Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About k_harini
k_harini
Communicator
Member since:
09-26-2016
09-24-2021
Community Statistics
| Posts | 131 |
| Solutions | 4 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 09-26-2016 |
Activity Feed
- Karma Re: How do I calculate the average over time when the count keeps changes every month? for woodcock. 06-05-2020 12:48 AM
- Karma Re: calculate Field count and pass it for percent calculation for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Custom single value icon not displaying with non-count field for dcoomer. 06-05-2020 12:48 AM
- Karma Re: Issue with Field other than _time to represent in x-axis for gcusello. 06-05-2020 12:48 AM
- Karma Re: splunklib client giving SSLError for kbarker302. 06-05-2020 12:48 AM
- Got Karma for condition match tag in drill down condition based on form input token and drilldown value not working. 06-05-2020 12:48 AM
- Karma Re: Find events matching a multi-value field for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Conditional count in stats function for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to create a new field with values in existing field based on the values in other field. for Gilberto_Castil. 06-05-2020 12:46 AM
- Karma Re: Splunk closing TCP port 9997 (forwarder port) for mikelanghorst. 06-05-2020 12:46 AM
- Karma Re: Rex mode=sed diff between replace and substitute for dwaddle. 06-05-2020 12:46 AM
- Got Karma for Re: indexing congestion consistenly happening. 06-05-2020 12:46 AM
- Posted Re: Subsearch in eval not working on Splunk Search. 03-09-2018 02:48 AM
- Posted Subsearch in eval not working on Splunk Search. 03-09-2018 01:07 AM
- Posted Re: How to set a token based on another token on Deployment Architecture. 02-02-2018 05:33 AM
- Posted How to set a token based on another token on Deployment Architecture. 02-02-2018 02:29 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 05:25 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 04:56 AM
- Posted Re: latest events which are indexed are not pulled correctly based on time filter on Getting Data In. 01-17-2018 04:55 AM
- Posted Re: timezone issue with custom log time date stamp on Getting Data In. 01-17-2018 04:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-25-2017
09:41 AM
Hi All,
We are running into serious issue with Forwarder settings. Please help
Forwarder was working fine when the set up was done. Now recently since last 1 week it is not working.. Issue - in Splunk d log - connection established and 1 event was passed and after some time the connectivity was lost and 9997 port got closed by itself.
I Google and found about stopacceptorafterqblock settings. Now my doubt is should this be in Forwarder inputs. Conf or indexer inputs. Conf..
If it is indexer inputs. Conf then which app should it be?
We have added Forwarder inputs.conf in search app in Splunk universal Forwarder..
Can some experts please help on this? This s a big hindrance for our client demo..
... View more
- Tags:
- splunk-enterprise
05-25-2017
07:11 AM
What was the issue? Please help.. We are facing same issue.. If this is resolved, can you please give snippet of inputs. Conf and output. Conf files..
... View more
05-22-2017
05:00 AM
Did the rename work? Which place in js do we need to change? I added label along with range. But it's not changed. Can you please help?
... View more
05-07-2017
09:31 AM
Hi,
There are around 50 servers for which log files are in same format... I want to track current server status, number of servers up/down at particular time and corresponding drill down etc. In the servers, log files will be in xxx.log format. Now my question is how to index these? Like having 50 different folders to monitor these with server name as source type? Or is there any other better option? Files will be picked up by using forwarders from the servers.
Please provide suggestions. Thanks
... View more
- Tags:
- server
- server-status
04-25-2017
11:17 PM
Its adding the new files . I'm flushing the data with different script. but presently its not adding any files. even then i get header rows every 1 hour
... View more
04-25-2017
08:57 PM
I removed that file and checked. Headers are still getting indexed. please help
... View more
04-25-2017
10:30 AM
There is nothing different, no spaces. Its all same as in other files. Its the first file..
... View more
04-25-2017
09:27 AM
Hi,
I'm facing a strange issue. Header rows are getting extracted as events every 1 hour. I have files flowing into monitoring path with scheduled shell script (every 15 mins).
I have done these changes in prop.conf file
CHECK_FOR_HEADER = TRUE
HEADER_FIELD_LINE_NUMBER = 1
FIELD_NAMES = "Consumer ID","Delivery code","Recipient Status","Event date"
PREAMBLE_REGEX = ^Consumer.*
Around 17 files are there with same headers. only from 1 file this issue is happening
despite all these headers are getting indexed as events.. Please help to resolve this issue.
... View more
04-05-2017
09:50 AM
I have to search the events and pull only those records that fall into resolution comparison criteria. That criteria will come from another table cell drill down. It's kind of sla calculation based on this time in each cell..
... View more
04-05-2017
09:48 AM
Thanks woodcock. I will try this. Actually I get result with resolution time>120, resolution time<240..etc. But when I pass to search I have to pass only resolution time in quotes for it to work.. That I could not achieve. Will try this.
... View more
04-04-2017
01:57 AM
Thanks. Will try. My current query pulls Resolution Time comparison. But If I pass in search I get no results found
... View more
04-04-2017
01:49 AM
It is there. But I cannot call straight forward field. I need to invoke in this way. Is it possible
... View more
04-04-2017
01:06 AM
I have tokens coming from drilldown
index="test" | eval res_time = case( "PRIORITY CODE" == "1" ,"Resolution Time <=120",1=1,"Resolution Time <2880")| table res_time
Here res_time here generates value. But i want to pass this to search and retrieve the table. if i pass this to search its not working. May be due to quotes issue. Not sure.. Please help
Thanks,
Harini
... View more
- Tags:
- splunk-enterprise
04-03-2017
10:53 AM
How to set earliest to 26th of previous month and latest to 25th of current month? if hard corded then 26th of Feb to 25th of March is the cycle. Please help with some examples. Thanks!
... View more
- Tags:
- splunk-enterprise
03-30-2017
12:20 AM
in continuous monitoring mode, how to take only latest days data. And not always all the records will repeat. If repeats discard those and consider only the new ones
Events time stamps are not unique
... View more
03-30-2017
12:02 AM
Hi,
I have a file containing 1000 records. There are multiple entries for each of the fields Eg- camp_label, del_code, Rec_ID, Event time etc.
Even the time stamp has multiple entries. say in total 1000 records
When the same file with additional records is added again the next day(1000+500 new entries) , I do not want the duplicate entries from previous file. Presently index has duplicate records as well (2500 records). How can i eliminate the duplicates in efficient manner. Will dedup with multiple fields work (like composite key)? Or is there any other better way? please suggest
... View more
- Tags:
- splunk-enterprise
03-29-2017
07:17 PM
I made the same mistake.. This was helpful.. Thank you 🙂
... View more
03-15-2017
04:15 AM
were you able to change colours? I'm facing same problem
... View more
03-15-2017
03:56 AM
Thanks a lot.. It worked!!
... View more
03-15-2017
01:41 AM
I have to produce Jan-2017 Feb-2017 in the dropdown
search query |eval datetime = strftime(strptime(mydate,"%m/%d/%Y"),"%b-%Y")|dedup datetime|table datetime|sort - datetime
I get Feb and Jan which is sorted by alphabetical order. How to sort with month order. please help. Thanks!
... View more
- Tags:
- splunk-enterprise
03-03-2017
01:46 AM
I got to know the answer. Its version issue. In 6.5 we have an option to edit the cell header in the table and this is not there in earlier versions..
... View more
03-03-2017
12:28 AM
I have formatted the table with simple table format visualization for columns in my local instance.. when i deploy it in AWS instance formatting is not shown. Also edit symbol for columns is not appearing when i edit panels. what could be the reason? please help?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-24-2021
05:20 AM
|
