Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ramprakash
ramprakash
Explorer
Member since:
11-12-2018
05-11-2022
Community Statistics
| Posts | 105 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 11-12-2018 |
Activity Feed
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 06:35 AM
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 03:30 AM
- Karma Re: Regex to Normalize data for PickleRick. 05-11-2022 03:30 AM
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 01:50 AM
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 01:00 AM
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 12:39 AM
- Posted Re: Regex to Normalize data on Getting Data In. 05-11-2022 12:38 AM
- Posted Help with configuration: How to use Regex to Normalize data? on Getting Data In. 05-10-2022 11:48 PM
- Tagged Help with configuration: How to use Regex to Normalize data? on Getting Data In. 05-10-2022 11:48 PM
- Posted How to Retrieve Splunk admin password on Installation. 03-15-2021 07:20 AM
- Posted Splunk Heavy forwarder(AIX) and Enterprise(Linux) version compatibility on Splunk Enterprise. 11-18-2020 10:07 AM
- Posted Re: Issue in transaction command on Splunk Search. 10-22-2020 09:28 AM
- Posted Re: Issue in transaction command on Splunk Search. 10-22-2020 07:20 AM
- Posted Re: Issue in transaction command on Splunk Search. 10-22-2020 06:59 AM
- Posted Re: Issue in transaction command on Splunk Search. 10-22-2020 06:43 AM
- Tagged Issue in transaction command on Splunk Search. 10-22-2020 06:22 AM
- Posted Issue in transaction command on Splunk Search. 10-22-2020 06:03 AM
- Posted Modification on Reporting. 08-28-2020 08:06 AM
- Karma Re: How to get the plain text of pass4Symmkey? for klischatb. 06-05-2020 12:50 AM
- Posted Re: Parsing of events with fixed pattern on Splunk Search. 05-04-2020 12:15 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-07-2019
01:33 AM
Hi Everyone...I want to put restrictions on users search as presently users can search for as long as they like. This could result in users executing searches for many hours.
I tried to change this setting in Roles area but it is not working even after starting splunk.
Restrict Search time range
Set a maximum time window (in seconds) for searches for this role. For example, set this to '60' to restrict this role's searches to 1 minute before the most recent time specified in the search. You can also set this to '0' to explicitly make the window infinite, or '-1' to unset the window for this role (can be overridden by imported roles).
I put 30 that means 30 sec and it is not working. Users can search beyond 30 sec. Can someone help ?
... View more
01-16-2019
06:54 AM
Sorry i meant it is not clustered environment
... View more
01-16-2019
06:38 AM
Hi@somesoni2..I think the issue is with hot buckets only. All the data is in Hot and Warm buckets and nothing has been moved to Cold buckets. Can you guide me what best config i choose so that 365 days data is always searchable and old data should be delete.
... View more
01-16-2019
06:36 AM
Yes it is showing 365 days only
... View more
01-16-2019
06:35 AM
No I checked the Indexer configuration only. Yes it is standalone setup
... View more
01-15-2019
09:11 AM
I pulled data from Search head and found that it has 3 years of data but when i logged in to check configuration files it shows me 1 year retention settings
... View more
01-15-2019
09:09 AM
I pulled data from Search head and found that it has 3 years of data but when i logged in to check configuration files it shows me 1 year retention settings
... View more
01-15-2019
08:50 AM
I pulled data from Search head and found that it has 3 years of data but when i logged in to check configuration files it shows me 1 year retention settings
... View more
01-15-2019
07:49 AM
Do i need to check configuration file precedence if the settings mentioned by me are fine.
... View more
01-15-2019
07:40 AM
Yes Splunk has been restarted and it has most recent data in Indexes.
... View more
01-15-2019
07:04 AM
Hi Everyone,
We have one index defined in indexes.conf with frozenTimePeriodInSecs as 365 days (31536000 seconds), but there are 3 years of data stored in index.It seems not working if we just define retention time period in frozenTimePeriodInSecs. Can someone help ?
$ view ./apps/launcher/local/indexes.conf
[Indexname]
coldPath = $SPLUNK_DB/Indexname/colddb
homePath = $SPLUNK_DB/Indexname/db
thawedPath = $SPLUNK_DB/Indexname/thaweddb
Maximum index total size in MB
maxTotalDataSizeMB = 35000
frozenTimePeriodInSecs = 31536000
... View more
01-04-2019
06:07 AM
I am not getting clear idea where this lookup is actually installed. How can i verify this thing through search head as i don't have admin access to check config files of Indexers and Search head.
... View more
01-02-2019
11:51 AM
This add on which works as a lookup is installed on indexer..will local=true work here
... View more
01-02-2019
11:50 AM
Hi..How can i check the file, since it is a external lookup...actually i have installed Http_user_agent add on which consists dynamic lookup
... View more
01-02-2019
02:54 AM
Hi Cusello...I have checked the issue and the events are more than 50k
... View more
01-02-2019
02:51 AM
Hi Richgalloway...I have modified the query and the issue still persists. It is checking almost 50k events and when i checked the Search Job Inspector, I found that lookup command is taking 99% of time.
... View more
12-28-2018
06:04 AM
Thanks for the Suggestions. I am out of office for Holidays. Requesting you to please continue following this post. I will try once i get into office.
Also could you please let me know if it is needed to update browscap.csv file or query only?
... View more
12-28-2018
06:04 AM
Thanks for the Suggestions. I am out of office for Holidays. Requesting you to please continue following this post. I will try once i get into office.
Also could you please let me know if it is needed to update browscap.csv file or query only?
... View more
12-28-2018
06:04 AM
Thanks for the Suggestions. I am out of office for Holidays. Requesting you to please continue following this post. I will try once i get into office.
Also could you please let me know if it is needed to update browscap.csv file or query only?
... View more
12-27-2018
02:58 AM
index=iso_wa sourcetype=iso_wa_pages | where isnotnull(nv_usr_agt) | table nv_usr_agt | rename nv_usr_agt as http_user_agent | dedup http_user_agent | lookup browscap_lookup_express http_user_agent | inputlookup http_user_agent append=true | dedup http_user_agent | outputlookup http_user_agent
Can anyone help me in understanding why it is taking long time to complete and how can i optimize ?
... View more
12-17-2018
07:43 PM
But everything is working fine. It is indexing data. I don't know what to do
... View more
12-17-2018
08:18 AM
Hi everyone.. Please help me in understanding the below alert that came from our forwarder. It is critical.
Summary:
enter code here Problem with process: splunkd -p 8089 start. Error encountered: less processes than expected.. Process count: 0
... View more
11-22-2018
05:23 AM
I appreciated the answer but I don't have admin access to run these commands
I checked the architecture again and they are using 4 Universal forwarders. Is there any search query ? so that i can provide you the result.
... View more
11-20-2018
07:43 AM
Hello Everyone . I have one doubt. In the Splunk Architect, my organization is using..it is mentioned 4 forwarders with their server name. But when i am running any query i am seeing more than 50 hosts. Is it correct understanding that Number of Forwarders = Number of Hosts and how to check the correct result ?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-11-2022
12:29 AM
|
