Hi, when i login to my CISCO APIC fabric devices, I see there are plenty of active connections with user splunk . And its somehow not good for the device health. Can someone please help me to identify why i am seeing so m any active connections and is there any timeout option which i can use or increase the interval of the connections getting opened. Thanks ... View more

Hi, It may be a very simple question but i want to know how the indexing actually works when the indexer is down for a few hours or a day. What happens to the data? will i lose it or it will get indexed once the indexer is up and running ? I have 1 indexer/ 1 searchhead/ 1 heavyforwarder/ 1 deployment Licensing server. Also how to maintain data resiliency in this scenario Thanks ... View more

Hi, Using below query now i am showing the trend of growth of one particular index for last 7 days. index=_introspection (host=indexername) sourcetype=splunk_disk_objects component=Indexes | rename data.* AS * | search name=assets | eval totalindexsize=total_size+datamodel_summary_size | eval totalindexsize_GB=(totalindexsize/1024) | fillnull value=0 totalindexsize_GB | bin span=1d _time | stats avg(totalindexsize_GB) AS Total_Index_Size(GB) by host,name,_time | convert timeformat="%d-%m-%Y" ctime(_time) AS date | rename name as IndexName | table date, host, IndexName, Total_Index_Size(GB) | sort - Total_Index_Size(GB) But my management wants to see growth of top 5 indexes which grew drastically. how to achieve that. That too using the line graph Thanks ... View more

The search I am using is below and in the output for few I am getting 3 records in the filed manage. Please help me to write a rex to get only a single record where protocol:{name:ssh} index="unicorn" |fillnull value="_" | search infrastructure{}.name="FRA-SGSS ZONE PARTENAIRE FRANCE" location.building="*" type.name="*" location.room="*" teamInCharge{}.name="*" |lookup Input_splunk_all.csv RTR as name |spath output=manage remoteManagement{} | table name manage If you see the output below for the name PFSOFW401 and PFSOFW01, I am getting more than 1 line for the manage filed- there I need single record. name manage TIGSGSSFR01 {"id":12584,"protocol":{"name":"ssh"},"ip":"192.0.4.193","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":3434} TIG-DMZ-SGSSFR-S01 {"id":15320,"protocol":{"name":"ssh"},"ip":"192.0.4.171","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":5164} SOCGEN-SGSS-CLICHY {"id":43103,"protocol":{"name":"ssh"},"ip":"223.3.2.145","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":22626} SOCGEN-DMZ-TIGERY {"id":43101,"protocol":{"name":"ssh"},"ip":"223.3.2.143","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":22624} RT2821-LEV-MIN-A18 {"id":43102,"protocol":{"name":"ssh"},"ip":"192.168.1.37","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":22625} PFSOFW401 {"id":17899,"protocol":{"name":"console"},"ip":"172.16.16.210","port":"22","additionalInformation":null,"plainTextURL":null,"login":"pfsofw401","password":null,"device":7076} {"id":17900,"protocol":{"name":"https"},"ip":"192.0.32.230","port":"443","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":7076} {"id":17644,"protocol":{"name":"ssh"},"ip":"192.0.32.230","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":7076} PFSOFW01 {"id":17897,"protocol":{"name":"console"},"ip":"172.16.16.210","port":"22","additionalInformation":null,"plainTextURL":null,"login":"pfsofw01","password":null,"device":7077} {"id":17898,"protocol":{"name":"https"},"ip":"192.0.4.41","port":"443","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":7077} {"id":17645,"protocol":{"name":"ssh"},"ip":"192.0.4.41","port":"22","additionalInformation":null,"plainTextURL":null,"login":"matricule SG","password":null,"device":7077} Thanks. ... View more

Hi, My requirement is i have given user to choose 2 dates and depending on the dates chosen i need to show pie chart so that the user can see the difference of count from Date1 to Date2. Here is the query am using now. and i am showing that in two different panels. But it would be better if i can compare using same panel same graph. Note: Dates are not a range. Example: Date1 = 20/09/2019 and Date2 = 17/10/2019 index="compliance_sum" | table name result ruleName |appendpipe[lookup netshot.csv Nom as name OUTPUT "Infrastrucure Name" teamInCharge] |table name result ruleName "$infraname$" teamInCharge |search "Infrastrucure Name"="FRA-SWING" |search teamInCharge="$team$"| search result="NONCONFORMING" | eval templateType= macro_template | where result="NONCONFORMING" | stats count by teamInCharge templateType | eval teamInCharge=teamInCharge." : ".count Thanks ... View more

Hi, I have a query output which have many fields out of which only 2 fields have more than one values. So when those fields have more than 1 value i want them to make new row entry with other field values remaining same. index=assets [|inputlookup abc.csv | search "Infrastrucure Name"="*" AND teamInCharge="*" AND type="*"| fields + Nom | rename Nom as name] | search result="*" AND ruleName="*" | table name "mgmtAddress.ip" ruleName policyName result status | rename "mgmtAddress.ip" as ip | eval name=upper(name)| lookup abc.csv Nom as name output "Infrastrucure Name" "teamInCharge" Output is as shown in the image I want now 2 different rows as there are 2 Infrastructure names. Please help. ... View more