Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About rashid47010
rashid47010
Communicator
Member since:
12-28-2015
07-21-2023
Community Statistics
| Posts | 151 |
| Solutions | 3 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 12-28-2015 |
Activity Feed
- Posted Re: create index field on Getting Data In. 07-21-2023 02:48 PM
- Posted Re: create index field on Getting Data In. 07-21-2023 12:58 PM
- Posted How to create index field? on Getting Data In. 07-20-2023 01:24 PM
- Posted How to upload large json format data into kv-store? on Knowledge Management. 07-25-2022 02:58 AM
- Posted Re: How do you remove a header from JSON? on Getting Data In. 12-14-2021 03:53 AM
- Karma Re: How can I configure indexes to replicate data with each other in a Splunk deployment? for ssadanala1. 06-05-2020 12:49 AM
- Got Karma for reputation for posting question. 06-05-2020 12:48 AM
- Karma Re: Is there a code example to add a drilldown for a column chart to display a table? for nfilippi_splunk. 06-05-2020 12:47 AM
- Karma Re: Passing selected time range to drilldown in Simple XML for somesoni2. 06-05-2020 12:46 AM
- Karma Re: Send Drilldown Search to a New Window for Lowell. 06-05-2020 12:46 AM
- Got Karma for Re: Splunk for Exchange: Not indexing message tracking logs. 06-05-2020 12:46 AM
- Posted Indexer Peer status Down in CM consloe on Getting Data In. 08-07-2019 03:56 AM
- Tagged Indexer Peer status Down in CM consloe on Getting Data In. 08-07-2019 03:56 AM
- Posted extract multi valued field on Splunk Search. 07-25-2019 02:41 AM
- Tagged extract multi valued field on Splunk Search. 07-25-2019 02:41 AM
- Posted SAP ETD integration with Splunk with hTTP event collector on Splunk Search. 07-24-2019 12:39 AM
- Posted NFS share for frozen data on Getting Data In. 07-10-2019 05:12 AM
- Tagged NFS share for frozen data on Getting Data In. 07-10-2019 05:12 AM
- Posted Re: "No possible srcs for replication" on Deployment Architecture. 07-02-2019 10:22 PM
- Posted Glass Table icron permission on Splunk Enterprise Security. 07-02-2019 03:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-14-2019
06:04 AM
Under the noteable event view, for each field ther is action, I want to add "got to virustotal $src$" field for src(if it is public) and "got to virustotal $dest$" for dest(if it is public) action into to "action" field and secondly how can i include more intelligence feeds
... View more
03-13-2019
05:15 AM
I have a chart showing top 10 values.
when I click on bar it should show me the values instead of act=24.
I want to values of that fields beside the count.
act=block|quarantine
instead of act=24
I am using act=$click.value2$ but instead taking the values=block|quarantine, he toold value(act=24)
hope you understand my query
... View more
03-13-2019
05:11 AM
Recently system admin give us another NFS share(share2) to move the frozen/archieve logs/data from old NFS share(share1).
share1()------------move data--------->>>share2
whats are the steps to aviod system performance issues.
... View more
- Tags:
- splunk-enterprise
03-10-2019
03:56 AM
Dear Nick,
I have a chart showing top 10 values.
when I click on bar it should show me the values instead of act=24.
I want to values of that fields beside the count.
act=block|quarantine
instead of act=24
I am using act=$click.value2$ but instead taking the values=block|quarantine, he toold value(act=24)
hope you understand my query
... View more
03-10-2019
01:33 AM
I want to use the eval function with cidrmatch function like
1- who to mention multip subnets in x field against cidrmatch function.
| eval network-outbound=if(cidrmatch("10...*/8",src), "local", "public")
... View more
03-07-2019
03:50 AM
I have a coloum chart with values displaying.
I select "configure link to a search"
when I click on coloum bar it opens the results in new windows. Problem is that beside showing act=unspecified|quarantine, it get the "number/count of event"
below is my query appear in searchbar:
iindex=trend sourcetype=e** cat="*e" **act=24 | dedup fixxth | table xxcxoxt fixxaxxh act TxxrxdMxxxroxxxleSHA1
search in the drilldown editor query is below:
iindex=trend sourcetype=*e act=$click.value2$ | dedup fixxth | table xxcxoxt fixxaxxh act TxxrxdMxxxroxxxleSHA1
Please help to fix this issue.
... View more
- Tags:
- splunk-enterprise
03-06-2019
05:33 AM
I have one correlation rule trigged against IP reputation.
Now we have different network devices, like cisco, f5.
I am thinking like
if device is f5 then show me more relevant fields and their crossponding values.
if device is cisco then just show me source destination port(s) and interface
For example, the
drill down search
"| from datamodel:"Intxxxon_xxx"."xxS_Axxacxxs" | search signature="OxxxxxxxxApxxxication Axxxxx Hxxaxxcxxking""
now the intelligance feed catch the bad IP reputation against f5. so how can I show more relevant fields against specific sourcetype or unique field
... View more
- Tags:
- splunk-enterprise
03-04-2019
11:07 PM
no there is no date filed. He is taking file date.
... View more
03-04-2019
03:07 AM
I found the problem on post :
https://answers.splunk.com/answers/23502/windows-sid-resolving-in-splunk.html
... View more
03-04-2019
02:52 AM
can you please share the input.conf parameter along with their values
... View more
03-04-2019
02:38 AM
a source user added one users to local admin group of server.
in event Security ID is S-x-x-xx-xxxxxxxxxxx8-7xxxxxx4-1xxx for both subject, member and group.
in event we can see that actually who made this change but there is no such information that "which user" get added to which local security group. only we I can see the SID or UID. how can we fix this issue
... View more
- Tags:
- splunk-enterprise
03-04-2019
02:31 AM
my event starts from [ 09:34:09.584]
[09:34:09.584] [DEBUG] [WebContainer : 3] [User:14xx7] com.gide.vmxxg.xx.xx.axxxation.ixxerceptors.VxxsFrontControllerInterceptor - Response SOAP:
Blockquote
... View more
02-27-2019
10:06 PM
error message: Could not use strptime to parse timestamp from "[00:00:00.015".
Event:
[00:00:00.015] [DEBUG] [xxxxxnitor_xxx-6] [xxxx:] com.gxxxe.vxxxg.dxx.jxxx.Ix expireTime=Sat Feb 23 23:45:00 AST 2019
props.conf
Timestamp format: \d{2}:\d{2}:\d{2}.\d{3}
Timestamp prefix:
Lookahead: 13
... View more
- Tags:
- splunk
02-18-2019
05:12 AM
I want to exlude specific domains from both sender and receipient.
for example I have abc.com domain and have one lookup file with legitiamate domain names.
Now I want to see a emails which is not include either as sender or receipient in that lookup file.
OR in simple words how can I compare lookup values againt two fields(sender and receipient)
... View more
- Tags:
- splunk-enterprise
02-03-2019
10:36 AM
I install the HP service manager app on splunk SH+ES.
on test ES, the bin/createincident.py can successfully create the incident. the test ES is not behind the proxy
on production, from app logs, I am seeing the the credentials fething part is being blocked by proxy.
i include no proxy parameters in /etc/environment but no impact.
Please advise.
... View more
- Tags:
- splunk-enterprise
05-10-2018
10:55 AM
We have different syslog sources.
Should I create one syslog server and configure all the syslog sources to send logs to that central syslog server and then install the UF to read the files from that paths?
Please share some scenarios or Splunk configuration.
... View more
05-08-2018
07:31 AM
hi
this is just a start of completed architecture.
However I achieve this.
Now where can I filter the events
on HF OR UF ?
Please advise.
... View more
05-08-2018
07:02 AM
I have
I want to send windows logs through heavy forwarder to indexer.
on windows server, I install universal forwarder and put Heavy forwarder ip:9997.
already configure listening on heavy forwarder.
now how can I see event in indexer.
... View more
- Tags:
- splunk
05-02-2018
01:45 AM
hi @niketnilay,
thanks for sharing useful information.
I am looking exactly the same.
... View more
05-02-2018
01:40 AM
how can I accept your answer
... View more
05-02-2018
01:37 AM
@ssadanala1
thanks.
it is helpful to understand basic concept.
... View more
04-15-2018
11:32 AM
I am new to splunk
I installed trial version which can index 500 MB/day. My question is that Domain controller can index how much events. Please just give me estimate.
... View more
04-15-2018
11:29 AM
Hi Everyone,
I want to install splunk trail version. I have multiple Domain Controllers, File Servers, Exchange Server, Firewalls.
the idea is to present splunk capabilities.
Please tell me:
1-Trial license is 500 MB/per day so what should be my strategy( how many indexers, search heads and Forwarders I can configure)
2- estimate space required for each data source, for example, for DC how many events can be indexed.
3- what should be my architecture strategy.
4- How can I drop windows events at universal forwarder or Index level.
5- How can I filter network events( should I do this at network device it self .. OR i can drop events at index level.
... View more
04-15-2018
03:06 AM
hi
thanks for your kind reply.
I believe that I need another server as index cluster.
I am limited with resources.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-21-2023
06:47 PM
|
