Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About human96
human96
Communicator
Member since:
02-13-2022
04-18-2023
Community Statistics
| Posts | 73 |
| Solutions | 0 |
| Karma Given | 30 |
| Karma Received | 0 |
| Member Since | 02-13-2022 |
Activity Feed
- Karma Re: Is there a way to encrypt sensitive data in index time and decrypt it in search time in Splunk? for Chiranjeev. 04-18-2023 11:51 AM
- Posted Re: splunk encryption on Splunk Search. 04-18-2023 06:35 AM
- Posted Does anyone know what is explore data option under settings? on Splunk Enterprise. 04-18-2023 05:41 AM
- Posted Re: splunk encryption on Splunk Search. 04-18-2023 05:37 AM
- Posted Is there a way to encrypt sensitive data in index time and decrypt it in search time in Splunk? on Splunk Search. 04-18-2023 12:16 AM
- Posted Re: How to combine multiple events into a single event based on identical timestamp on Getting Data In. 03-18-2023 11:35 PM
- Posted Re: How to combine multiple events into a single event based on identical timestamp on Getting Data In. 03-18-2023 11:26 PM
- Karma Re: How to combine multiple events into a single event based on identical timestamp for gcusello. 03-18-2023 11:22 PM
- Karma Re: How to combine multiple events into a single event based on identical timestamp for PickleRick. 03-18-2023 11:22 PM
- Posted How to combine multiple events into a single event based on identical timestamp? on Getting Data In. 03-17-2023 11:09 PM
- Posted Is it possible to do Line breaking and Event breaking in Universal Forwarder ? on Splunk Enterprise. 02-13-2023 12:17 AM
- Posted Why am I getting null values in my results? on Splunk Enterprise. 10-18-2022 08:07 AM
- Posted Re: How to check when splunk's automatic processing is finished? on Splunk Enterprise. 08-22-2022 06:23 AM
- Posted Re: Restrict users from export data on Splunk Enterprise. 03-30-2022 11:27 PM
- Posted Re: Restrict users from export data on Splunk Enterprise. 03-30-2022 11:15 PM
- Karma Re: Restrict users from export data for VatsalJagani. 03-30-2022 11:11 PM
- Posted Re: Restrict users from export data on Splunk Enterprise. 03-30-2022 10:48 PM
- Posted Re: How to search a splunk search result? on Splunk Search. 03-30-2022 09:48 PM
- Posted How to restrict users from export data via RestAPI, CLI ? on Splunk Enterprise. 03-30-2022 09:41 PM
- Posted How to upgrade Splunk from 8.2.2 to latest version? on Splunk Enterprise. 03-29-2022 09:57 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-11-2022
09:53 PM
Hi, thanks for your response. yes i have access to the CLI. could you please be kind enough to guide me how to do it from CLI ? it will be more helpful if you prove me any splunk documentation.
... View more
03-11-2022
04:41 AM
i have 2 servers, i want to move the studio dashboard with background image to anoither server. is there a way to do that ?
... View more
03-11-2022
04:22 AM
i have a dashboard, is there a way to move that dashboard studio screen to another server? please provide some documentation.
... View more
Labels
03-10-2022
12:47 AM
Is it possible to configure HF's inputs.conf for data transferring from UF?
Please provide some Splunk documentation
... View more
Labels
- Labels:
-
configuration
-
installation
03-08-2022
10:29 PM
can anyone explain me tsidxWritingLevel variables from 1 to 4 ?
tsidxWritingLevel = [1|2|3|4]
Reference - https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Indexesconf?_ga=2.85851486.671277735.1646626990-1267829109.1638160623&_gl=1*hp9d3s*_ga*MTI2NzgyOTEwOS4xNjM4MTYwNjIz*_gid*NjcxMjc3NzM1LjE2NDY2MjY5OTA.
... View more
Labels
03-08-2022
12:04 AM
Windows Event Log (.evt) and Windows Event Log XML (.evtx) files that you exported from another Windows machine don't work. https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Uploaddata the better way would be- 1. convert your evtx files to csv using logparser ( by Microsoft ) $logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx"
& $logparser -i:evt -o:csv $query 2. forward those converted csv file directly to splunk.
... View more
03-07-2022
05:36 AM
i installed a universal forwarder in Windows server 2019. assume i configured for 2 heavy forwarder and persistent queue is 10 GB. Does that mean i'll get 20 GB for 2 heavy forwarder or 10 GB for 2 forwarder ? where and how can i check my persistent queue, whether the data is storing or not ?
... View more
03-07-2022
03:07 AM
i have 1 universal forwarder and 2 heavy forwarder.
If two of my heavy forwarder lost communication with the UF at the same time, how will the data accumulate in the persistent queue of the UF?
please provide splunk documentation or previous splunk community Q&A if you have any.
... View more
03-04-2022
01:25 AM
when splunk is running in a production server , what complication can happen ?
... View more
Labels
03-02-2022
10:37 PM
hi @SanjayReddy , thank you so much for your quick response. i already encountered with this add-on. would it be possible for you to simulate this and let me know the step-by-step process how to do it ?
... View more
03-02-2022
10:18 PM
[ VERY URGENT ]
Hi all, Does anyone has knowledge about how to push symantec antivirus logs to splunk or pull logs from symantec antivirus.
step - by - step process to do it.
... View more
03-02-2022
12:13 AM
functionality of these add-ons ? ・Trend Micro Deep Security for Splunk ・Splunk Add on for Amazon Web Services ( all reply will appreciated with karma )
... View more
Labels
03-01-2022
12:02 AM
hi, i know many have answered this question before but i didn't find any perfect and detailed answer. Setup :- UF ---> HF -----> IDX Q1. i have a file called test.txt ( Location :- /send/test.txt ). i want to send the txt file from to UF to HF to IDX. ( Receiving ports 9997 is open and configured for all as well ) How do i do it ?
... View more
Labels
02-28-2022
04:00 AM
hi @gcusello, i have one following question though, Can I overwrite and save files with the same file name when uploading? if yes, what is the most efficient and easiest way ?
... View more
02-28-2022
03:58 AM
hi @gcusello , Thanks a lot. just encountered with the app. which is very intuitive and easy to use.
... View more
02-28-2022
03:39 AM
is there a way for a user without admin privileges to export existing lookup file information locally after processing and upload CSV with the same file name after manual update?
... View more
02-27-2022
09:21 PM
From my prospective , i believe the indexing speed by source, sourcetype, host, or index can be calculated using the below SPL or the search query. index="_internal" source="*metrics.log" per_source_thruput series=ps | eval MB=kb/1024 | timechart span=5m sum(MB) by series
... View more
02-22-2022
04:01 AM
thanks for the quick response @gcusello , really appreciate this. can we also check by event or file (source)? Will really appreciate if you could attach the splunk documentation.
... View more
02-22-2022
02:25 AM
how to check the transfer speed from UF to indexer ? is it possible to check by events or source ?
... View more
Labels
- Labels:
-
Linux
-
universal forwarder
02-21-2022
09:35 PM
It is set to select the host value as the file name.
The name of the file that UF was reading will be changed in the middle of the file.
Which of the following is your host name?
(1) The one before the change (2) The one after the change
... View more
Labels
- Labels:
-
configuration
02-19-2022
10:46 PM
I want to control the number of concurrent user searches on an app-by-app basis. I think it is possible to control the number of concurrent executions on a role-by-role basis, but is it possible to control on an app-by-app basis? If control is possible on an app-by-app basis, please tell me how to control it. (I think it is feasible by distributing limits.conf (base_max_searches) under App.)
... View more
Labels
02-17-2022
08:10 PM
Hi @somesoni2 thanks for your response. I already reviewed these threads given below and still unclear with my posted question. https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Limitsconf https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/Limitsearchprocessmemoryusage Could you please answer the question in details. Thanks
... View more
02-17-2022
03:26 AM
Could you please tell me about the following? If I want to limit memory usage for a search, is it correct to think that I should set the following? ＝＝＝＝＝ [search] enable_memory_tracker=true search_process_memory_usage_threshold=10000 search_process_memory_usage_percentage_threshold=60
＝＝＝＝＝
※ If either value of "10000 (MB)" or "60 (%)" is reached, the operation is forcibly terminated.
Is it correct to understand that the above setting is for all searches including ad hoc searches?
If I want to enable the settings for all app searches, is it safe to add them to limits.conf below? $SPLUNK_HOME/etc/system/local/limits.conf
※Set to $SPLUNK _ HOME/etc/apps/App name/local/limits.conf to search for individual apps.
Am I correct in thinking that the above limits.conf settings should be set for both SearchHead and Indexer?
... View more
Labels
02-17-2022
02:33 AM
thanks @ITWhisperer , but i'm not getting the value " 0 ". so i would like to add more to your spl | stats count by flag system | xyseries flag system count | fillnull value=0
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-18-2023
03:15 PM
|
Karma given to
