Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About impurush
impurush
Contributor
Member since:
05-29-2017
07-18-2023
Community Statistics
| Posts | 105 |
| Solutions | 14 |
| Karma Given | 44 |
| Karma Received | 19 |
| Member Since | 05-29-2017 |
Activity Feed
- Got Karma for Re: multiple host input listing in splunk query (search & Reporting). 01-06-2023 12:27 AM
- Karma Re: How do you disable/enable alerts via the REST API? for tmontney. 05-31-2022 02:25 PM
- Karma Re: reducing splunk fishbucket size for gjanders. 05-12-2022 12:50 PM
- Posted Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor? on Splunk Enterprise. 05-12-2022 12:48 PM
- Posted Re: Clearing fishbucket in UF on Getting Data In. 05-02-2022 02:20 PM
- Karma Re: Clearing fishbucket in UF for gcusello. 05-02-2022 02:16 PM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 05-02-2022 06:44 AM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 04-13-2022 11:59 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-07-2022 09:37 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 06:45 PM
- Got Karma for Re: Trigger Alert and avoid false p[positives. 02-04-2022 04:16 PM
- Karma Re: Trying to find host that send logs over the last 7 days for PickleRick. 02-04-2022 05:56 AM
- Posted Re: Add export button on top of a dashboard on Splunk Dev. 02-04-2022 05:53 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 05:50 AM
- Karma Re: why user with same role not able to see data for isoutamo. 08-10-2021 07:05 AM
- Karma Re: Need help: Stack 2 panels left, and have 1 panel on the right. for richgalloway. 08-10-2021 06:27 AM
- Posted Re: splunk add on for salesforce on Splunk Cloud Platform. 08-10-2021 06:26 AM
- Posted Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-02-2020
06:23 AM
Additionally, I tried to create a new user and assigned all the capabilities. Then I tried to run the query or search from the user, but still, I got the same issue.
... View more
10-30-2020
11:09 AM
Hi @richgalloway I am currently using Splunk Enterprise 8.0.1 and I login as an admin user. I have verified that the capability is assigned to this role but still it does not working. However, the sendemail command is working when I used straight forward which means as below: <my query> | sendemail <details> But I am getting the error in the python log when I use it in makeresults command as I mentioned in the initial question.
... View more
10-30-2020
10:02 AM
I am trying to send an email with the help of the make results command in the splunk search but I am not receiving the email and getting the below error. Error: 2020-10-30 12:45:21,129 -0400 ERROR sendemail:1428 - [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8289/servicesNS/admin/cams/search/jobs/subsearch_asfd29470124adsfa319841023e?output_mode=json Traceback (most recent call last): File "/app/splunk/etc/apps/search/bin/sendemail.py", line 1421, in <module> results = sendEmail(results, settings, keywords, argvals) File "/app/splunk/etc/apps/search/bin/sendemail.py", line 400, in sendEmail jobResponseHeaders, jobResponseBody = simpleRequest(uriToJob, method='GET', getargs={'output_mode':'json'}, sessionKey=sessionKey) File "/app/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 559, in simpleRequest raise splunk.AuthorizationFailed(extendedMessages=uri) AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8289/servicesNS/admin/cams/search/jobs/subsearch_asdfasljfd9147192034ejdlajff?output_mode=json Query <My query> | map search="| makeresults | eval attribute=\"$value$\" | table attribute | sendemail to=\"myemail@id.com\" content_type=\"html\" message=\"Test message\"" Any help would be appreciated and Thanks in advance.
... View more
Labels
- Labels:
-
subsearch
09-23-2020
05:56 AM
Thank you everyone for the replies and I got the reply from Developer Support from the App. "MS Teams Connector are send the message for each results. please consider convene multiple results put together one result in Splunk."
... View more
09-21-2020
06:43 AM
Hi @inventsekar , I totally agree with you but the throttle setting is default.
... View more
- Tags:
- hi
09-21-2020
06:21 AM
1 Karma
Hi @inventsekar, I have included the MS teams add-on in the respective alert. I have changed the alert to trigger only once if the alert triggers but still I am getting a lot of alerts when a single alert triggers.
... View more
09-20-2020
04:11 PM
1 Karma
Hi @niketn Thanks for reaching out to this post. I have tried to reach them via email, unfortunately, I did not get any response and hence I reached here in the community. I will try one mor time to reach them with my questions.
... View more
09-17-2020
10:52 AM
Hi @jiaqya , As of I know, there is no functionality to export the pdf with charts on forms or multiple panels in a single row till the 8.x versions. I saw in the splunk ideas page that this functionality may get introduced in the future.
... View more
09-17-2020
08:47 AM
1 Karma
Hello Everyone, I have integrated the "MS Teams alert for Splunk" add-on in my splunk cluster. I have added it in to alert action and triggering alerts n number of times. Example: The alert has 5 result rows and I am getting 5 messages in MS teams however I need only one alert per trigger. I checked the alert configuration and the trigger action is set to as Once. In the same alert I have configured to send to my email and I am getting only once but in MS team I am getting 5 times. Thanks in advance!
... View more
Labels
- Labels:
-
configuration
09-17-2020
08:42 AM
2 Karma
You can create an eventtype with all the hosts you want in the queries and use the eventtype in your query. Example: Create a eventtype=host_list host=hosta OR host=hostb OR host=hostc Then use in your query index=os eventtype=host_list
... View more
- Tags:
- with
08-20-2020
10:05 AM
Hi @tkerr1357 Use the append command to do that. index=myindex Eventcode=4624(successful) host=myhost1 user=user* | stats count
|append [search index=myindex EventCode=4625(failed) host=myhost1 user=user* | stats count]
... View more
08-19-2020
06:45 AM
Hi @Allampally , As mentioned in the post, there is no way to track the changes in the Splunk and you need to use git or bitbucket to track the changes, however, you can try this below query. index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search This query will show the searches ran by the user previously, you can tune the query and see your search based on your last successful ran and compare the current query. I got the answer from below post https://community.splunk.com/t5/Splunk-Search/Why-history-command-only-shows-my-searches-not-searches-run-by/td-p/185318
... View more
08-18-2020
11:29 AM
Hi @vinod0313 You can use |transpose function at the end of your query and it will transpose all the x-axis into the y-axis.
... View more
08-17-2020
02:27 PM
Hi @sphiwee Use the below one <your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)\-"
... View more
08-17-2020
12:31 PM
HI @driva If it is in a clustered environment, probably the artifacts are replicating when you restart the server and it replicated with the other servers. You can try creating a web.con under /etc/system/local and add the insecure web login option and restart the server.
... View more
- Tags:
- @@
@clwboscovs Could you please tell me what is the user name in your log? And is it already the user name is extracted into any field? index=<your index> sourcetype=<your sourcetype> "The Radius server ise_servers rejected authentication"
| stats count by user
| where count > 5
... View more
08-17-2020
12:12 PM
2 Karma
@sphiwee If I understand correctly, you need the error details in a keyword after the ERROR message. 2020-08-17 16:34:02,141 [68618-1397] ERROR NodePoolServlet - [urn:uuid:6144BCB27826B3BECC1597674752077153] Bot Manager can't find a free Bot to execute a robotic task. Please check that Bots with requested capabilties are alive using the Healtcheck API and the Bot Source size in Control Tower is equal to the number of available Bots. You can use the below regex format to achieve that. <your query>|rex field=_raw "ERROR\s(?<Error_Message>.+)"
... View more
08-17-2020
07:30 AM
@CarolinaHB Did you try stopping and starting the server again? I faced sometimes same thing, just try to stop and start again, generally the web interface likely to be available. If that did not help, you can try looking into different solutions.
... View more
08-13-2020
05:43 PM
We thought to use bitbuckets to store the configurations and track the changes. But we are yet to implement. I am not sure about the other solutions.
... View more
08-13-2020
07:47 AM
@dpdwibedy This will not solve the exact solution which you are looking but we are handling the same kind of situation in our environment as below index=apache_core userAgent!="nginx/*" source="*access.log*" requestURI!="/web/app*" NOT (requestURI="/api/xyz/*" OR requestURI="/api/yyy/*" AND statusCode=404) earliest=-30m latest=now
| timechart span=5m count(eval(statusCode>=400)) as errors, count as total
| eval ErrorRate = errors * 100 / total | fields _time,ErrorRate
| where ErrorRate > Threshold And if you want to send an alert if it is greater than 15 mins, then you need to configure the alert as trigger the alert if the result has more than 2 rows. Then the alert will trigger if it 3 times crosses the threshold in the 30 mins window. Explanation: The above query split the 30 minutes window into 5 mins window and we are checking if 3 (5 mins) window is greater than the threshold, the alert will trigger. So it solves our problem.
... View more
08-12-2020
12:06 PM
@Ashwini008 1. Create a new app like a search app and remove the dashboard, alerts in default.xml. 2. Create a new role and assign the the capabilities of "User" role. Do not inherit 3. Create a user and assign a new role. 4. Give access to your new app to the new role.
... View more
08-12-2020
08:35 AM
@Ashwini008 1. You can create a different app same like search and reporting, then give them access to those users which has the default.xml only search option. 2. You can remove the dashboards, alerts from the default so that it won't visible, and admins can access directly by accessing the URL. (Example : https://<your_url>/app/search/dashboards) 3. Create one dashboard which has the links for dashboard, alerts and give the access to only admins, then remove the dashboard and alert from default.xml, then add the newly created dashboard, so that only admins can see the dashboard and access those links.
... View more
08-12-2020
07:59 AM
@here2infinity You can use like this directly <your query> "non contacts" to show the logs only it has the term <your query> NOT "non contacts" to show the logs only the contacts term has. I have tested in my splunk and it is working.
... View more
08-10-2020
09:56 PM
@BRG By seeing ur question,It looks like the splunk is already stopped. So when you are starting you are getting this error right. Also, removing this file will not affect your cluster. To be safer side, check the Child process id in the file is already running or not. If not, u can kill the process id and remove the file, then start the splunk.
... View more
08-10-2020
08:53 PM
@BRG Looks like the splunk process is not able to read the file /opt/splunk/var/run/splunk/splunkd.pid. Remove the splunkd.pid file under the location /opt/splunk/var/run/splunk and start again.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-18-2023
04:20 PM
|
