Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About impurush
impurush
Contributor
Member since:
05-29-2017
07-18-2023
Community Statistics
| Posts | 105 |
| Solutions | 14 |
| Karma Given | 44 |
| Karma Received | 19 |
| Member Since | 05-29-2017 |
Activity Feed
- Got Karma for Re: multiple host input listing in splunk query (search & Reporting). 01-06-2023 12:27 AM
- Karma Re: How do you disable/enable alerts via the REST API? for tmontney. 05-31-2022 02:25 PM
- Karma Re: reducing splunk fishbucket size for gjanders. 05-12-2022 12:50 PM
- Posted Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor? on Splunk Enterprise. 05-12-2022 12:48 PM
- Posted Re: Clearing fishbucket in UF on Getting Data In. 05-02-2022 02:20 PM
- Karma Re: Clearing fishbucket in UF for gcusello. 05-02-2022 02:16 PM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 05-02-2022 06:44 AM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 04-13-2022 11:59 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-07-2022 09:37 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 06:45 PM
- Got Karma for Re: Trigger Alert and avoid false p[positives. 02-04-2022 04:16 PM
- Karma Re: Trying to find host that send logs over the last 7 days for PickleRick. 02-04-2022 05:56 AM
- Posted Re: Add export button on top of a dashboard on Splunk Dev. 02-04-2022 05:53 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 05:50 AM
- Karma Re: why user with same role not able to see data for isoutamo. 08-10-2021 07:05 AM
- Karma Re: Need help: Stack 2 panels left, and have 1 panel on the right. for richgalloway. 08-10-2021 06:27 AM
- Posted Re: splunk add on for salesforce on Splunk Cloud Platform. 08-10-2021 06:26 AM
- Posted Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-11-2021
07:16 AM
Hi @vn_g , For dashboard, the trail 3 is working perfectly, I have tested in my environment. For Alert, I have modified your trail 3 query and getting the results correctly. index=_internal sourcetype=splunkd_ui_access method=post saved/searches NOT StreamedSearch | table req_time,file,user | rename file as Alertname req_time as editTime
... View more
03-10-2021
07:18 AM
1 Karma
Hi @vn_g , As per my knowledge, you can see when and who accessed the UI of Saved searches and dashboards API, however, we cannot see what is changed because Splunk is not maintaining any versions of these knowledge objects. You may need some additional apps to monitor the changes.
... View more
03-05-2021
01:14 PM
Looks like a connectivity problem between the forwarder and Deployment Server. Check the connection between both.
... View more
03-03-2021
01:21 PM
1 Karma
https://community.splunk.com/t5/Archive/Why-am-I-getting-the-error-quot-You-do-not-have-the-capability/m-p/252465 As mentioned here, looks like there is no index assigned in your roles, hence the add data is showing error like this. Go to setting->roles->Go to your role->index, assign some index to your user.
... View more
01-27-2021
03:21 PM
I have a 200 GB/day license installed in the Splunk Enterprise Cluster. The daily usage of license hovers around ~180 constantly in the whole month except mid of the month and end of the month. It reaches ~250 GB on those days, like 5 days in a month. What is the best way to accommodate the above use case? 1. To buy 250 GB/day license (Which I think it will be useless for the remaining 25 days because it is constantly less than the 200 GB) 2. Is there any way to scale up and scale down the license in terms of pricing? Thanks in advance!
... View more
- Tags:
- Licenseing
01-25-2021
06:30 AM
I have done few changes to solve the issue. IgnoreOlderthan=1d blacklist=filename.<yesterday>.txt (Because all the older files are in the same folder structure) Restarted the forwarder exactly at 12o clock Even though few lines of data got re-indexed, however, it is around 10 to 20 lines only which were acceptable.
... View more
01-22-2021
06:28 AM
Thanks @manjunathmeti for answering the question. However, if we put crcSalt=<SOURCE>, then the older files are getting re-indexed because the files are in same folder. Example: /app/folderA/locationA/filename_yyyy-mm-dd.txt /app/folderB/locationB/filename_yyyy-mm-dd.txt So if we put crcsalt in any of the file, under the location all the files are getting re-indexed. If we put ignoreOlderthan=1d, still the yesterday file is getting re-indexed.
... View more
01-21-2021
10:23 AM
I am getting the below error because of two files has same first two lines including timestamps in the different folder. ERROR TailReader - File will not be read, seekptr checksum did not match (file=filename.2021-01-19.txt). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. The monitoring stanza has filename.*.txt. So if I increase the initcrc or crcSalt, then all the files under the folders will get re-indexed. Along with crcSalt, I tried to use ignoreOlderThan but still, the old files are getting re-indexed. Example: ignoreOlderThan=1d, means still yesterday files are getting re-indexed. Any better solution to prevent this?
... View more
Labels
- Labels:
-
universal forwarder
01-20-2021
12:46 PM
We are planning to move to Smartstore for the cold storage and we are having the on-prem multisite indexer cluster. We are having two S3 object storage created with our partners. Can I point out the two different S3 object storage to each site? (I know the suggested solution is to have a single indexer cluster should have single S3 object storage) What would be the best way to migrate from On-prem to Smartstore. Our configuration around 10 indexers with each 10 TB of data on the daily volume of 300 GB/day. Thanks in advance!
... View more
Labels
- Labels:
-
smartstore
11-26-2020
12:16 PM
@roderick001 If you can paste the screenshot of what type of jobs you are running, that will be helpful. Hope the Splunk is running by you alone or your team? By the way, the logout option will be under your username(Admin).
... View more
11-26-2020
06:23 AM
Hi @roderick001 , You can see the job/search status under the Activity->Jobs tab and see what is running, then you can take necessary action whether to stop/pause. Which Splunk version are you using? If you are installed or updated recently to 8.0.x version and if you are not able to view the lookup page, then one of your dashboard is without a title. This is a known issue.
... View more
11-25-2020
01:22 PM
Hi @jason_hotchkiss , As you are populating the drop-down using dynamic values via query, you cannot set the default value for the dropdown. I tried to give the static value as Filter and set it as a default value in the dropdown. It works as you want but I am not sure how it reacts when it populates the value from the query and the token you use in the subsequent queries.
... View more
11-25-2020
12:50 PM
1 Karma
Hi @Depressedadmin , to make it looks like a line, please go to Format-> select the second one in the Null values. This will help to plot the line when it is null values.
... View more
11-25-2020
11:57 AM
1 Karma
Hi @Depressedadmin , For both of your questions, you can use the below answer. <your base query> |timechart span=1s count(Loss) as Loss by GATEWAY This will show all 5 gateway in different colors and it will show the count 0 if it is pocket loss. PS: Do not select All time until unless it is required and with timechart you can retrieve only 10000 rows at a time, so choose the time wisely else increase the span to 1m or 1h or 1d.
... View more
11-24-2020
04:10 PM
Thank you @isoutamo . I am working on that and will accept the answer as soon as I get where I want. Thanks once again for really valuable points which I did not realize to be noted when we are sharing the cluster with different teams.
... View more
11-24-2020
12:15 PM
Hi @user2020dy , You need to use two different tokens and two different panels to be successful in your requirement. I have faced the same problem and implemented the below code to reach the expected output. <row>
<panel depends="$value$">
<title>DNS</title>
<single>
<search>
<progress>
<condition match="$job.resultCount$>1">
<set token="novalue">true</set>
<unset token="value"></unset>
</condition>
<condition>
<set token="value">true</set>
<unset token="novalue"></unset>
</condition>
</progress>
<query>Your query</query>
<earliest>-5m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
</single>
</panel>
<panel depends="$novalue$">
<title>DNS</title>
<html>
<br/>
<br/>
<h1 align="center">No Value</h1>
</html>
</panel>
</row>
... View more
11-21-2020
01:57 PM
Thanks for the great point you have given about the access. I did not understand your answer to my question. How can I see what other search head clusters are doing with my indexer cluster and is there any way to control the search head cluster using Cluster master because I have access to Indexer cluster, my search head cluster, and the cluster master whereas I don't have visibility to other search head cluster.
... View more
11-20-2020
02:52 PM
Let me explain in detail. I am the owner of an indexer cluster and search head cluster for my environment. From other teams, they want to connect and see our data, hence I gave my cluster master details to them. The other teams connected their search head using my cluster master details. If my understanding is correct, the searches happen in the Indexer and return the results to the Search head. With DMC, I am able to see my Indexer performance and searches usage but I want to know whether/what is the impact or usage of other search head cluster to my indexer.
... View more
11-20-2020
01:24 PM
Hi Everyone,
Basically, we have an indexer cluster where multiple search head clusters are connected. I do not know the exact term but I would like to see the performance/usage of each shcluster. The only place I am able to see all the search head is connected to the cluster master where I have access to see the details. I do not have any other details in my DMC which related to other shclusters.
Thanks, Purush
... View more
Labels
- Labels:
-
using Splunk Enterprise
11-04-2020
05:25 AM
Hi @uagraw01 You need to use the token to set and unset in the drop-down menu and connect to all the panels. Please find the below answer to help you to get familiar with the tokens. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-hide-panels-with-no-results-from-a-dashboard/td-p/162367 https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-dashboard-panels-dynamically/m-p/122670/highlight/true#M7191
... View more
11-03-2020
05:51 AM
I have found the workaround solution and thanks to @ayush1906 for pointing out the right one. Attaching the link below for the solution and marking as the right solution to close this thread. https://community.splunk.com/t5/Alerting/Send-same-email-alert-to-different-email-ids-based-on-a/m-p/527628/highlight/true#M9934
... View more
11-02-2020
08:39 PM
@ayush1906 Awesome, thank you so much. I have been trying to overcome this scenario for the last three days. It is working perfectly and as expected.
... View more
11-02-2020
11:45 AM
@ayush1906 In this case, the email id values also will be present in the result email. But is there any way to send an email without a present in the result email? The resulting email contains the below columns based on your suggestions. Col A Col B email But, I am trying to get the result email like below Col A Col B Thanks in advance.
... View more
11-02-2020
11:34 AM
Looks like this is a known issue SPL-169625 which will be fixed in a later version. I will close this thread if I get any workaround solution. Please let me know if you have come across this issue and a workaround.
... View more
11-02-2020
07:16 AM
Hi @aallred, Did you got a chance to solve the problem, or do you have any workaround for your scenarios. I am also facing the same problem right now. The same alert use to work in the 7.2.1 version and it is not working after I upgrade to 8.0.1.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-18-2023
04:20 PM
|
