Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About vikas_gopal
vikas_gopal
Builder
Member since:
12-03-2013
05-15-2025
Community Statistics
| Posts | 255 |
| Solutions | 20 |
| Karma Given | 58 |
| Karma Received | 36 |
| Member Since | 12-03-2013 |
Activity Feed
- Karma Re: Can I send windows security logs using UF over HTTP to Logstash ? for PickleRick. 05-15-2025 11:52 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:19 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:16 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 11:15 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-15-2025 09:59 AM
- Posted Re: Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-14-2025 03:44 PM
- Karma Re: Can I send windows security logs using UF over HTTP to Logstash ? for richgalloway. 05-14-2025 03:42 PM
- Posted Can I send windows security logs using UF over HTTP to Logstash ? on Getting Data In. 05-13-2025 04:24 PM
- Posted Re: How to calculate MTTD in ES on Splunk Enterprise Security. 09-09-2024 06:43 AM
- Posted How to calculate MTTD in ES on Splunk Enterprise Security. 09-04-2024 11:41 AM
- Posted Upgrade Splunk ESCU on Search head clsuter members on Installation. 05-21-2024 11:59 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-28-2023 07:41 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-27-2023 07:29 AM
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-27-2023 06:40 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:50 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:24 AM
- Posted Re: restore and search old data on a standalone Splunk instance? on Installation. 09-07-2023 07:22 AM
- Posted restore and search old data on a standalone Splunk instance? on Installation. 09-06-2023 07:56 AM
- Posted Re: Splunkd crashed with memory allocation error on Getting Data In. 09-14-2022 02:18 PM
- Posted How do I prevent Splunkd crashing with memory allocation error? on Getting Data In. 09-14-2022 01:39 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
02-04-2015
10:42 AM
thanks for quick response , let me check this app
... View more
02-04-2015
10:28 AM
Hi Experts,
Need your expert advice. I am planning to show locations of source and destination devices on a world map and along with that, I want to show a color link/line between source and destination based on their data flow e.g source A sending data to B and the count is 10, but another source C sending data to D and the count is 20. Now the line color in the second scenario should be brighter as compared to the first one .
Any idea on this must be appreciated.
Thanks
VG
... View more
02-03-2015
06:14 PM
The only stupid problem with my code was that I was missing ',' in the 3rd line .Due to this silly mistake Splunk was ignoring 3rd line .
... View more
02-03-2015
06:13 PM
Thanks for the solution , it works. The only stupid problem with my code was that I was missing ',' in the second line .Due to this silly mistake Splunk was ignoring 3rd line .Thanks again
... View more
02-02-2015
06:36 PM
Hi Experts,
I am struggling to stop time chart drilldown using js. Here is the code.
this._chartView = new ChartView({
managerid: 'details-search-manager',
'charting.legend.placement': 'none'
'charting.drilldown': 'none'
});
'charting.legend.placement': 'none' is working absolutely fine but 'charting.drilldown': 'none' is getting ignored by Splunk. Please help.
... View more
01-30-2015
01:40 AM
Thanks for the quick response Martin, but with this solution I have to define series color manually , because I am getting random IP as output so how I can fix this .
... View more
01-29-2015
09:07 PM
I am facing this issue in Splunk 6.2 version .Same thing is working fine in Splunk 6.0 version.Please suggest if anyone facing such issue in 6.2.
... View more
01-29-2015
08:51 PM
Hi Experts,
I have an issue with stacked time chart. My search is like
Sourcetype="ABC"| timechart count by dest_ip usenull=f useother=f
I am getting top 10 IP addresses with count but I can see duplicate colors, like yellow color 3 times. Is there any way to provide different color to all 10 different IPs
Thanks
VG
... View more
01-28-2015
09:18 PM
Thanks , that sounds Interesting will start with the first option i.e add-on
... View more
01-28-2015
08:22 PM
Hi Experts,
I am new to this please suggest how I can achieve it, I have firewall device data in CEF format which has device name , IP and location like "USA/Los Angeles", "India/Delhi" etc. I want to show the device location on MAP.
Thanks
VG
... View more
- Tags:
- map
01-07-2015
06:13 AM
yup it works , the only problem is it is picking everything after msg field . Can we do something like it picks line between "msg" and "categorySignificance" fields . I observed that message ends just before "categorySignificance" field.
Here is the overall log
2014-12-26 16:22:42 Local7.Debug 172.28.70.132 CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4634|An account was logged off.|Low| eventId=1 externalId=4634 msg=Network: A user or computer logged on to this computer from the network. categorySignificance=/Informational categoryBehavior=/Access/Stop categoryDeviceGroup=/Operating System catdt=Operating System categoryOutcome=/Success categoryObject=/Host/Operating System art=1419639752421 cat=Security deviceSeverity=Audit_success rt=1419639736000 dhost=WIN-789Z3VMFC02 dst=172.28.70.132 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 dntdom=WIN-789Z3VMFC02 duser=Administrator duid=0x1d11f9 cs2=Logon/Logoff:Logoff cn1=3 c6a4=fe80:0:0:0:8045:2eed:5e73:a468 cs1Label=Accesses cs2Label=EventlogCategory cs4Label=Reason or Error Code cs5Label=Authentication Package Name cn1Label=LogonType cn2Label=CrashOnAuditFail cn3Label=Count c6a4Label=Agent IPv6 Address ahost=WIN-789Z3VMFC02 agt=1
... View more
01-07-2015
06:07 AM
I tried above command only it is still picking everything after "msg" ,like till the last word of the overall log
... View more
01-07-2015
05:59 AM
yup it works , the only problem is it is picking everything after msg field . Can we do something like it picks line between "msg" and "categorySignificance" fields . I observed that message ends just before "categorySignificance" field.
Here is the overall log
2014-12-26 16:22:42 Local7.Debug 172.28.70.132 CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4634|An account was logged off.|Low| eventId=1 externalId=4634 msg=Network: A user or computer logged on to this computer from the network. categorySignificance=/Informational categoryBehavior=/Access/Stop categoryDeviceGroup=/Operating System catdt=Operating System categoryOutcome=/Success categoryObject=/Host/Operating System art=1419639752421 cat=Security deviceSeverity=Audit_success rt=1419639736000 dhost=WIN-789Z3VMFC02 dst=172.28.70.132 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 dntdom=WIN-789Z3VMFC02 duser=Administrator duid=0x1d11f9 cs2=Logon/Logoff:Logoff cn1=3 c6a4=fe80:0:0:0:8045:2eed:5e73:a468 cs1Label=Accesses cs2Label=EventlogCategory cs4Label=Reason or Error Code cs5Label=Authentication Package Name cn1Label=LogonType cn2Label=CrashOnAuditFail cn3Label=Count c6a4Label=Agent IPv6 Address ahost=WIN-789Z3VMFC02 agt=1
... View more
01-07-2015
05:41 AM
This is what I have done , but with this message is blank.
sourcetype="CEF" | table cat,msg | rex field=msg (?i)msg=(?P .*)
even I tried
sourcetype="CEF" | table cat,msg | rex field=msg "\smsg=(? .+?)."
... View more
01-07-2015
05:40 AM
this is my first time that I am using REX . This is what I have done , but with this message is blank.
sourcetype="CEF" | table cat,msg | rex field=msg (?i)msg=(?P .*)
... View more
01-07-2015
05:20 AM
Hi Experts,
I have syslog file and I want to generate a table from this log file .This file contains log like
2014-12-26 16:22:42 Local7.Debug 172.28.70.132 CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-
Auditing:4634|An account was logged off.|Low| eventId=1 externalId=4634 msg=Network: A user or computer logged on to this computer from the network.
I want to pick complete "msg" from this log but in the table when I pick msg it shows only one word "Network". I want to show complete msg field like "Network: A user or computer logged on to this computer from the network."
Please help on this .
... View more
- Tags:
- rex
01-02-2015
08:20 AM
Thanks for prompt reply Martin
but , does that mean that we can get older versions of Splunk ES App for free (atleast the trials)?
... View more
01-02-2015
06:42 AM
Hi Team,
Recently I was studying Splunk App for enterprise security , I want to dig it further like what are it's capabilities, so my questions are
1) Is it free , I mean can I download it for free like we have Splunk 30-90 days trial version ?
2) If not do I need to purchase a separate license for this app ?
3) What if someone already using licensed SPLUNK , will the same license can be used for this APP ?
4) What is the cost ?
5) Is it compatible with older versions of SPLUNK ?
Thanks
... View more
- Tags:
- siem
10-01-2014
12:42 PM
1 Karma
thanks VG for such detailed answer .
Not sure if Splunk is looking into these issues or not but these are some basic requirements
... View more
10-01-2014
09:36 AM
2 Karma
Hi Experts,
I am aware that we can create and customize a new app and as per below document
http://docs.splunk.com/Documentation/Splunk/6.1.4/AdvancedDev/UseCSS
But application.css is ignored by splunk 6.0 and above .So my questions are
1) How to hide the Create New Dashboard
2) Ho I can customize app bar or nav bar.
3) Rather changing color from Nav xml do we have any other choice .?
4) If application.css is not supported by Splunk 6.0 or above then why we still have this document provided by Splunk. stating that we can customize app from application.css
Thanks in advance
Thanks
VG
... View more
10-01-2014
07:35 AM
I missed my nav code
<nav search_view="search" color="#65A637" stylesheet="application.css">
<view name="dashboards" default='true' />
</nav>
I actually want to hide account bar
... View more
10-01-2014
07:21 AM
Hi Experts,
I want to add my custom style to my app. I have done some modifications in application.css in ($SPLUNK_HOME/etc/apps//appserver/static/) folder and I restart the web service then refresh browser but it did not reflect the changes to the app.
here is my nav code
Application.css code
/*
* Top app banner section
*/
.AccountBar {
background-image: url(/static/app/samples/samples_header.png);
background-repeat: no-repeat;
background-color: #79a60b;
height: 140px;
}
.AccountBar .appLogo,
.AccountBar p.appName {
display: none;
}
.AccountBar .accountBarItems {
background-color: #000;
opacity: .5;
filter: alpha(opacity=50);
}
/*
* view menu system
*/
.AppBar {
font-family: Arial Black, Arial, sans-serif;
font-size: 18px;
font-variant: small-caps;
}
.AppBar a {
color: #f3df00 !important;
}
.AppBar a:hover {
color: #6ad7ff !important;
}
/*
* Body content
*/
body {
background-image: url(/static/app/samples/body_bg.png);
background-repeat: repeat-x repeat-y;
}
Please suggest what else do I need to consider
... View more
- Tags:
- Apllication.css
09-30-2014
08:19 AM
Strange even for this question I did not receive any suggestion or solution, but again I resolved this issue by myself ,hope this will help some one.
The only problem was with the app name as I mentioned in the question that my new app name was "Prod Search".
Since I have provided a space in the app name which is not supported by Splunk 6.0 .So when I replace the space with "_" the error get resolved .Now my app name is "Prod_search" i.e my app folder name.
Thanks
Vikas,Strange even for this question I did not receive any suggestion or solution, but again I resolved this issue by myself ,hope this will help some one.
The only problem was with the app name as I mentioned in the question that my new app name was "Prod Search".
Since I have provided a space in the app name which is not supported by Splunk 6.0 .So when I replace the space with "_" the error get resolved .Now my app name is "Prod_search" i.e my app folder name.
Thanks
Vikas
... View more
09-30-2014
03:19 AM
1 Karma
Hi Experts,
I do not want to show Message, Setting , activity , help to my user it is present at the top right corner .
What I want is when user login he/she will only see his login name and under that logout option.
Please advice from where I can hide these options. I have assigned User splunk role to my users.
Thanks
VG
... View more
- Tags:
- hiding
09-29-2014
09:42 AM
What I wanted to know is apart from app.conf is there any other conf file which I need to modify or update .Please suggest
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-15-2025
09:58 AM
|
Karma given to
