Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About prakash007
prakash007
Builder
Member since:
11-27-2018
06-01-2022
Community Statistics
| Posts | 220 |
| Solutions | 13 |
| Karma Given | 2 |
| Karma Received | 39 |
| Member Since | 11-27-2018 |
Activity Feed
- Posted Re: Configure Universal forwarder 8.1.0 to send data over HTTP on Splunk Enterprise. 06-01-2022 11:14 AM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 11-03-2021 09:28 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 08-25-2021 10:29 PM
- Got Karma for Re: Splunk Dashboard autorefresh all panels. 08-20-2021 12:56 AM
- Got Karma for Re: What are your Splunk t-shirt ideas?. 07-07-2020 02:47 AM
- Got Karma for Do we need a license for Heavy forwarder..?. 06-24-2020 01:28 PM
- Got Karma for Re: "Addon Metadata - Summarize AWS Inputs" is not enabled on Add-on instance?. 06-05-2020 12:51 AM
- Karma Re: Can you help us with the following "expandtoken" error?: "field larger than field limit (131072)" for sylim_splunk. 06-05-2020 12:50 AM
- Got Karma for Re: Defining Timestamp for HEC Input. 06-05-2020 12:50 AM
- Got Karma for Re: can't read "splunkdestinationip_withrd": no such variable. 06-05-2020 12:50 AM
- Got Karma for Re: How do I set dashboard to fast mode?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you use regex on 2 fields and combine them into one field for an xyseries?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: What do we need to write in TIME_FORMAT in props.conft to extract a timestamp?. 06-05-2020 12:50 AM
- Got Karma for Re: in a Splunk Distributed Environment, what is the limit of indexers by a single dedicated search head?. 06-05-2020 12:50 AM
- Got Karma for Re: How to push out an indexer bundle after rebuilding a server?. 06-05-2020 12:50 AM
- Got Karma for Re: Can you help me extract the information I want from the following JSON data (mvzip, mvindex, split)?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a list of what each privilege/capability permits?. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 1 |
04-22-2016
12:27 PM
can you just try and check the fields if you can find idx as we did a timechart by idx.
index=_internal source="/opt/splunk/var/log/splunk/license_usage.log"
... View more
04-21-2016
02:53 PM
based on the picture you attached it has to show the license usage by individual indexes. run the search for more than a day as the search says span=1d
... View more
04-21-2016
02:37 PM
Martin,
We're on 6.3.1, and we don't have a plan to upgrade to 6.4 shortly. Is there any way i can get a query which report maximum pool size overlays in the chart..?
... View more
04-21-2016
02:17 PM
I have been trying to create a timechart on license usage. I did try this search below..
index=_internal source=*license_usage.log* type=Usage NOT idx=sos| timechart span=1d sum(eval(round(b/1024/1024/1024,5))) by idx |eval Test=(uat1+uat2+uat3) | rename main As Prod | eval TotalLicenseConsumption=(Test+Prod) | fields - default uat1 uat2 uat3
Looking for a chart with below requirement. Any help would be appreciated.
1.to display the max license(200GB in my case) in the bar graph
2.show the individual usage line graph (might be a overlay graph on top of 1) for Test, Prod and Total license consumption.
... View more
04-20-2016
11:17 AM
Hi somesoni2,
I have put some filtering using props and transforms on HF before sending the data to cloud, will it work fine when i change it to slave or free license..?
... View more
04-20-2016
08:57 AM
Ktugwell,
I don't want to use indexing on HF, but still i have some regexs in props and transforms to filter/restrict/mask some of the data before sending it to cloud.
-do i need to convert it to slave or a free license would be fine..?
... View more
04-20-2016
08:46 AM
1 Karma
I have this workflow
UFs---------->HF---------->Splunkcloud
I'm using this HF just to route the data to Splunk clould without any indexing locally, but with few regexes for filtering in props and transforms. When i tried to login to HF GUI there was a message prompted to upgrade the license.
Can i convert that HF to a slave or a Free license..?
... View more
04-14-2016
08:29 AM
Hi muebel, I did try your command and it says connected
$ openssl s_client -connect apwebsvr:9997
CONNECTED(00000003)
3648:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:
Here's our data flow... UF------->HF-------->Splunkcloud, i did telnet and openssl from UF to HF which is connecting.
I don't see this message (Could not send data to output queue (parsingQueue), retrying..) when i restart the splunk instance on UF, but it's been happening every now and then.
Based on the message in the log, is parsingQueue gets filled up on UF or HF or Indexer...? just trying to understand to get a permanent solution. Thanks..!!
... View more
04-14-2016
08:12 AM
Yes it is connecting, i did $telnet servername port#
... View more
04-14-2016
07:41 AM
I'm getting this message below on Universal Forwarders' splunkd.log...
INFO BatchReader - Could not send data to output queue (parsingQueue), retrying...
INFO TailingProcessor - Could not send data to output queue (parsingQueue), retrying...
INFO TailReader - Could not send data to output queue (parsingQueue), retrying...
I did follow this step below...
grep "*blocked=true*" /opt/app/splunkforwarder/var/log/splunk/metrics.log*
I don't see any blocked queues
I did add limits.conf in /opt/apps/splunkforwarder/etc/system/local
[thruput]
maxKBps = 0
Still I see the message:
Could not send data to output queue (parsingQueue), retrying...
What are the next options I need to look to resolve this..??
... View more
04-14-2016
07:21 AM
Thanks..will try to find a program which reads the file.
... View more
04-13-2016
09:22 AM
I'm getting this error in Splunk:
04-13-2016 11:13:58.607 -0500 WARN FileClassifierManager - The file '/opt/wasserver/server/server01/log/server.log' is invalid. Reason: binary
04-13-2016 11:13:58.607 -0500 INFO TailReader - Ignoring file '/opt/wasserver/server/server01/log/server.log' due to: binary
I tried this setting NO_BINARY_CHECK = true , where I can avoid the error above, but I'm looking to convert the binary data to human readable format.
Any help would be appreciated. Thanks..!!
... View more
03-03-2016
07:54 AM
We store metadata in files alongside the raw data (in journal.gz). Why would you want to tweak it and what do you want to tweak?
wanted to know if i can change the hostname form ks75rhel to webserver01 or similar...
... View more
03-02-2016
09:29 AM
Make sense... the raw data doesn't have a host field, i have few questions on this...
1.coming to the diff b/w indexed and raw data..? indexed data is the one which does key value pair extractions and license would be calculated based on the indexed data..?
2. how does splunk store the metadata(like host=ks75rhel)...? can we make any tweaks on this...?
3. does retention period applies for both indexed and raw data...?
... View more
03-02-2016
08:58 AM
I have the sample log pasted when i search by host=ks75rhel, when i type in just ks75rhel it's blank in the output...
3/2/16 192.168.6.3 - - [02/Mar/2016:10:49:55 -0600] "GET /test.htm " 200 168 "-" "-" 0\2341
10:49:55.000 AM bytes = 168 clientip = 192.168.6.3 file = testing.htm host = ks75rhel index = rhelt0 method = GET response_ms = 2341 source = /opt/applications/web2/servers/ks_ncr/logs/access.20160302000000.log sourcetype = access_combined uri_path = /testing.htm
... View more
03-02-2016
08:29 AM
When I try to search for hostname (ks75rhel) typing it in the search bar, I'm not getting any results. I tried the following ways...
ks75rhel
*ks75rhel*
ks75*
I did get results when I use host=ks75rhel , did anyone face this kind of issue...? Any help would be appreciated. Thanks..!!
... View more
02-17-2016
10:23 AM
@renjith, @gblock...Thanks for the explanation, i wish i will implement this soon. 🙂
... View more
02-17-2016
07:23 AM
@gblock...Thanks for the reply...
let's say if i have a mobile or client application, can i ask developer to send the data to HWF in a JSON format..?
client/mobile application---------------->HWF-------------------------->Splunk Indexer
1.Do i need to enable HEC on both HWF and Indexer..?
2.In the above workflow i want my HWF to not index locally, just route the data to Splunk Indexer.(does this tweak on HWF output.conf(indexAndForward = false) help me to use HWF to just forward)..?
3.After the data has been indexed by splunk indexer, does splunk autoextract key-value pairs even from JSON format..?
... View more
02-16-2016
08:11 PM
Thanks renjith..
It says using HEC the data is transferred over HTTP, what would be the transfer protocol when we use UF----->Splunk.
... View more
02-16-2016
07:45 AM
1 Karma
I have been through the blogs below on HTTP event collector, but I'm looking for detailed explanation/use cases on using the HTTP event collector.
According to my understanding, are we sending the data directly to an indexer using a HEC without a universal forwarder..?
In what scenarios would this be helpful..?
Any explanation would be appreciated. Thanks.
http://dev.splunk.com/view/SP-CAAAE6M
http://blogs.splunk.com/2015/09/22/turbo-charging-modular-inputs-with-the-hec-http-event-collector-input/
... View more
02-08-2016
05:06 PM
It's giving me the same values under TotalUsers and avg(TotalUsers), not sure if i'm asking the question in a right way...
I'm looking for TotalUsers/day and also avg users..?
... View more
02-08-2016
11:38 AM
I'm trying to calculate Total count and avg(count) of users on a specific file...
I don't think it's the right way to do, any help would be appreciated. Thanks.
index=web sourcetype=web_access refe_domain=sample.com file="checkout.jsp" JSESSIONID!="-" | dedup JSESSIONID |stats dc(trueclientip) as TotalUsers by file | stats avg(TotalUsers)
... View more
02-03-2016
01:56 PM
Thankyou...It worked,I have also added count at the end of the search to display the count by file in pie chart...
.......... | replace "src.jcp" with "Search" in file| eval file_slice = count + "-" + file | fields file_slice, count
... View more
02-03-2016
11:11 AM
1 Karma
I'm not able to rename file names to display in a pie chart...any help would be appreciated...
I tried both ways..
index=web_server sourcetype=web_access (file="pr.prod" OR file="cr.crt" OR file="src.jsp") SESSIONID!="-" | dedup SESSIONID | stats count by file | rename "pr.prod" AS "Products", "cr.crt" AS "Category", "src.jcp" AS "Search"
index=web_server sourcetype=web_access SESSIONID!="-" | dedup SESSIONID | stats count(eval( file="pr.prod")) AS Products, count(eval(file="cr.crt")) AS Category, count(eval(file="srchjsp")) AS search | stats count by file
... View more
01-28-2016
07:59 PM
I have a search scheduled to send an email alert when count > 10 in an hour timespan.
index=webserver sourcetype=web_logs loglevel=error | stats count by user | where count > 10
let's say if i schedule this alert at @8am to run every hour, how does the hourly cycle works to fire an email alert..?
If count is > 10 @9:30am, will i get notified via email alert @9:30 or 10am..?
... View more
- « Previous
- Next »
