Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About impurush
impurush
Contributor
Member since:
05-29-2017
07-18-2023
Community Statistics
| Posts | 105 |
| Solutions | 14 |
| Karma Given | 44 |
| Karma Received | 19 |
| Member Since | 05-29-2017 |
Activity Feed
- Got Karma for Re: multiple host input listing in splunk query (search & Reporting). 01-06-2023 12:27 AM
- Karma Re: How do you disable/enable alerts via the REST API? for tmontney. 05-31-2022 02:25 PM
- Karma Re: reducing splunk fishbucket size for gjanders. 05-12-2022 12:50 PM
- Posted Re: Is there a way in Splunk to get the information of dashboard visits, hits, or unique users visitor? on Splunk Enterprise. 05-12-2022 12:48 PM
- Posted Re: Clearing fishbucket in UF on Getting Data In. 05-02-2022 02:20 PM
- Karma Re: Clearing fishbucket in UF for gcusello. 05-02-2022 02:16 PM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 05-02-2022 06:44 AM
- Posted Re: reducing splunk fishbucket size on Getting Data In. 04-13-2022 11:59 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-07-2022 09:37 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 06:45 PM
- Got Karma for Re: Trigger Alert and avoid false p[positives. 02-04-2022 04:16 PM
- Karma Re: Trying to find host that send logs over the last 7 days for PickleRick. 02-04-2022 05:56 AM
- Posted Re: Add export button on top of a dashboard on Splunk Dev. 02-04-2022 05:53 AM
- Posted Re: Trigger Alert and avoid false p[positives on Splunk Enterprise. 02-04-2022 05:50 AM
- Karma Re: why user with same role not able to see data for isoutamo. 08-10-2021 07:05 AM
- Karma Re: Need help: Stack 2 panels left, and have 1 panel on the right. for richgalloway. 08-10-2021 06:27 AM
- Posted Re: splunk add on for salesforce on Splunk Cloud Platform. 08-10-2021 06:26 AM
- Posted Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
- Tagged Splunk Covid Dashboard on Splunk Dev. 07-22-2021 01:12 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
08-10-2020
07:59 PM
@rkris , you can try this source="General-linux-sql.log" sourcetype="Linux" ("Possible NewApt.Worm - gadget.exe" OR "Possible Y2K Zelu Trojan" OR "Possible NewApt.Worm - baby.exe")
|rex field=_raw "Virus\s-\s(?<virus_name>.*)"
| table _time,virus_name
... View more
08-10-2020
05:10 PM
Hi @rkris , use the below query to get all three "Possible NewApt.Worm - gadget.exe", "Possible Y2K Zelu Trojan", and "Possible NewApt.Worm - baby.exe" from the logs. source="General-linux-sql.log" sourcetype="Linux" ("Possible NewApt.Worm - gadget.exe" OR "Possible Y2K Zelu Trojan" OR "Possible NewApt.Worm - baby.exe")
... View more
- Tags:
- Hi @e
08-10-2020
01:44 PM
Hi, Do you want to get that "Virus" word in a separate field using rex command or do you want to show the log details in the dashboard which has a virus word?
... View more
08-10-2020
01:39 PM
Hi, Need some more information to understand the question exactly. 1. In the component drop-down, the data is hard-coded or generated dynamically? 2. If you can paste the drop-down XML, it would be easy to answer.
... View more
08-10-2020
01:29 PM
Hi, So you need to go to settings->User Interface->Navigation Menus-> Edit the "default" file for the respective app. If you don't have access, then you might need to ask your admin for access or edit the file on behalf of you.
... View more
08-09-2020
03:43 PM
1 Karma
You can add the below line by replacing your comment(//Add something here) |stats max(PercentagesPerVersion) by generation,version this will give the results like. generation version max(PercentagesPerVersion)
... View more
08-06-2020
10:36 AM
1 Karma
Hi, If you upgraded the splunk enterprise recently to 8.x version, then this is happening due to one of your dashboards in your app has an empty title. I faced the same situation and troubleshoot a lot to find the root cause and I found the answer from Splunk Community. Thanks, Purush
... View more
06-29-2020
06:15 PM
Hi, I installed the "smart Exporter" app from Splunkbase and exporting PDF is working properly. When I try to schedule, the below error message keeps coming even though I set up the mail host. "Please finish setting up the smart export application (restart may be required)" The host is an application mail relay, hence the id and password is not required to send the emails but this app keep asking the id and password. Based on the below post, I commented out the id, port, password in the service.py, however, still the same error message is coming. Could someone help to fix the issue, thanks in advance! Regards, Purush
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
troubleshooting
06-24-2020
02:48 PM
Hi, I tried this code on my dashboard. When I put the token in my SPL query, the toke is working fine but when I use the same token in the units, it doesn't display the value, instead, it is displaying the token itself. Could you please help with this.
... View more
08-21-2019
07:37 AM
I have posted the reply below, any leads are appreciated.
... View more
08-21-2019
07:37 AM
I have posted the reply below, any leads are appreciated.
... View more
08-15-2019
12:57 PM
I have two requirements, if either one works, that is fine for me.
1. I want to change the red color to a different color when it is negative.
2. I want to set the range of colors to a Trend based on the values.
... View more
08-15-2019
08:30 AM
Hello Splunkers,
I am trying to change the color of the Trend symbol in the single value dashboard.
As per Splunk docs, if it is positive then green else red. So, I need to change the color instead of red.
I have read the answer which the color of the single value can be changed based on the trend percentage, but it does not change the color of the trend.
https://answers.splunk.com/answers/659702/how-to-configure-single-value-dashboard-color-base.html
Any help here much appreciated, thank you and happy splunking.
Regards,
Purush
... View more
03-29-2019
02:00 PM
Thank you for your answer!
I don't want to re-index because of large volume. For Summary Indexing, no need to re-index, just run the job and save the metrics to the summary index and do not give the access to the original index., that way we restricted the user to see the original data. Due to too many types of data and jobs, we are not moving towards it.
I agreed that if we save as a macro and if the user knows the base query, still he/she can see the data.
For this option, I tried to restrict the access to the only Macro but it didn't work.
... View more
03-29-2019
01:26 PM
Yes, Summary indexing is the best solution which we have already implemented for one part of data but the problem with summary indexing is that you need to run a job for every 5 mins to make it lively and I have different types of data and our alerts are running extensively, so if we run the summary indexing job every 5 mins which may not be effective for our environment.
PS: I am going to think in this direction of how much efficiently I can use SI in our environment.
... View more
03-29-2019
11:52 AM
yes, perfectly working in all the options. I verified with regex online editor also. The problem with the first option is that I am able to give macro in the restrict search terms for a role but when I search as a user belongs to that role, no data is populating.
... View more
03-29-2019
11:44 AM
Hi Splunkers,
I want to mask the PII data during the search time for specific users.
I checked all the existing questions and answers, but was not able to achieve it. I tried the below option,
I masked the data using the below search, and I saved as a macro, and then, I tried to give access to the user for only this macro, but the macro did not run.
my search|rex field=_raw "(?.*)TYPE\s\[PHONE\]\s*\[\+\w{12}\](?.*)"
| eval _raw=head."TYPE [PHONE] [############] ".tail
I tried to use regex in props/transforms in the search head, but it did not help.
I don't want re-index the data because the volume is large.
I tried to do event type, but the query cannot have the pipe symbol.
Any help is appreciated.
Thanks,
Purush
... View more
12-06-2018
06:48 AM
Hi, I tried the same app and just sending the test message itself not working. Please see the attached screenshot in one my answer below.
... View more
12-06-2018
06:46 AM
Hi,
below is my alert set up. I added to trigger mail also to verify the search is working perfectly or not, I am getting the alert mail. And I added incoming webhook configuration to my channel in the slack app. Also, I tried this webhook from my personal Splunk instance and it is working perfectly.
... View more
12-05-2018
07:34 PM
Hello all,
I am getting the below error when I trigger alert from Slack alert app. I tried from Splunk 6.4 and 6.5.5 version also.
FATAL sendmodalert - action=slack STDERR - Unexpected error:
FATAL sendmodalert - action=slack STDERR - Alert action failed
INFO sendmodalert - action=slack - Alert action script completed in duration=127380 ms with exit code=6
WARN sendmodalert - action=slack - Alert action script returned error code=6
... View more
- Tags:
- splunk-enterprise
11-28-2018
08:22 PM
1 Karma
FYI, I understand from his question is that he wants to set the table/panel height when it is a statistics table but not for the chart.
... View more
11-28-2018
12:35 PM
Hi @Kendo213
You can use html label to scroll over on top of the dashboard saying the information.
<row>
<html>
<marquee behavior="scroll" direction="left"><h2 align="right">Server is down</h2></marquee>
</html>
</row>
So that when they open the dashboard, they will come to know this is the known issue.
... View more
11-28-2018
12:02 PM
Hi @bennybunny09 Please use the below cron expression to schedule your alert.
* 10 2-7 * 1-5
Every 2nd business day of the month @10 AM will run the alert/report.
... View more
09-27-2018
04:33 PM
Hi All,
I got the answer how to do and I wrote it in below link.
https://splunknotes.wordpress.com/2018/09/27/visibility-of-dashboards-based-on-role-in-splunk-navigation-bar/
... View more
09-25-2018
04:25 PM
yes, I tried all the options which is mentioned there... all are helping me to hide the data but not the dashboard...
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-18-2023
04:20 PM
|
