About Praz_123

Praz_123 · ‎04-03-2025

@livehybrid I ran the | rest /services/cluster/manager/health But while CM was down at that time also am getting value 1 but it should show 0 . As I need to create a Alert for this but am not getting the correct output

Praz_123 · ‎04-03-2025

Is there is any query to check like if there is any fixup pending and also it shows SF , RF and data is searchable in the cluster master . We can check in cluster master U.I but without going there is there anywhere this log are store so that we can fetch. I need to created a query which shows the status of SF, RF and searchable in Cluster Master also if there are any fixup pending.

Praz_123 · ‎03-16-2025

Need help for the below Query index=na sourcetype=na:co state=down host_state_type="HARD" [| tstats prestats=f values(host) as host_name WHERE index=df AND host!=1* | eval host_name=lower(host_name) | mvexpand host_name ] | stats count as DownMins by host_name |sort - DownMins|head 25 | addcoltotals label=Total labelfield=host_name While am running the query for last 24 hours its showing results but when I reduced the time range to less than 24 hours it's not showing any output but previously this query is running fine. Also while I run the query like - It shows me output for last 24 hours - index=na sourcetype=na:co state=down host_state_type="HARD" while I search the same host in - index= df host="ooo" Am getting the results while combining both not getting results less than 24 hours Also I can see in the backend those host are down but not showing in Splunk query

Praz_123 · ‎03-12-2025

@livehybrid @gcusello Thanks for your help but I created a query which shows me the required results | rest /services/server/introspection/indexer | where match(splunk_server, "indexer") | eval status = if(status == "normal", "up", "down") | table splunk_server, status

Praz_123 · ‎03-11-2025

Is there is any Query to check whether the indexers status is down, up or in unknown state . I can check in monitoring console but need a query to see for all indexer.

Praz_123 · ‎02-18-2025

How can I export the host values in excel for the particular serverclass Is there is any query for that that will be helpful . Path will be Deployment server -> forwarder management ->serverclass -> action (edit clients) -> need to export the hostname from the list

Praz_123 · ‎02-11-2025

How can i find ulimit value/status for all server in monitoring console.

Praz_123 · ‎01-30-2025

@tomdaniel <style> /* Hide the "Populating..." text */ .loading-msg { display: none !important; } </style> <dashboard>  </dashboard>

Praz_123 · ‎01-29-2025

@zksvc Did you checked splunk status or check the splunk logs

Praz_123 · ‎01-29-2025

@perfeng Try this { "type": "splunk.table", "dataSources": { "primary": "ds_zn4Nlcdc" }, "title": "Some title", "options": { "columnFormat": { "name": { "width": 109 }, "team": { "width": 60 }, "url": { "drilldown": "customUrl", "url": "$row.url.value$", "newTab": true } }, "headerVisibility": "fixed" }, "description": "Some description.", "eventHandlers": [ { "type": "drilldown.customUrl", "options": { "url": "$row.url.value$", "newTab": true } } ], "context": {}, "containerOptions": {}, "showProgressBar": false, "showLastUpdated": false }

Praz_123 · ‎01-29-2025

@PickleRick But how can I get the data like below image Praz_123_0-1738214744917.png

Praz_123 · ‎01-29-2025

@PickleRick Error - INFO: Cannot use span, bins on a remote storage index unless cached=f is specified (index "_internal").

Praz_123 · ‎01-29-2025

@PickleRick I need to get the result like the below shown as in image but while am running span=1d it shows error Praz_123_0-1738159593580.png

Praz_123 · ‎01-29-2025

@Karthikeya Based on your logs you can fetch data like 1. For time chart - This shows how violations are trending over time, with separate lines for successes and failures. | eval violation_type=if(like(violations, "%failed%"), "Failure", "Success") | timechart span=1h count by violation_type 2. Bar chart - This shows the top 10 attack types by frequency. | stats count by attack_type | sort - count | head 10 3. Pie or bar chart - This helps you visualize how often each HTTP response code (e.g., 200, 404, 500) is returned. | stats count by response_code 4. Bar chart - This shows the most frequently accessed URIs, which could help you understand which endpoints are under attack. | stats count by uri | sort - count | head 10 Hope this works 🙂

Praz_123 · ‎01-29-2025

Hi @Karthikeya Will you describe in more details like what exactly you are looking for .Will you just give sample data so that will help you with the query.

Praz_123 · ‎01-29-2025

How to find the bucket status in the CLI As I am using the below query :- ./splunk search "| dbinspect index=_internal span=1d"

Praz_123 · ‎11-08-2024

@PickleRick so basically there is window server they had U.F which is forwarding data to Splunk. While I checked the _internal logs not able to find anything on search head . What should I do next

Praz_123 · ‎11-07-2024

@PickleRick like while am searching in Splunk indexer am not able to see host, index and source for the windows server at that specific time.

Praz_123 · ‎11-07-2024

@PickleRick error is something like Read error. An existing connection was forcibly closed by the remote host.

Praz_123 · ‎11-06-2024

After Splunk forwarder version got upgrade from 9.0.5.0 to 9.3.1.0 windows server are having issue in forwarding the data to Splunk. Splunkd is stopping often in different server after restarting splund it start forwarding the data but issue comes again after 2,3 days what actions to be taken to make the logs flow easily to Splunk

Praz_123 · ‎10-22-2024

@gcusello Thanks for your reply but the problem is am not able to find like which index is causing the issue at the point of time which making the bucket count increase also . How can we see the data ingestion trend for today?

Praz_123 · ‎10-21-2024

How we can check the data coming to Splunk creating problem to CM making it unstable leading the peers to reach more than 2k+ and also RF and SF are red .

Praz_123 · ‎04-10-2024

How Splunk admin give access for a service account AB-CDRWYVH-L. Access for- Splunk API read write access

Praz_123 · ‎03-05-2024

@kiran_panchavat , thanks for your help

Praz_123 · ‎03-05-2024

Can , anyone help me where can I find the above dashboard in splunk , in Monitoring console.

Posts	79
Solutions	1
Karma Given	13
Karma Received	3
Member Since	‎07-12-2023

Online Status	Offline
Date Last Visited	a week ago

data not coming in one of the sourcetype

Splunk universal forwarder upgrade

query help

need to optimize the below query

how to make splunkd working

query help in splunk cloud

Monitor Data Ingestion Health and Latency using c...

Assistance Required for Troubleshooting Splunk Ent...

Need help in writing regex

Need to write a regex for time extraction

Re: query to check fixup , SF, RF and data is sear...

query to check fixup , SF, RF and data is searchab...

Need help in query

Re: Query to check the indexer is down, up or in u...

Query to check the indexer is down, up or in unkno...

export serverclass hostname

need to check where is ulimit value

Re: How to hide "Populating..." under drilldown in...

Re: Javascript Error in Enterprise Security and Sp...

Re: Splunk Dashboard Studio Table Hyperlink on ONE...

Re: How to find bucket status

Re: How to find bucket status

Re: How to find bucket status

Re: Splunk query suggestion

Re: Splunk query suggestion

How to find bucket status

Re: Not getting splunk logs

Re: Not getting splunk logs

Re: Not getting splunk logs

Not getting splunk logs

Re: how to check data ingestion trend for today?

how to check data ingestion trend for today?

how to give access for splunk api by splunk admin

Re: In Monitoring console where I can find this da...

In Monitoring console where I can find this dashbo...

Join the Conversation