Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ankithreddy777
ankithreddy777
Contributor
Member since:
09-20-2016
06-05-2020
Community Statistics
| Posts | 202 |
| Solutions | 0 |
| Karma Given | 50 |
| Karma Received | 11 |
| Member Since | 09-20-2016 |
Activity Feed
- Karma Re: Sending data from one UF to other UF for esix_splunk. 06-05-2020 12:50 AM
- Karma Re: How can we track configuration changes on a universal forwarder server? for dkeck. 06-05-2020 12:50 AM
- Karma Re: Splunk event sourcetype overide and send event back to parsing queue for tiagofbmm. 06-05-2020 12:49 AM
- Karma Re: Recommended maximum concurrent searches? for s2_splunk. 06-05-2020 12:49 AM
- Karma Re: Can these three searches be combined and ran sequentially? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: Raw data back to files for gcusello. 06-05-2020 12:49 AM
- Karma Re: Raw data back to files for hardikJsheth. 06-05-2020 12:49 AM
- Karma Re: Splunk ingest SNMP traps for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: Can I use CLONE_SOURCETYPE to send events to multiple indexes? for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: What is the best way to number each event in descending time? for Vijeta. 06-05-2020 12:49 AM
- Karma Re: Why is my input not getting parsed if I use wildcards? for MuS. 06-05-2020 12:49 AM
- Karma Re: Splunk fetching results from database in realtime for richgalloway. 06-05-2020 12:49 AM
- Karma Re: Timestamp extraction for varying subseconds and time zones? for adonio. 06-05-2020 12:49 AM
- Karma Re: How to configure alert based on other timezones? for woodcock. 06-05-2020 12:49 AM
- Got Karma for Does Heavy forwarder forwarded events will undergo parsing on indexers. 06-05-2020 12:49 AM
- Got Karma for Does Splunk use .spec files?. 06-05-2020 12:49 AM
- Karma Re: What type of storage is needed for frozen data? for nickhills. 06-05-2020 12:48 AM
- Karma Re: Splunk CRC check for woodcock. 06-05-2020 12:48 AM
- Karma Re: whats happens if "maxVolumeDataSizeMB" limit is reached for cold path. for somesoni2. 06-05-2020 12:48 AM
- Karma Re: DR deployer storage setup for s2_splunk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-07-2017
09:11 AM
I am getting data to Splunk Universal Forwarder port through the TCP port. Then the data is forwarded to indexers. What if the server is rebooted, will there be the data loss? If not, how much time can data can be in hold until the server is restarted? What factors should I consider?
... View more
03-02-2017
11:06 AM
1 Karma
Using authorize.conf, we can create roles. Using authentication.conf, we can map roles to LDAP groups. But how can we add users with Splunk authentication using configuration files?
... View more
- Tags:
- configuration
- user
02-16-2017
06:51 AM
I have a questions regarding the upgrade
Can we upgrade the replicated indexers first in maintenance mode?
Can we upgrade the deployment server independently of the indexers to save time?
... View more
02-14-2017
06:32 AM
All my Splunk instances are in linux including Deployment server. But the UF server is in Windows. Does windows UF server communicated with DS server and send data to indexers in Linux OS . Can we push apps to windows UF through linux Deployment server.
... View more
- Tags:
- compatability
- splunk-
02-13-2017
10:36 AM
Until now our clustered indexers do not have the frozen Directory.
Now we would like to add the storage especially to data that is going to be frozen.
So what type of storage is required? Can we use SAN storage that is shared by all Indexers to store frozen data at one place? Otherwise do I need to use local storage for each Indexer to hold frozen Data?
... View more
02-13-2017
08:38 AM
on Splunk Distributed Management Console, I see that for one index
DataAge Vs FrozenAge
1005/562
why is DataAge more than FrozenAge? why the data is not rolling? Does data Age takes indextime in to account or the timestamp of an event to froze the event. Because, here for DataAge calculation it is taking timestamp of the event. But looks like for rolling buckets it is taken _indextime in to account
... View more
02-13-2017
08:04 AM
we are using the indexer clustering. It is okay even though we store multiple copies of frozen data . Can we go for coldtofrozenDir.
... View more
02-13-2017
07:51 AM
If data is frozen, Even though we set frozentimeperiodinsecs to high value. Its effect is no more if "maxVolumeDataSizeMB" is reached? So only way to save the data is by configuring coldtofrozendir.
... View more
02-13-2017
07:30 AM
If it is frozen, Even though we set frozentimeperiodinsecs to high value. It effect is no more if "maxVolumeDataSizeMB" is reached?
... View more
02-13-2017
07:22 AM
Hi,
if "maxVolumeDataSizeMB" is reached for home volume , the buckets roll to cold.
what is "maxVolumeDataSizeMB" is reached for the cold path. Does it causes cold buckets to frozen or does it stops indexing.
If it is frozen, Even though we set frozentimeperiodinsecs to high value. It effect is no more?
... View more
02-09-2017
02:33 PM
I have a event as below
nam=this is org name;
-this is hyta name;
-this is hju name;
falu= this is gao name
I need to match multiple lines. until the line "falu=". May I know how to match multiple lines.
... View more
02-08-2017
01:56 PM
It is something like
[netscreen-error]
REGEX = device_id=[w+](?[^:]+)
FORMAT = err_code::$1
WRITE_META = true
and my search is ,
index=my_index_name|table err_code
Is there any way to search error_code values quickly
... View more
02-08-2017
08:12 AM
Hi I have extracted ipaddress during indextime.
Do I have to use fields.conf for every time I during the Index time extraction.
[ipaddress]
INDEXED=true
Does "WRITE_META=true" is not sufficient for storing values.
... View more
02-08-2017
07:41 AM
I have did index time extractions for fields.
I have stored them in _meta. But when I search for the extracted field values, It is taking same time as search time extractions. Is there any query to search for index time extracted fields stored under _meta. Or should I store the extracted fields at different place for fast search of the queries.
... View more
02-06-2017
10:07 AM
If a search head cluster is deployed in multiple sites (2 sites), what is the type of storage is required for each search head? Local storage is fine or do we have to use SAN storage?
... View more
02-06-2017
08:55 AM
In a Multi-Site Search head cluster, do we have to use the F5 load balancer in both Data centers? Or do we have to use single F5 load balancer for all search heads in both Data centers?
... View more
02-03-2017
11:37 AM
I have followed the documentation. But still cant see the jms_modular_input option on splunk UI.
Below are the logging errors
02-03-2017 13:33:35.936 -0600 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" It has been determined via the REST API that all inputs have been disabled
02-03-2017 13:33:26.474 -0600 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/jms_ta/bin/jms.py
02-03-2017 13:33:26.473 -0600 INFO ModularInputs - No stanzas found for scheme "jms" in inputs.conf at script (re)start.
02-03-2017 13:33:26.472 -0600 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/jms_ta/bin/jms.py
DO I need to configure anything more
... View more
02-02-2017
02:12 PM
Using Splunk-DB database outputs I am sending results to database. How do we know that if particular database update has failed. Can we create alerts
... View more
02-02-2017
01:23 PM
Hi,
below is the stanza in transforms.conf.
[rfc5424_header]
REGEX = <(\d+)>\d{1}\s{1}\S+\s{1}\S+\s{1}(\S+)\s{1}(\S+)\s{1}(\S+)
FORMAT = prival::$1 appname::$2 procid::$3 msgid::$4
As given, above regex has four capturing groups $1,$2,$3,$4. how to identify how many capturing groups are present in a regular expression?
I know how to write regex to match a text and write regex with single name capturing group, but how do I write regex with multiple capturing groups to extract fields? Don't understand what part of regex represents $1, $2 etc.
... View more
02-02-2017
01:12 PM
I followed the document for JMS modular input app set up. I have set java environment variable. but I still cant see the JMS inputs option on splunk UI- Manager-Datainputs. Do I need to add jars for the messaging platform.
... View more
02-01-2017
03:25 PM
I installed JMS Messaging Modular Input on Splunk search head but it's not visible on Splunk Web. Do we need to configure anything?
... View more
01-31-2017
02:51 PM
Does JMS Messaging module supports “Solace System” messaging system which is alterative to IBM Websphere MQ.
... View more
- Tags:
- splunk-enterprise
01-31-2017
04:59 AM
Hi cusello,
can we delete rows in database by creating database input and update all results by creating database output mapping to search results?.
... View more
01-31-2017
04:43 AM
How to send all results to the database for every execution Instead of only new results using using splunk db database output . Can we delete results in database from database input. My requirement is I have to update the database with the new results everytime replacing the old results.
... View more
- Tags:
- splunk-enterprise
01-31-2017
04:39 AM
Hi Cusello,
How to send all results to the database for every execution. Instead of only new results using database. Can we delete results in database?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
