Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vikas_gopal
vikas_gopal
Builder
Member since:
12-03-2013
05-15-2025
Community Statistics
| Posts | 255 |
| Solutions | 20 |
| Karma Given | 58 |
| Karma Received | 36 |
| Member Since | 12-03-2013 |
Activity Feed
- Karma Re: Can I send windows security logs using UF over HTTP to Logstash ? for PickleRick. 05-15-2025 11:52 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:19 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:16 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:15 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 09:59 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-14-2025 03:44 PM
- Karma Re: Can I send windows security logs using UF over HTTP to Logstash ? for richgalloway. 05-14-2025 03:42 PM
- Posted Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-13-2025 04:24 PM
- Posted Re: How to calculate MTTD in ES on Splunk Enterprise Security. 09-09-2024 06:43 AM
- Posted How to calculate MTTD in ES on Splunk Enterprise Security. 09-04-2024 11:41 AM
- Posted Upgrade Splunk ESCU on Search head clsuter members on Installation. 05-21-2024 11:59 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-28-2023 07:41 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-27-2023 07:29 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-27-2023 06:40 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:50 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:24 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:22 AM
- Posted restore and search old data on a standalone Splunk instance? on Installation. 09-06-2023 07:56 AM
- Posted Re: Splunkd crashed with memory allocation error on Getting Data In. 09-14-2022 02:18 PM
- Posted How do I prevent Splunkd crashing with memory allocation error? on Getting Data In. 09-14-2022 01:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
01-03-2020
11:43 AM
I am still figuring out how I can join or map below query with rest query
| datamodel
| rex field=_raw "\"modelName\"\s*:\s*\"(? [^\"]+)\""
| fields modelName
| table modelName
| map maxsearches=40 search="tstats summariesonly count from datamodel=$modelName$ by sourcetype,index | eval modelName=\"$modelName$\""
Rest Query
| rest /services/admin/summarization by_tstats=t splunk_server=local count=0 | eval datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","") | table datamodel| map maxsearches=100 search="| tstats summariesonly count FROM datamodel=$datamodel$ WHERE sourcetype!=\"stash\" BY sourcetype
| eval datamodel=\"$datamodel$\"" | join type=outer datamodel [| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches
| rex field=search "datamodel\W{1,2}(?\w+)"
| rex field=search "tstats.*?from datamodel=(?\w+)"
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| where disabled=0
|rename action.correlationsearch.label as rule_name |fields rule_name,datamodel
... View more
01-03-2020
10:41 AM
agreed but I was checking below answer
https://answers.splunk.com/answers/597619/list-all-datamodels-with-the-feeds-index-sourcetyp.html
I used the same and able to get CR per sourcetype and data model . Now I am thinking if somehow i can map or join with notable index based on rule_name .
... View more
01-03-2020
09:20 AM
Hi Splunk Experts,
In Splunk ES I need to count of notable events per sourcetype . I tried different things like checked index=notable but it does not have sourcetype .I also checked API "rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches" as it has rule name which I joined with index=notable but it gives me count by rule_name not as per sourcetype .
Can someone please assist .
Regards
Vikas
... View more
11-08-2019
12:10 PM
Well for a given time range both your questions can be true , like if I search for last 24 hours in an index there might be servers from lookup that did not show up in index however they did in last 48 hours , so can we achieve something like query will ignore those machines whos IP is being updated ?
... View more
11-08-2019
08:13 AM
Thanks for the reply , but I am still not clear what is the role of |eval active="yes" in your query . Actually I already have this column in lookup table with values like yes or no . So I just t need to update IP against only those wrkstation_names where active =yes , query should ignore where active=no, when I ran above query I saw splunk convert active to yes for all .
... View more
11-07-2019
06:14 PM
I am sure someone must have achieved this
I have an existing lookup table .It has 4 columns and it has values like below for 20 servers , I want to update existing lookup table but only those workstation_name where active is yes . I want to achieve this via
workstation_name ip type active
abc x.x.x.x web1 yes
bcd y.y.y.y web2 no
bla web3 yes
ttd web4 yes
So far this is what I did
1) Get the ip address from index , map it with lookup table where active is yes
index=abc |search [|inputlookup 20_servers where active=yes|fields Workstation_Name |rename Workstation_Name as dest_nt_host] |fields dest_nt_host,dest_ip|rename dest_nt_host as "Workstation_Name", dest_ip as ip |table Workstation_Name ,ip |dedup Workstation_Name
This gives me results as expected like below
workstation_name ip
abc x.x.x.x
bla z.z.z.z
ttd t.t.t.t
From here onward how I can append/attach lookup remaining two fields/columns that is type and active and update the existing lookup with |outputlookup
I hope I was clear with my requirement if not please let me know I can explain further .
Regards
VG
... View more
10-03-2019
05:30 AM
Thank you woodcock, first of all my apology on the inconsistent data .Because I need only from_date,to_date,name duration status in my table so just added below to end of the query .
|table from_date,to_date,name duration status |dedup from_date,to_date,name duration status
but with this approach if new name comes in with same status then it is showing wrong duration. I have just added new line at the bottom so now I have 2 names erp and trp but for trp duration is 300
trp,200,2019-10-01 08:37:33
... View more
10-02-2019
01:34 PM
Hi Experts ,
I know this can be achieved in splunk , I have data like below
name,status,date
erp,200,2019-10-01 08:28:33
erp,200,2019-10-01 08:29:33
erp,503,2019-10-01 08:30:33
erp,,2019-10-01 08:31:33
erp,,2019-10-01 08:32:33
erp,503,2019-10-01 08:33:33
erp,200,2019-10-01 08:34:33
erp,200,2019-10-01 08:35:33
erp,200,2019-10-01 08:36:33
I want to show something like below in a table
name from_date to_date status duration
erp 2019-10-01 08:28:33 2019-10-01 08:29:33 200 1 min
erp 2019-10-01 08:30:33 2019-10-01 08:31:33 503 1 min
erp 2019-10-01 08:31:33 2019-10-01 08:32:33 "" 1 min
erp 2019-10-01 08:33:33 2019-10-01 08:36:33 200 4 min
So the idea is to get the duration as per status , if my service has like 503 status for how long that status was .
Any help will be highly appreciated
Regards
VG
... View more
- Tags:
- splunk-enterprise
09-17-2019
07:41 AM
Totally agreed , I have observed the same with the data. Well thanks for all the efforts , I will keep this question as unanswered . Let's see what others think about this .
... View more
09-16-2019
11:53 AM
Thank you Adonio for your quick response and you are absolutely correct from single index it is not possible so i have checked both _internal and _audit and I have prepared below query . Somehow this is not working any help here please
index=_audit sourcetype=audittrail user=admin action=log* |dedup action, user|append [|search index=_internal sourcetype=splunk_web_service user=admin action=log* | stats count by user action status] |transaction user startswith=eval(action="login attempt") endswith=eval(action="logout") | table user action status info duration
... View more
09-16-2019
11:15 AM
Hi Experts,
I want to create a report for last 24 hours which provides the information like how many hours users was on splunk in past 24 hours , or in other words how many hours user spent on Splunk .
Output will be like
User Number of hours
Admin 10
test 5
abc 6
Regards
VG
... View more
- Tags:
- splunk-enterprise
08-09-2019
08:04 PM
1 Karma
Well this is really strange I waited like 40 min and suddenly I started seeing data on the dashboard. This is weird because my interval was 10s . Anyways things are working .
... View more
08-09-2019
07:24 PM
Well yes on SHC I have this app and on HF I configure the input which points to my Indexer . On Both indexer and Searchhead I can see the data in sourcetype="web_ping" . However I am still wondering why SH is not displaying data on the dashboard .
Here is my Default props.conf on both HF and on SH
props.conf
[source::...web_availability_modular_input.log]
sourcetype=web_availability_modular_input
[source::...website_monitoring_rest_handler.log]
sourcetype=website_monitoring_rest_handler
... View more
08-09-2019
03:52 PM
Hi Gtazi ,
Did you solve this issue ? I am facing same issue app is on HF and no data in the dashboard?
regards
VG
... View more
03-07-2019
01:27 AM
Hi Experts ,
I have Splunk Add-on for Amazon Kinesis and I have setup Initial Stream Position to Latest .
Now when I disable the stream let's say for 2 days and I switch it on today, it is taking ages to show me the latest logs(stream) as Splunk is busy to collect older date logs first (last 2 days)which I have cross checked with the query .
What I am missing here I have no Idea , can someone please help me here ?
Regards
VG
... View more
12-18-2018
04:47 AM
No Specific Reason I am just doing testing and playing with the data was not aware of MAX_DAYS_AGo Setting
... View more
12-18-2018
04:45 AM
Ahaaa!!! worked like a charm Thank you so much
... View more
12-18-2018
01:20 AM
![alt text][1]HI Experts,
I have the following 2 logs. Why 2? Because I know BREAK_ONLY_BEFORE = Path=
I want the timestamp: "2006-09-21, 02:57:11.58"
{{"2006-09-21, 02:57:11.58", 122, 11, "Path=/LoginUser Query=CrmId=ClientABC&ContentItemId=TotalAccess&SessionId=3A1785URH117BEA&Ticket=646A1DA4STF896EE&SessionTime=25368&ReturnUrl=http://www.clientabc.com, Method=GET, IP=209.51.249.195, Content=", ""}}
{{"2006-09-21, 02:57:11.60", 122, 15, "UserData:<User CrmId="clientabc" UserId="p12345678"><EntitlementList></EntitlementList></User>", ""}}
{{"2006-09-21, 02:57:11.60", 122, 15, "New Cookie: SessionId=3A1785URH117BEA&Ticket=646A1DA4STF896EE&CrmId=clientabc&UserId=p12345678&AccountId=&AgentHost=man&AgentId=man, MANUser: Version=1&Name=&Debit=&Credit=&AccessTime=&BillDay=&Status=&Language=&Country=&Email=&EmailNotify=&Pin=&PinPayment=&PinAmount=&PinPG=&PinPGRate=&PinMenu=&", ""}}
{{"2006-09-21, 02:57:11.58", 122, 11, "Path=/LoginUser Query=CrmId=ClientABC&ContentItemId=TotalAccess&SessionId=3A1785URH117BEA&Ticket=646A1DA4STF896EE&SessionTime=25368&ReturnUrl=http://www.clientabc.com, Method=GET, IP=209.51.249.195, Content=", ""}}
{{"2006-09-21, 02:57:11.60", 122, 15, "UserData:<User CrmId="clientabc" UserId="p12345678"><EntitlementList></EntitlementList></User>", ""}}
{{"2006-09-21, 02:57:11.60", 122, 15, "New Cookie: SessionId=3A1785URH117BEA&Ticket=646A1DA4STF896EE&CrmId=clientabc&UserId=p12345678&AccountId=&AgentHost=man&AgentId=man, MANUser: Version=1&Name=&Debit=&Credit=&AccessTime=&BillDay=&Status=&Language=&Country=&Email=&EmailNotify=&Pin=&PinPayment=&PinAmount=&PinPG=&PinPGRate=&PinMenu=&", ""}}
I have the below settings at source type selection in preview mode
[ test123 ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=Path=
CHARSET=AUTO
MAX_TIMESTAMP_LOOKAHEAD=30][1]
TIME_FORMAT= %Y-%m-%d, %H:%M:%S
TIME_PREFIX={{"
category=Custom
disabled=false
pulldown_type=true
With the above settings, I am getting the below error as shown in the snippet.
... View more
11-28-2018
05:40 AM
Wow Line Break logic works like a charm but Can you help me to understand why was that , why we need line break here ?
... View more
11-28-2018
05:31 AM
Well I tried with only %Z ,with this I can see 2 lines as Splunk split the record in 2 one with the first time and second with the mentioned format date basis which is wrong (11/13/18 11:02:23.000 PM and 8/24/13 6:37:11.000 AM). It should be one line only
... View more
11-28-2018
05:20 AM
Hi Expert,
I have the below log. In this, I have 2 different time with different formats. I need to set a second date and time at the time of source type selection. I used the below settings, but I am getting the below warning.
Can anyone tell me what is missing here?
Log Sample
[167154] 2018-11-13 00:43:26 Received fatal signal 6 (Aborted). Cause: Signal sent by PID 4679 running under UID 1687. Crashing thread: Main Thread OS: Linux Arch: x86-64
Backtrace:
Linux / usr13.eng.buttercupgames.com / 2.6.32-279.5.2.el6.x86_64 / #1 SMP Fri Aug 24 01:07:11 UTC 2013 / x86_64
I need to select Fri Aug 24 01:07:11 UTC 2013.
Sourcetype Settings
[ abc ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%a %b %d %H:%M:%S %Z%z %Y
TIME_PREFIX=SMP\s
With the above settings, things looks good, but I can see one warning in the data preview screen. It says:
Could not use stptime to parse timestamp from "Fri Aug 24 01:07:11 UTC 2013 / x86_64"
... View more
- Tags:
- splunk-enterprise
10-27-2018
04:27 AM
Hi Experts,
I tried hard to get this worked saw many posts and questions asked by many people . It seems I am doing something wrong . Here is what I am doing
1) Splunk version 7.2.0, Eventgen Version 6.3.0 latest
2) Download and installed Eventgen app
3) Create new app called test_app and create 3 folders in it
default
samples
metadata
4) Under Default folder I have created eventgen.conf file
[test_data\.txt]
mode = replay
timeMultiple = 2
backfill = -60m
backfillSearch = index=main source=eventgen
outputMode = splunkstream
splunkHost = localhost
splunkUser = admin
splunkPass = changeme
token.0.token = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3,6}
token.0.replacementType = timestamp
token.0.replacement = %Y-%m-%d %H:%M:%S,%f
5) under samples folder I have created my sample text file
test_data.txt
2018-10-25 11:12:13,567 transType=ReplaceMe transID=000000 transGUID=0A0B0C userName=bob city="City" state=State zip=00000 value=0
6) My metadata folder hold a file called default.meta
[eventgen]
access = read : [ * ], write : [ admin ]
export = system
Now after above all steps I checked in search/eventgen app their is not data even I checked it from past 7 days . I am using below simple query
index=main source=eventgen
Please help me to understand what I am missing here , is their any settings that needs to enable here .
Regards
VG
... View more
- Tags:
- eventgen
03-01-2018
07:26 AM
Hi Splunk Experts,
I am preparing one POC , here what I want .
I have data in splunk like (empId,name,deparment) . I have prepared csv lookup and csv has (empid , salary) columns . What I want is to write back the csv file and add only those employees which does not exist and ignore if empid exists. For example
Splunk Data is
empId,name,deparment,salary
1,vg,finance,10$
2,gv,it,20$
3,abc,IT,30$
lookup file
empId,Salary
1,10$
2,20$
Now I want to update csv using outputlookup command , but only for empid 3 . Please suggest how I can achieve this .
So my outputlookup csv should look like
empId,Salary
1,10$
2,20$
3,30$
Reagrds
VG
... View more
11-05-2017
07:20 AM
for alternate i can create new app then create new index within this app. But I want to test if i already have index in search app and later I want to move it to my newly created app then I am facing an issue . Saw many answers on the same topic and I followed the instructions but no success .
Something like this
https://answers.splunk.com/answers/174843/how-to-move-an-index-to-another-app.html
... View more
11-05-2017
07:13 AM
Neither it is a cluster environment nor my indexer and search head are on different machine .It is a dev machine so all the components are on same machine that is search head and indexer.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-15-2025
09:58 AM
|
Karma given to
