: How to configure email settings in search head

Re: How to configure email settings in search head

Re: How to configure email settings in search head

Re: How to configure email settings in search head

Re: In GUI, I cannot see email settings, which was...

How to configure email settings in search head

Re: How to move index from one hard drive to anoth...

Re: How to move index from one hard drive to anoth...

How to move index from one hard drive to another i...

symantec Brightmail gateway- SBG field extraction

Re: Splunk forwarder on linux: parameter format er...

Splunk forwarder on linux: parameter format error ...

Re: Doing lookup in the same index without using l...

Re: escaping hyphen if any field has hyphen(-) as ...

Re: escaping hyphen if any field has hyphen(-) as ...

Re: Doing lookup in the same index without using l...

escaping hyphen if any field has hyphen(-) as valu...

Re: Doing lookup in the same index without using l...

Re: how to get the value of field if another field...

Doing lookup in the same index without using looku...

Re: how to get the value of field if another field...

Re: how to get the value of field if another field...

Re: how to get the value of field if another field...

Re: how to get the value of field if another field...

Are you a member of the Splunk Community?