Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About anandhalagarasa
anandhalagarasa
Path Finder
Member since:
06-05-2017
06-05-2020
Community Statistics
| Posts | 202 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 7 |
| Member Since | 06-05-2017 |
Activity Feed
- Got Karma for Is there any way to pull the report on license usage for the last one year irrespective of all indexes?. 04-16-2024 03:14 AM
- Karma Re: Qualys TA for harsmarvania57. 06-05-2020 12:50 AM
- Got Karma for Can you help me find where I can see the license usage per day in Enterprise Security?. 06-05-2020 12:50 AM
- Got Karma for Specific Wineventlog (Security) ingestion into Splunk. 06-05-2020 12:50 AM
- Karma Re: Field Extractions in Search Head GUI for micahkemp. 06-05-2020 12:49 AM
- Karma Re: Enterprise Trial license: does it include clustering? for inventsekar. 06-05-2020 12:49 AM
- Got Karma for How can we view the data retention policy we have set?. 06-05-2020 12:49 AM
- Got Karma for Interesting Fields Missing in Search & Reporting of two different Search Heads. 06-05-2020 12:49 AM
- Got Karma for Enterprise Trial license: does it include clustering?. 06-05-2020 12:49 AM
- Karma Re: Search Factory: Unknown search command 'vt'. for hardikJsheth. 06-05-2020 12:48 AM
- Got Karma for Search Factory: Unknown search command 'vt'.. 06-05-2020 12:48 AM
- Posted Re: Splunk Alert and Dashboard Creation Permissions on Security. 11-05-2019 04:32 AM
- Posted Splunk Alert and Dashboard Creation Permissions on Security. 11-05-2019 03:32 AM
- Posted Re: Splunk Cloud License Usage on Monitoring Splunk. 11-04-2019 11:36 PM
- Posted Splunk Cloud License Usage on Monitoring Splunk. 11-04-2019 11:24 PM
- Posted Re: Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-24-2019 01:06 AM
- Posted Re: Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-23-2019 07:40 AM
- Posted Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-23-2019 06:54 AM
- Posted Use cases in Enterprise Secuirty on Splunk Enterprise Security. 10-22-2019 11:11 PM
- Tagged Use cases in Enterprise Secuirty on Splunk Enterprise Security. 10-22-2019 11:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-08-2018
06:13 AM
Can anyone help on this request
... View more
02-07-2018
10:27 PM
Hi Team,
Is there any way to capture the Risky Sign-ins from Azure into Splunk so that will be helpful to implement the same in our environment.
Kindly note we have already installed Splunk Add-on For Microsoft services in our Search Head server. But not sure how to proceed further to capture the Risky Sign-ins from Azure environment.
... View more
- Tags:
- splunk-enterprise
01-21-2018
11:46 PM
Hi Team,
We have a request to index the O365 Message trace logs from Splunk .
So as recommended in Splunk blog we have followed the 1st step to retrieve the same.
https://www.splunk.com/blog/2017/10/05/splunking-microsoft-cloud-data-part-3.html
-->We have installed the Microsoft Office365 Reporting Add-on
-->As mentioned in the blog we have updated the configuration and their respective inputs.
Post which when we tried to fetch the logs with sourcetype as ms:o365:reporting:messagetrace we can able to see some events which got generated on Jan 12th 2018 and post which we couldn't able to see any new events for the same.
We are not sure about the exact issue in it.
We have provided the inputs and configurations as recommended. And I can able to see the logs for just one day and that means logs are getting ingested but dont know why it got indexed only for one day and post which there are no logs.
So kindly help on my query.
... View more
- Tags:
- splunk-enterprise
01-09-2018
12:13 AM
Thanks for your response.
I have applied the regex as provided but still the last field alone (FileId) is fetching the information along with the message that might be whatever even-though we have a pipe symbol in between..
Once the field is extracted and when i click the FileId it shows the result as below:
xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx
Can you kindly help on this.
... View more
01-08-2018
04:15 AM
Hi,
Consider this exact sample event and from here i want to extract those fields.
2018-01-07 01:50:39,296|INFO|ServiceName=xxxx|DropId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx|JobNumber=(xxx)|DropNumber=(xxx)|StampCycle=xxxx|TotalFiles=xx|FileId=xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx, GUID: xxxxxx-xxxx-xxxx-xxxx-xxxxxxx
I just want to extract the following fields without any issues.
ServiceName
DropId
JobNumber
DropNumber
StampCycle
TotalFiles
FileId
And as mentioned in your regex expression i can able to extract all fields perfectly except "FileId" alone.
When i extract FileId and when i click the FileId its getting extracted along with (|) pipe symbol and QueueName information.
xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx
But actually i need only the FileId value alone and it should not be extracting any messages post FileId Since I need to extract only till FileId.
Is there any way to get it achieved.
NOTE:
For few instances alone its getting extracted with | information followed by FileId and the remaining FileId values are getting extracted perfectly.
... View more
01-08-2018
01:53 AM
Hi Elsurion,
Thanks for your response. But still it didn't worked.
Let me show the actual raw event from this example can you help to retrieve those 8 fields.
2018-01-07 01:50:39,296|INFO|ServiceName=xxxx|DropId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx|JobNumber=(xxx)|DropNumber=(xxx)|StampCycle=xxxx|TotalFiles=xx|FileId=xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx, GUID: xxxxxx-xxxx-xxxx-xxxx-xxxxxxx
I just want to extract the following fields without any issues.
ServiceName
DropId
JobNumber
DropNumber
StampCycle
TotalFiles
FileId
And as mentioned in your regex expression i can able to extract all fields perfectly except "FileId" alone.
When i extract FileId and when i click the FileId its getting extracted along with (|) pipe symbol and QueueName information.
xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx
But actually i need only the FileId value alone and it should not be extracting any messages post FileId Since I need to extract only till FileId.
Is there any way to get it achieved.
NOTE:
For few instances alone its getting extracted with | information followed by FileId and the remaining FileId values are getting extracted perfectly.
... View more
01-08-2018
01:53 AM
Hi abhijeet01,
Thanks for your response. But still it didn't worked.
Let me show the actual raw event from this example can you help to retrieve those 8 fields.
2018-01-07 01:50:39,296|INFO|ServiceName=xxxx|DropId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx|JobNumber=(xxx)|DropNumber=(xxx)|StampCycle=xxxx|TotalFiles=xx|FileId=xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx, GUID: xxxxxx-xxxx-xxxx-xxxx-xxxxxxx
I just want to extract the following fields without any issues.
ServiceName
DropId
JobNumber
DropNumber
StampCycle
TotalFiles
FileId
And as mentioned in your regex expression i can able to extract all fields perfectly except "FileId" alone.
When i extract FileId and when i click the FileId its getting extracted along with (|) pipe symbol and QueueName information.
xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx
But actually i need only the FileId value alone and it should not be extracting any messages post FileId Since I need to extract only till FileId.
Is there any way to get it achieved.
NOTE:
For few instances alone its getting extracted with | information followed by FileId and the remaining FileId values are getting extracted perfectly.
... View more
01-08-2018
01:52 AM
Hi mayurr98,
Thanks for your response. But still it didn't worked.
Let me show the actual raw event from this example can you help to retrieve those 8 fields.
2018-01-07 01:50:39,296|INFO|ServiceName=xxxx|DropId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx|JobNumber=(xxx)|DropNumber=(xxx)|StampCycle=xxxx|TotalFiles=xx|FileId=xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx, GUID: xxxxxx-xxxx-xxxx-xxxx-xxxxxxx
I just want to extract the following fields without any issues.
ServiceName
DropId
JobNumber
DropNumber
StampCycle
TotalFiles
FileId
And as mentioned in your regex expression i can able to extract all fields perfectly except "FileId" alone.
When i extract FileId and when i click the FileId its getting extracted along with (|) pipe symbol and QueueName information.
xxxxxxx-xxx-xxxx-xxxx-xxxxxxxxxxxxxxx|QueueName: xxx_xxxxx_xxxxxx
But actually i need only the FileId value alone and it should not be extracting any messages post FileId Since I need to extract only till FileId.
Is there any way to get it achieved.
NOTE:
For few instances alone its getting extracted with | information followed by FileId and the remaining FileId values are getting extracted perfectly.
... View more
01-04-2018
10:56 PM
Thanks for your suggestion. All fields are working fine except the last one that is "Field".
Sample Event :
2017-06-04 03:51|Level=***|Name=Men|Id=(xxxxx)|Job=(xxxx)|DropNumber=(xxxx)|Cycle=(xxx)|Value=(xxx)|Field=(xxxx)|Process xxxxxxxx
Here in this case the "Field" is getting extracted along with Process information.
When I click "Field" in extracted fields the results are as below:
xxxxxxx
xxxxxxx|Processs xxxxxx
But i need to exclude the Process one and get only the key value xxxxxxx.
So kindly help to provide regex for the same.
... View more
01-04-2018
05:40 AM
Hi Team,
I have an event which is getting segregated with pipe (|) symbol and i want to separate those events with a regex expression how to proceed further.
Sample Event are below:
2017-06-04 03:51|Level=***|Name=Men|Id=(xxxxx)|Job=(xxxx)|DropNumber=(xxxx)|Cycle=(xxx)|Value=(xxx)|Field=(xxxx)|Process xxxxxxxx
So I have tried to segregate the same in search head GUI by clicking the Field extractions and by using delimit option i choose pipe (|) symbol to split it.
The fields are getting extracted and I have renamed the field names too. But once I saved it and clicked the extracted fields which is in left hand column its getting with the field name and with the key value. But actually i want the key value alone.
For Example:
If i have delimit the field using (|) symbol and rename the field to "Name" and saved it.
Post saving it when i click the "Name" in the extracted field it should show as "Men" as mentioned in sample event.
But instead when i click the "Name" field it shows as "Name=Men"
So kindly let me know the regex to extract only the key value alone since i need to create multiple field extractions for the same.
... View more
- Tags:
- splunk-enterprise
12-12-2017
04:56 AM
Also i have added the following stanza into it but still REST is not visible so kindly help on this.
edit_rest = enabled
... View more
12-11-2017
11:25 PM
Thanks for your response.
As mentioned I have added the below stanza for the user role.
edit_tcp = enabled
edit_monitor = enabled
indexes_edit = enabled
search = enabled
And now I can able to see the Data Inputs in the user role with Local inputs .
Under Local Inputs i can able to see a option as Type in that i can able to see "Files & Directories" & "TCP" but I couldn't able to find "REST" in the same.
So what needs to be done so that "REST" is also visible under Local Inputs for user role too.
... View more
12-08-2017
05:12 AM
Hi Team,
I have recently installed (https://splunkbase.splunk.com/app/1546/#/overview) this app in our search head. But as an admin I can able to navigate to Settings-->Data Inputs-->REST and I can able to provide the inputs.
But as a user role couldn't able to view the Data Inputs itself and he couldn't able to add the Data Inputs in REST API.
So for a user how come we need to provide access to add their Data Inputs in REST API.
Kindly help on this request.
... View more
- Tags:
- splunk-enterprise
11-21-2017
04:40 AM
Hi All,
Can you kindly clarify what is the exact difference between admin role , power role & user role.
Also what and all permissions that a admin , power & user has in Splunk Search Head.
Kindly provide detailed information regarding the same.
... View more
- Tags:
- splunk-enterprise
10-23-2017
07:17 AM
It has been already placed in indexers only. But still its not working as expected.
... View more
10-23-2017
06:29 AM
Hi Team,
Currently we have the logs getting indexed into Splunk in this format but we require that each line has to be indexed separately in Splunk.
But this didnt worked and hence once again we are getting all lines as a single event so kindly let me know the props.conf also how to monitor the same with the servername instead of sourcetype.
... View more
10-16-2017
05:02 AM
Thanks for your swift response.
As per both the links when i checked , the index value has been set for 1 year but when i tried to search the data for any of those index i can able to retrieve for more than a year too..
So kindly help on this.
... View more
10-16-2017
04:14 AM
1 Karma
Hi All,
We have set the data retention has 1 year (365 days) for in cluster master. But when we search the data in Search and Reporting app for an index then we can able to fetch data more than a year too. For audit purpose we need to track what would be the exact data retention and after that there should not be any logs for the same. But in our case we can able to fetch data more than a year too.
So is there any search query that can able to pull the exact data retention which has been set for all indexes and beyond that there should not be any data for that particular index.
These are the configurations which we have been set in cluster master server under the following folder:
... View more
10-11-2017
04:35 AM
Can anyone kindly help on this request.
... View more
10-11-2017
04:34 AM
Is there any search query to pull who and all logged in & logged out in Splunk for last 24 hours . Also logs being performed on Splunk tool.
This is just an example.
... View more
10-11-2017
04:23 AM
Exact Question is:
Need the list of users with access to the Splunk tool and then access logs related to who is coming in and out of the tool. Also, logs related to functions being performed on the Splunk tool.
Also, can you point the specific page number where you feel the policy and process requirements are covered for this control? It may be that policy needs to move to 75% if you don't specifically speak to protecting access to audit tools. The process can stay at 100% since it would likely just follow you audit and access control standards
... View more
10-11-2017
12:55 AM
How to retrieve list of users with access to the Splunk tool and then access logs related to who is logging in and out of the Splunk tool. Also, logs related to functions being performed on the Splunk tool.
Is there any search query to retrieve those details since its required by auditors for verification purpose.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
