Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nareshinsvu
nareshinsvu
Builder
Member since:
01-08-2019
02-07-2023
Community Statistics
| Posts | 203 |
| Solutions | 20 |
| Karma Given | 11 |
| Karma Received | 25 |
| Member Since | 01-08-2019 |
Activity Feed
- Posted Re: props and transforms to extract multiline muntivalue event on Splunk Search. 02-06-2023 11:48 PM
- Posted How can I use props and transforms to extract multiline muntivalue event? on Splunk Search. 02-06-2023 11:26 PM
- Tagged How can I use props and transforms to extract multiline muntivalue event? on Splunk Search. 02-06-2023 11:26 PM
- Tagged How can I use props and transforms to extract multiline muntivalue event? on Splunk Search. 02-06-2023 11:26 PM
- Posted Re: Stuck with Splunk ES Upgrade on Splunk Enterprise Security. 05-01-2022 08:00 PM
- Posted Stuck with Splunk ES Upgrade on Splunk Enterprise Security. 04-27-2022 08:42 PM
- Posted Re: Splunk Apps throwing Invalid key python3 warnings on All Apps and Add-ons. 03-03-2022 03:17 PM
- Posted Re: Splunk Apps throwing Invalid key python3 warnings on All Apps and Add-ons. 03-03-2022 03:13 PM
- Posted Splunk Apps throwing Invalid key python3 warnings on All Apps and Add-ons. 03-02-2022 07:16 PM
- Posted Re: eval not working in props.conf on Getting Data In. 02-15-2022 08:48 PM
- Posted Re: eval not working in props.conf on Getting Data In. 01-26-2022 03:25 PM
- Posted Re: eval not working in props.conf on Getting Data In. 01-26-2022 03:24 PM
- Posted Why does eval search work but eval in the props conf file doesn't creating new field? on Getting Data In. 01-24-2022 07:18 PM
- Posted Re: Search Time extraction not working on Splunk Enterprise. 12-09-2021 03:01 PM
- Karma Re: Search Time extraction not working for isoutamo. 12-09-2021 03:00 PM
- Posted Re: Search Time extraction not working on Splunk Enterprise. 12-09-2021 02:18 PM
- Posted Search Time extraction not working on Splunk Enterprise. 12-08-2021 04:52 PM
- Got Karma for Re: How to configure a sourcetype for JSON data to parse each line as a distinct event?. 01-28-2021 03:55 PM
- Posted Data Anonimization - Multiple transforms not working for single _raw event on Getting Data In. 09-17-2020 12:23 AM
- Posted Re: JSON payloads not getting indexed into Splunk on Getting Data In. 08-24-2020 06:54 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-22-2019
07:51 PM
Hello experts,
My inputs.conf is having below config. Just wondering what happens end of the day? Will my splunk loose the final 10secs updates in the log? Also my logs get rolled and renamed into a different archive directory when they reach 500mb. Will there be a dataloss in splunk during the roll over?
interval = 10
crcSalt = <SOURCE>
... View more
08-22-2019
07:08 PM
Below is my use-case (Heavy Forwarders -> Indexers). Need expert assessment.
1) I have very huge log files.
2) So, I have used heavy forwarders to cut down data at source using REGEX transforms.
3) Got a peak load and splunk not able to get any data .
splunkd.log on forwarders - Could not send data to output queue (parsingQueue)
metrics.log on forwarders - Metrics - group=queue, name=aggqueue, blocked=true, max_size_kb=1024, current_size_kb=1023, current_size=2324, largest_size=2336, smallest_size=2169
4) Didn't help after restart/deletion of metrics.log*
Are there any specific config changes that can fix this without changing my architecture? Else, I have to go for Universal Forwarder -> Heavy Forwarders -> Indexers. And any issues that I foresee in the new architecture?
changing interval in inputs.conf might help? currently it is set to 10. Suspecting that the log filling is very fast and it couldnt cope with the changes? Should I increase it to may be 50 and see?
... View more
08-22-2019
12:04 AM
1 Karma
Try this: Keep in mind that this only helps if the time placements are at the same position for all your log content. If your input is of csv format with all headers, extraction would have been easy
|makeresults
|eval _raw="class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType"
|eval fields=split(_raw,",")
| eval Start_time=mvindex(fields,9), End_time=mvindex(fields,10)
| table Start_time End_time
... View more
08-21-2019
07:51 PM
Not sure if this helps. You can use the logic according to your requirements. Hope it helps
<your base search>| makemv delim=" " col2|mvexpand col2 | stats count(col2) as count by col2 | eval new_column=if((count=1),col2,"") | table new_column
... View more
08-21-2019
06:45 PM
Depends on the volume of your indexing. below is my environment with a small scale indexing (around 1GB/day)
Indexer Cluster - 2 servers
Seach head Cluster - 3 servers
DMC, CM, LM, DS, SHCD - 1 server
... View more
08-21-2019
06:35 PM
Can you create a new column like found_flag in your csv file and keep updating it?
| inputlookup perimeter.csv | where found_flag=""
|blah blah
|eval found_flag=1
|outputlookup perimeter.csv append=true
And then another search query to dedup the results
| inputlookup perimeter.csv | sort - found_flag |dedup SplunkHost |outputlookup perimeter.csv
... View more
08-21-2019
05:53 PM
Not very clear. Do you want seperate row for "C" ?
<your base search>| makemv delim=" " col2|mvexpand col2
... View more
08-21-2019
07:16 AM
What is the root cause and resolution?
... View more
08-20-2019
10:47 PM
Do go through the conf files involved in Data forwarding before jumping into your environment.
outputs.conf - Indexer discovery etc happens here
inputs.conf - target index, source and sourcetype to be defined here
props.conf & transforms.conf - Filter and extractions of your data to be defined here.
... View more
08-20-2019
10:32 PM
You should probably raise a Support ticket for your data integrity and security related queries. As per their docs,
Data Segregation for Splunk Cloud
Splunk Cloud deployments run in a secured environment, and your data exists on virtually dedicated servers to ensure it remains isolated from other customers’ data.
... View more
08-20-2019
10:18 PM
1)
https://answers.splunk.com/answers/148813/steps-to-setup-splunk-forwarder-for-splunk-in-the-cloud.html
https://docs.splunk.com/Documentation/Forwarder/7.3.1/Forwarder/HowtoforwarddatatoSplunkCloud
2)
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/ManageIndexes
... View more
08-20-2019
09:51 PM
Not clear on what you are asking. Can you brief with a small example/anonymized data/code
<your base search> | sort - _time| dedup device | blah blah
... View more
08-20-2019
09:40 PM
1 Karma
How about using search(without AND operator) instead of where?
| search service="*" resource="*"
... View more
08-20-2019
09:10 PM
Hope you have tried props and transforms.conf instead of blacklisting in inputs.conf?
... View more
08-20-2019
07:58 PM
1 Karma
Sorry, I read it wrong. Can you try this? tweak the time format according to your need. Hope this should help now?
index=wineventlog EventCode=4624 OR EventCode=4625
| eval failed_time=if(EventCode=4625,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"")
|eval Success_time=if(EventCode=4624,strftime(_time,"%Y-%m-%dT%H:%M:%S"),"")
| stats list(EventCode) as EventCode range(_time) AS duration values(failed_time) as failed_time values(Success_time) as Success_time BY ComputerName
| rex field=duration mode=sed "s/\..*$//"
| where duration <600
... View more
08-20-2019
06:08 PM
Do you have a deployer for your Search Head cluster?
Did you deploy the conf file through the deployer and deleted through the deployer? If not do it.
What errors are you seeing in splunkd.log?
... View more
08-20-2019
05:59 PM
Are you trying to match anything from your sub-search? if not, can you try this?
index=wineventlog earliest="-10m@m" latest="now" EventCode=4624 OR EventCode=4625 | fields _time EventCode ComputerName
... View more
08-20-2019
04:50 PM
I have not tried this. But will this help?
https://splunkbase.splunk.com/app/282/
... View more
08-20-2019
04:46 PM
Did you mention your index name in the inputs.conf, else add this in your transforms.conf and see if it works?
transforms.conf
[keep_index]
REGEX=((?i)error|crit|fatal|splunk|ora-|INFO)
DEST_KEY=_MetaData:Index
FORMAT=<your index name>
props.comf
TRANSFORMS-set = nulldefault,keep,keep_index
... View more
08-19-2019
11:06 PM
@niketnilay - Would you recommend this approach over transaction if we want to group (say) 10 or more events into a group using a common identifier which is re-used by other group of events?
... View more
08-19-2019
10:27 PM
Try this:
|makeresults
|eval raw="Message: UseCaseX.ProcessData ItemID=5 Provider=123 ElapsedMilliseconds=230 timestamp=09/21/2017T10:16:33;Message: UseCaseX.ProcessData ItemID=5 Provider=333 ElapsedMilliseconds=130 timestamp=09/21/2017T10:16:38;Message: UseCaseX.ProcessData ItemID=5 Provider=999 ElapsedMilliseconds=780 timestamp=09/21/2017T10:16:41;Message: UseCaseY.CalculateScore ItemID=5 ElapsedMilliseconds=780 timestamp=09/21/2017T10:16:58"
| makemv delim=";" raw
|mvexpand raw
| rename raw AS _raw
`comment("Ignore above code which is just used for generating a dataset")`
| kv
| eval _time = strptime(timestamp,"%m/%d/%YT%H:%M:%S")
|rex field=_raw "Message\:\s+(?<Message>.*?)\s*\s+ItemID"
| dedup ItemID Message
|reverse
| transaction ItemID startswith="UseCaseX.ProcessData" endswith="CalculateScore"
... View more
08-19-2019
09:19 PM
Kindly Accept and/or upvote if it helped. It might help other splunkers with similar issues.
... View more
08-19-2019
09:10 PM
@sahil237888 - It is working on my datamodels.
I think you have to define your datamodel/table and then run this query as volume and ReportKey should be a field names?
| from datamodel:"your_data_model"| timechart span=1m count(volume) by ReportKey as F |
timewrap 1w series=short |
sort -_time |
where _time>=relative_time(now(),"-10m@m") |
eval Time=strftime(_time,"%D %H:%M")|
rename F_s1 as 1_week_ago |
rename F_s0 as Today |
table Time Today 1_weeks_ago
... View more
08-19-2019
07:06 PM
Did you check this? Kindly upvote the original post if it helped
https://answers.splunk.com/answers/330563/find-latest-login-per-user-and-ip-address.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-07-2023
04:09 AM
|
