Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About gaurav_maniar
gaurav_maniar
Builder
Member since:
02-05-2017
12-03-2021
Community Statistics
| Posts | 166 |
| Solutions | 29 |
| Karma Given | 4 |
| Karma Received | 54 |
| Member Since | 02-05-2017 |
Activity Feed
- Got Karma for Re: Export to csv on click of button. 02-27-2025 04:43 AM
- Got Karma for Re: Export to csv on click of button. 08-11-2024 11:53 PM
- Got Karma for Re: Export to csv on click of button. 08-05-2024 11:59 PM
- Got Karma for Re: Export to csv on click of button. 07-31-2024 10:45 PM
- Got Karma for Re: Export to csv on click of button. 06-26-2023 02:35 AM
- Got Karma for Re: sort multi value field by word length. 04-26-2023 02:45 AM
- Got Karma for Re: Export to csv on click of button. 02-24-2023 09:05 AM
- Got Karma for Re: Export to csv on click of button. 09-13-2022 05:41 AM
- Got Karma for Re: Export to csv on click of button. 06-27-2022 11:35 PM
- Got Karma for Re: Help with script to make Splunk status up automatically if Splunk is down. 03-18-2022 10:04 AM
- Got Karma for Re: Export to csv on click of button. 02-07-2022 11:12 AM
- Posted Re: Issue with Microsoft Azure add-on for Splunk on All Apps and Add-ons. 12-03-2021 03:35 AM
- Got Karma for Re: Export to csv on click of button. 07-13-2021 07:06 AM
- Got Karma for App setup.xml - 404 page not found. 02-24-2021 03:35 PM
- Posted Re: How to call a python script from an html view? on Splunk Dev. 01-21-2021 02:01 AM
- Posted Re: How to provide the upload option in a view to upload procedure documents in the Splunk app static folder? on Dashboards & Visualizations. 01-20-2021 09:31 PM
- Posted Re: How to upload file on dashboard, without navigating to another page? on Splunk Search. 01-20-2021 09:29 PM
- Posted What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
- Tagged What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
- Tagged What is the best way to monitor large log files? on Getting Data In. 12-02-2020 10:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 |
03-04-2020
03:12 AM
The limit is global for sub-searches. You can change the limit from limits.conf
[join]
subsearch_maxout = 50000
[searchresults]
maxresultrows = 50000
(but it strongly not recommended, as it highly affects the Splunk performance)
Another workaround is, in single search you can include all your data source (index, sourcetypes) ans use stats to combine the results for desired output.
You can check the following thread for more info,
https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html
https://answers.splunk.com/answers/146633/how-to-join-large-tables-with-more-than-50-000-rows-in-splunk.html
... View more
03-04-2020
01:39 AM
hi,
Let me explain the working of join command.
Let's call, search query before join as main-search and the other as sub-search.
As your query is missing some events, the possibilities are,
- In case of outer join, the result will include all the events from main-search and only matching events from sub-search. Now if the field used with join command is not available in sub-search, those events will not be available.
- There limit on results returned by sub-search. While using join command, the sub-search will only return 50,000 events. In you case, you are searching for 30 days span, so may be the sub-search event out is greater than 50,000.
For more details you can refer to - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Join
accept and up-vote the answer if it helps.
... View more
03-02-2020
06:22 AM
1 Karma
Hi,
this can be done in multiple ways.
- append - https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Append
it appends the results from the subsearch to the mail search as events
appendcols - https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Appendcols
it will add the columns from the subsearch to the main search. The first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on, without any relation.
you will get the better idea by going through the examples given on the reference sites.
accept & up-vote the answer if it helps
... View more
03-02-2020
05:17 AM
hi,
I'm also not sure about the issue, but as per understanding you can try the below solution,
- remove "Indexed_Extarction" line
- add "KV_MODE = JSON"
let me know if it works or not
... View more
03-02-2020
04:51 AM
do you want to hide the other panels or just disable the drilldown option?
... View more
03-02-2020
04:29 AM
1 Karma
Hi,
Try the below search query,
- the first part will give details regarding action performed on Index (create, edit, remove)
- subquery after join will provide the parameter and other details for the action
index=_audit action=indexes_edit operation IN (create, edit, remove)
| rename object as idx
| bin span=1m _time
| join type=outer _time, idx
[ search index=_internal params=*
| bin span=1m _time
| stats first(params) as params by _time, idx]
| table _time, user, operation, idx, params
accept & up-vote the answer if it helps.
... View more
02-28-2020
03:14 AM
1 Karma
Hi,
Add the below code in your dashboard XML, it's a hidden panel.
line-height - to change cell height
font-size - to change text/font size
<row depends="$hidden$">
<panel>
<html>
<style>
td {
line-height: 10px !important;
font-size: 5px !important;
}
</style>
</html>
</panel>
</row>
accept & upvote the answer if it helps.
... View more
02-28-2020
02:42 AM
Hi,
As per your information, there may be same models in multiple in sites.
So the output of the second stats and fields - SITE is correct.
| stats count(host) as "Number of degradation" by Model SITE
Now Splunk has prepared the results and will give you the count based on combination of "Model" and "SITE" fields.
The next command fields - SITE simply work as removing the column from the display, it will not change the results from the previous stats command.
Either remove SITE from the second stats or get the clear requirement regarding the report.
... View more
02-21-2020
03:22 AM
Hi,
In your case, you have write field extraction regex for the client_ip and user_id fields.
Check the attached screenshot, if you want field extraction like that append your query with the below code,
| rex field=_raw "Client IP address:\s(?<client_ip>[\d\.\:]+)[\s\w]+\:\s(?<user_id>[^\s]+)"
If these fields are used very often, instead of extracting them at rum time with query, you can use Splunk Filed Extraction utility to automatic field extraction.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/ExtractfieldsinteractivelywithIFX
accept & up vote the answer if it helps.
... View more
01-15-2020
12:01 AM
Hi,
I have checked your dashboard XML, the token billingperiodselected is not being used in search query.
Hence you will see no updates on the dashboard after changing the value from the dropdown.
The toke is being used for the depends parameter for a search tag.
depends is used to dynamically manage visibility of any panel in the dashboard. It has nothing to do with the value of the token.
Also, using it with search tag doesn't make any sense. If you want to change the results the token should be used in search query.
For more details, refer the following documentation.
https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/ContextualDrilldown#Show_or_hide_content
accept and upvote the answer if it helps.
... View more
01-14-2020
12:06 AM
Hi Daramjan,
Which MacOS version you are using? With MacOS Catalina, the issue is there. It wont allow to install new third party softwares (which are unidentified developer). I had the same issue and rolled back to Mojave version.
8.0.1 runs fine on my MacOS Mojave.
If you are already using Mojave, check the below article,
https://www.macworld.co.uk/how-to/mac-software/mac-app-unidentified-developer-3669596/
The last solution is, instead of using .dmg installation, try to install via source package .tgz .
Convert it to answer and accept if it helps.
... View more
01-13-2020
06:36 AM
Hi Eid,
You query regex works fine in Splunk web, but haven't checked with python.
As it is being used in python, the reason you are getting this error is most probably due to character escaping \\ at the end of your regex.
Try to play around character escapes at <Error_description>[^\\\\] and it will solve your problem.
... View more
01-13-2020
06:30 AM
1 Karma
Hi Ankit,
Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a
accept and upvote the answer if it helps.
... View more
11-16-2019
06:29 AM
Or you can directly use the below app from Splunk Base
https://splunkbase.splunk.com/app/4776/
... View more
11-16-2019
02:52 AM
sorry, it was a typing mistake.
As I mentioned in the question, both queries are working fine.
The problem is the first query is supposed to return all groups, but due to some reasons, some groups are missing in the result.
When I execute the second query explicitly for those groups it is returning the results for these groups.
So why they are getting skipped in first query.
... View more
11-15-2019
07:02 AM
Hi,
The concept of Base Search is to load the search on the dashboard loading and use it multiple times.
Splunk will pass the results of the base search to the next search, not the query. So you can add eval, stats or any other command to manipulate the data but you can edit or append to the existing base query.
You can achieve this by including default token initialization, add any where outside row elements,
<init>
<set token="base_search">| pivot shopping_reshaping Test FILTER field1 is "value1" count(Code) AS "Count of Codes" SPLITROW _time AS _time PERIOD auto SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1</set>
<init>
Now use it in your panel queries,
<row>
<panel>
<table>
<search>
<query>$base_search$ SPLITCOL Type</query>
<earliest></earliest>
<latest></latest>
</search>
</table>
</panel>
</row>
accept the answer if it helps.
... View more
11-15-2019
01:29 AM
Mr. @woodcock , can you help with this one?
... View more
11-15-2019
12:37 AM
answer updated.
Splunk javascript is stored in browser cache and in Splunk javascript changes are not loaded automatically on browser side.
So once you update your script, goto https://splunk_host:8000/en-US/_bump and click Bump Version it will reload the updated javascript.
accept the answer if it helps.
... View more
11-14-2019
06:39 AM
Hi @ryanksplunkster ,
Your problem will be solved by using regex provided by @gcusello .
This is just for better practice and suggestions.
If you can properly format your JSON and ingest the data, Splunk will automatically extract all the fields.
And by using spath command you can group json elements and extract the required values without writing regex.
I have formatted your json sample data - https://jsonblob.com/d8185020-06e9-11ea-b8b2-d99444fde766
In this case, the activity can be easily extracted by appending | spath output=ACTIVITY_FIELDS path=activity to your query.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
... View more
11-14-2019
05:25 AM
1 Karma
Hi,
append the below code to your query,
If you want calculate the length of entire multi value field and than sort
...| eval mv_length = len(mv_field) | sort mv_length | fields - mv_length | ...
If you want to calculate the length of each value in multi-value field,
...| mvexpand mv_field | eval length = len(mv_field) | mvcombine mv_field delim="," | sort length |...
accept the answer if it helps.
... View more
11-14-2019
12:59 AM
I'm trying to create a lookup of the domain, ad group and user using ldapsearch command from Active Direcotyr Add-on .
The below query is schduled as report and generates the lookup. If I manually verify the the data, some groups and all users from that groups are missing in the lookup.
| ldapsearch domain="test_domain" search="(&(objectClass=group))" attrs="sAMAccountName,member,groupType,sAMAccountType"
| search groupType=SECURITY_ENABLED
| spath
| rename sAMAccountName as sAMAccountName1
| mvexpand memebr
| ldapfetch domain="test_domain" dn="member" attrs="sAMAccountName,distinguishedName"
If I include the group names in the query, it generates the required lookup for the specified groups only.
| ldapsearch domain="test_domain" search="(&(objectClass=group)(|(cn=grp_prefix1*)(cn=grp_prefix2*))" attrs="sAMAccountName,member,groupType,sAMAccountType"
| search groupType=SECURITY_ENABLED
| spath
| rename sAMAccountName as sAMAccountName1
| mvexpand memebr
| ldapfetch domain="test_domain" dn="member" attrs="sAMAccountName,distinguishedName"
I'm not able to figure out, why the first query not returning the results for particular groups.
I also checked that, ignore/skipped groups is not due some outputlookup limit or alphabetical order.
Is there any limit on ldapfetch command for returning results?
Let me know if any other details are required.
... View more
11-14-2019
12:02 AM
Hi,
For MAC there are two types are of packages are available, depending on the package you have downloaded check the below instruction.
tar.gz - you have to extract the file. It will create a folder with splunk name. Now to start Splunk execute command,
/path_to_splunk_folder/bin/splunk start
.dmg - once download is complete, you can open that file and it will guide you through setup instruction. Once setup is completed it will create the Application Link on Desktop.
For more details refer to the MAC Installation Manual.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Installation/InstallonMacOS
accept the answer if it helps.
... View more
11-13-2019
11:55 PM
Hi,
can you please check the given sample data, "activity" keyword is not there.
One more thing, your json data format is not correct, its having tow types of double quotes,
" U+0022 QUOTATION MARK
“ U+201C LEFT DOUBLE QUOTATION MARK
check the difference at first key value pair "Y“
Once your data is in correct format, you can ingest it as json format and use spath command to get values of keys.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
... View more
11-12-2019
02:22 PM
Hi,
It is possible by migrating db/buckets folders from the old index location to the new location.
Details with example
old index path - splunk_home/var/lib/splunk/perfmon
new index path - splunk_home/var/lib/splunk/perfmon_windows
Now both index path will be having coldb, thaweddb & db folder. These folders contain your index buckets.
The buckets folder name format - db_xxx_xxx_<id> or hot_v1_<id> .
Now move these bucket folders from old location to new location and while moving make sure that there are no duplicate ids in the bucket folder name.
Re-enumerate the IDs of the new buckets at the end of the existing range, or in a completely new range while copying to the new location.
make sure Splunk is stopped before the bucket movement
... View more
11-12-2019
05:31 AM
The issue is with unbalanced quotes "" .
Try the below queries,
| jirarest jqlsearch "project=CHANGE AND issuetype in (\"App Code\", \"PaaS\" , \"Arch\", \"CR-PaaS Maint\", \"CR-Akamai\")"
and
| jirarest jqlsearch "project=CHANGE AND KEY=\"CHANGE-88778\""
all the programming languages and tools follow nested quotation rules.
as per the rule, all sub-level quotes should be escaped (using \\ )
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-03-2021
07:08 AM
|
Karma from
