About VijaySrrie

VijaySrrie · ‎05-21-2024

Hi Team, I have an auto-extracted field - auth.policies{} I have another field called user Whenever auth.policies{} is root, I need that to be a part of user field May I know how to do it? Is there a possibility to use case and coalesce together?

VijaySrrie · ‎05-19-2024

Hi @VatsalJagani 1. Checkpoint file is not getting update 2. It happens only in DC1 3. modinput_tyk_analytics_mongodb is the app having the python script 4. Whenever we see error in splunk internal logs, duplicate logs are seen

VijaySrrie · ‎05-13-2024

In Python script I get a below error in internal logs TypeError: Object of type bytes is not JSON serializable We are using python 3 May I know how to get rid of this error in internal logs?

VijaySrrie · ‎09-13-2023

Hi Team, How to integrate proficio with splunk

VijaySrrie · ‎08-22-2023

Hi, Working on splunk capacity planning 1. splunk is in cloud 2. 100GB of data 3. 10 users 4. No use of splunk enterprise security How much license would be required? No. of indexers? search heads? Is there any site where I can get the exact details?

VijaySrrie · ‎08-16-2023

Hi, I could see duplicate data in splunk by using below query index="indexname" | stats count by _raw | where count >1 I checked 10 different indexes out of which 8 indexes are having duplicate logs

VijaySrrie · ‎08-01-2023

I wanted to show an example to my junior in practical setup

VijaySrrie · ‎08-01-2023

Hi All, How to find unwanted logs (noise) in crowdStrike Falcon logs? Do you know the details that can be filtered in crowdstrike falcon logs?

VijaySrrie · ‎04-20-2023

Hi All, Is there an option to see the working of Fish bucket in real time? Switching off the server? can we test it? If yes, please let me know how to do it in test server.

VijaySrrie · ‎03-01-2023

Hi I have extracted a field username and it has domain and user username= "google\\john" username="googleuser" username = "admin" I need calculated to be created in props.conf where google should go to domain and john should go to user field This domain field will be there only in certain logs So whatever is there before "\\" should be considered as domain and after "\\" is user In some cases domain wont be there, for those cases username to be tagged to user field All this should happeb at backend props.conf domain = google user= john user = googleuser user = admin

VijaySrrie · ‎02-26-2023

Hi @ITWhisperer , Thanks for the reply, I have pasted the answer that worked for me.

VijaySrrie · ‎02-26-2023

This answer worked for me https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361

VijaySrrie · ‎02-26-2023

index=_internal host=hoatname or IP

VijaySrrie · ‎02-26-2023

index=cat Name Place ID jack delhi 1 jill melbourne 2 index=dog Country number Australia 2 India 1 ID field in cat and number field in dog are same, I need below output Name Place ID Country jack delhi 1 India jill melbourne 2 Australia

VijaySrrie · ‎02-18-2023

Hi @bowesmana The query which you shared works fine. I am bit confused about the timing This query should run 60 mins once. cron_schedule = 01 * * * * dispatch.earliest_time = -60m dispatch.latest_time = now May I know the correct earliest and latest time?

VijaySrrie · ‎02-16-2023

Hi Team, We have a field called Status=Start and Status=Success OrderId is one field When orderId has the Status=start and if there is no Status=Success for 10 mins it should be considered as failure May i know how to write a condition for this?

VijaySrrie · ‎11-24-2022

Hi All, I have encrypted the user field with sha256 index=abc sourcetype=xyz | eval domain = sha256(User) | table domain I am able to see encrypted values under domain field Is there a splunk command to decrypt it?

VijaySrrie · ‎11-24-2022

@gcusello Below config worked Props [host::LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure Transforms.conf [change_index_abc_secure] SOURCE_KEY = _MetaData:Index REGEX = os|os_secure DEST_KEY = _MetaData:Index FORMAT = abc_secure

VijaySrrie · ‎11-06-2022

Hi @gcusello This isn't working Not sure where am I going wrong

VijaySrrie · ‎11-03-2022

Hi @gcusello Yes, this is fine, also I want the logs only from the hostname LIANS* Will the below props and transforms work? props.conf [host=LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure transforms.conf [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os|os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure

VijaySrrie · ‎11-01-2022

Hi Team, [host::1.(xx|xx).xx.xx(x|y)] TRANSFORMS-change_index_abc_secure = change_index_abc_secure [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os, os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure I need to route the logs from certain host to index=abc_secure (not all the logs only os and os_secure logs)

VijaySrrie · ‎09-04-2022

what happens when move_policy setting is not given in the batch config?

VijaySrrie · ‎09-01-2022

Hi All, What is the use of move_policy = sinkhole and on which scenario we will use batch (Batch will index the file and delete but in which application or server this should be used?)

VijaySrrie · ‎09-01-2022

Hi @dkeck What is the use of move_policy = sinkhole And In which scenario we go for batch ?

VijaySrrie · ‎07-07-2022

Hi Team, How to get OCI logging option under Data Inputs?

Posts	274
Solutions	13
Karma Given	73
Karma Received	10
Member Since	‎02-22-2019

Online Status	Offline
Date Last Visited	‎10-16-2024 08:53 PM

Splunkbase app download via command line

Auto Update MaxMind Database

Skipped search

Log latency

timechart and trendline command

Dashboard studio - Add colours

dashboard studio to classic dashboard

Skipped searches

Splunk Alert creation from dashboard

Skipped Search

Case and coalesce statement in one

Re: TypeError: Object of type bytes is not JSON se...

TypeError: Object of type bytes is not JSON serial...

How to integrate proficio with splunk?

Splunk capacity planning: How much license, search...

Why am I seeing Duplicate data (_raw)?

Re: Is there an option to see the working of Fish ...

How to find the noise in crowdstrike falcon logs?

Is there an option to see the working of Fish Buck...

How do I calculate field in props.conf?

Re: alert query with join or append?

Re: alert query with join or append?

Re: Splunk Syslog

Help with alert search with join or append?

Re: Need alert query

How to write a condition for this?

Is there a Splunk command to decrypt encrypted val...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

How to route the logs from certain host to index=a...

Re: Batch and move_policy = sinkhole

What is the use of batch and move_policy = sinkhol...

Re: Splunk forwarder oneshot continues to forward ...

How to get OCI logging option under Data Inputs?

Join the Conversation