About anil1432

anil1432 · ‎06-21-2021

We have new servers in which we installed new Splunk forwarders that are running fine. In case of a system reboot, we would like to also start it up automatically. I noticed that our old servers has this file /etc/rc.d/init.d/splunk which is described in this guide https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/ConfigureSplunktostartatboottime We don’t know who configured it for our old servers, but may I confirm that I need to follow the steps in the previous link and that I also need to be a root user to run splunk enable boot-start -user <preferred user>?. Please can you give brief explanation and solutions please

anil1432 · ‎06-13-2021

anil1432 · ‎06-13-2021

Good morning. I added new PRD Splunk forwarders and sourcetypes last Wednesday night, June 9. I can see the events in sourcetype list, but I cannot see the events listed at all when using search for sourcetypes starting with "sens2". We have been conducting load tests since last Thursday, June 10. We also can't see the events an hour ago. User=user_sens, no events listed for sourcetypes "sens2-ntfapi-dsl-order", "sens2-ntfapi-api-order-async", "sens2-ntfapi-api-order-async-performance", "sens2-ntfapi-api-basic", "sens2-ntfapi-api-basic-performance" since Thursday last week. The count shows a lot of events collected. We only started logging last Thursday to PRD Splunk.

anil1432 · ‎06-13-2021

If I give capital "T" in place of small "t" then my logs started genarating . What might be the solution

anil1432 · ‎06-13-2021

anil1432 · ‎06-13-2021

I have one file which is monitoring from 1 year in deployment server in inputs my file name is sourcetype: D:\Applications\Smartfill-tools\*\logs\*.log . I received my logs correctly till 2nd April , but after that m geeting error like this And also file is modified automatically on March 18th D:\Applications\Smartfill-tools\*\logs\*.log To D:\Applications\Smartfill-Tools\*\logs\*.log and if I check with this D:\Applications\Smartfill-Tools\*\logs\*.log again my logs are coming. But I don't know how file path name is modified . And also deployment server in inputs the file path is D:\Applications\Smartfill-tools\*\logs\*.log and if I change to this D:\Applications\Smartfill-Tools\*\logs\*.log and deployed .then if I check in search then my logs are coming. I want to know how file path is modified automatically and also small change small "t" to capital "T" is changed . If you want more information please reach me out

anil1432 · ‎06-13-2021

Sorry I didn't get your solution and what your trying to convey is some thing difficult to me please explore in brief please

anil1432 · ‎06-10-2021

So I need to delete only events from my from my logs. i.e from 17/05/2021 to delete events . How can I ?

anil1432 · ‎06-10-2021

Hi All, How can I delete my logs permanently Request to delete old Splunk logs for EMS and Truvue webservices that are older than 05/17/2021. * Long Description Request to delete old Splunk logs for EMS (App id: 2926) and Truvue webservices (App id: 637) that are older than 05/17/2021 as required by Experian GSO as these logs contained plain text Pll data. As part of an Insider Threat audit currently being performed the following Splunk index was flagged as containing clear text Pll data originating from a production host. eits_ec_prod_us Items in Index: Name/Address/DOB/SSN Host names: mckecpap043v mckecpap044 I alnecsap456V alnecsap455v Source = /logs/TRUVUEWS_V6/TRUVUEWS_V6-std.log

anil1432 · ‎06-10-2021

Hii everyone, Please can any one do splunk query optimization. Phenomenon we are facing The report count looks incorrect and we could see this error as below. --- [subsearch]: Subsearch produced 2602757 results, truncating to maxout 2000000. And this is my query (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate. please provide me a solution

anil1432 · ‎06-09-2021

Can you please solve the query . Issue with limits.conf (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate

anil1432 · ‎06-04-2021

As far as I can explain this background, we have been using Splunk to know business conditions but we faced the issue on the Splunk. That issue is that when we tried to see User's 7day's churn rate, we were using that query on Splunk which I shared with you on previous e-mail. However, from around Feburary, churn rate was suddenly sprung up on our demographic tools as I attached capture image (we connect with Splunk report with DOMO). And we found that this issue is caused by .limitconf settings. This is the reason why I asked a question to change the settings. I would like to provide you more infromation, but I could not do that due to not having more additional information.

anil1432 · ‎06-03-2021

I need to know more details about splunk usage for Paas/Rpaas users. Can you define us some brief explanation please. Thanks in advance

anil1432 · ‎06-03-2021

If we increase the subserach limit to 3000000 any issue / problem will occur ?

anil1432 · ‎06-03-2021

Okay let me see , if it works , But you suggest me that we should not change limits to limits =3000000010 right? So if we do that any problem will occur? So better we should reduce the query and run the search right 😊

anil1432 · ‎06-03-2021

So can I use summary index to get correct count? For this issue or?

anil1432 · ‎06-03-2021

Actually I am facing this issue sir, I would like to ask a question about changing settings of Splunk. We have been using Splunk for few years for now. currently we are facing issues that Splunk can not dsplay results correctly. ■Background History We observe users churn rate through Splunk by using query. ■Phenomenon we are facing The report count looks incorrect and we could see this error as below. --- [subsearch]: Subsearch produced 2602757 results, truncating to maxout 2000000. --- ■Question As we investigated through some docs, I guess we have a option to change the upper limits by changing "limits.conf". Would it be possible to change limits from current 2,000,000 to 3,000,000 or 3,500,000 ?

anil1432 · ‎06-03-2021

And also I want to solve subsearch error. I will arrange in neat query (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate.

anil1432 · ‎06-03-2021

This is. My query and I want to know my summary index (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate

anil1432 · ‎06-03-2021

Okay thanks for your answer 1)If user have separate index and if we can have any problem regarding sub search . can I troubleshoot from summary index? To get the correct report count Like mentioning summary index =index And some query To solve Phenomenon we are facing The report count looks incorrect and we could see this error as below. --- [subsearch]: Subsearch produced 2602757 results, truncating to maxout 2000000. For user if I run a query

anil1432 · ‎06-03-2021

I have a question please summary index is like mixup up of all indexes? Like index 1 , index2 , index 3..... Combination of these three index data is stored in summary index ? . Or else one entire index is summary index? Please confirm me this plz Thanks in advance for you support

anil1432 · ‎06-03-2021

How to know that , how my summary index is implemented?. I know that only uses for implementing scheduled searches and reports . May I know it's correct . Otherwise can please you please provide me some solution . How to find out that our summary index is implemented Thanks in advance

anil1432 · ‎06-02-2021

1.(host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id 2.[search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] 3. | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate. This is you want me do sir or anything else do I need to do Can you give me suggestions Thanks in advance

anil1432 · ‎06-01-2021

This is my query sir, (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate. Can you please help me further plz

anil1432 · ‎06-01-2021

@bowesmana Thank you very much it's very helpful 😊😊🤘

Posts	60
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎02-06-2020

Online Status	Offline
Date Last Visited	‎03-04-2022 01:37 AM

How to search data usage by sourcetype

Logs are not genarating , root cause is TailReafer

Unable to export millions of records

Log events are missing

How to find last 3 months data usage and what logs...

Remove closed search heads in our splunk cluster O...

Search peer went down

Issue in Splunk Cluster

SENS STG Splunk new alerts unable to send emails

Unnable to Access the splunk search page

How to run splunk forwarder on system startup

Re: SENS-PRD splunk not listing events in search r...

SENS-PRD splunk not listing events in search resul...

Re: How my file path name is modified automaticall...

Re: How my file path name is modified automaticall...

How my file path name is modified automatically

Re: Subsearch error

Re: Delete logs

Delete logs

Subsearch error

Re: Why is there a 10000 rows limit?

Re: How to know that summary index is implemented

Splunk usage for Rpaas user

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

Re: How to know that summary index is implemented

How to know that summary index is implemented

Re: Currently we are facing issues that Splunk can...

Re: Currently we are facing issues that Splunk can...

Re: Some cost calculation by counting the number o...

Join the Conversation