Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vishaltaneja070
vishaltaneja070
Motivator
Member since:
03-09-2020
01-20-2022
Community Statistics
| Posts | 352 |
| Solutions | 30 |
| Karma Given | 0 |
| Karma Received | 69 |
| Member Since | 03-09-2020 |
Activity Feed
- Got Karma for Re: Renewing server.pem certificate. 06-12-2025 09:02 AM
- Got Karma for Re: Renewing server.pem certificate. 11-20-2024 07:52 AM
- Got Karma for Re: How do I retrieve the first and last date from each month?. 05-22-2024 06:59 AM
- Got Karma for Re: How to restart Universal Forwarder via the deployment server?. 01-23-2024 05:36 AM
- Got Karma for Re: How do I renew a Splunk forwarder's default certificate?. 09-19-2023 01:14 AM
- Got Karma for Re: Renewing server.pem certificate. 07-19-2023 08:57 AM
- Got Karma for Re: Can you help me with the following mongod kvstore error?. 04-05-2023 02:07 PM
- Got Karma for Re: What is the purpose of the sourcetype "stash_new"?. 12-02-2022 02:59 AM
- Got Karma for Re: Renewing server.pem certificate. 11-01-2022 11:11 AM
- Got Karma for Re: Renewing server.pem certificate. 09-29-2022 02:08 AM
- Got Karma for Re: Search factor vs Replication factor. 08-03-2022 06:58 AM
- Got Karma for Re: Renewing server.pem certificate. 07-12-2022 06:40 AM
- Got Karma for Re: How do I renew a Splunk forwarder's default certificate?. 03-10-2022 09:20 AM
- Got Karma for Re: Renewing server.pem certificate. 03-02-2022 07:20 AM
- Got Karma for Re: Renewing server.pem certificate. 03-02-2022 06:06 AM
- Got Karma for Re: Renewing server.pem certificate. 02-10-2022 03:39 AM
- Got Karma for Re: Splunk eval if with wildcard. 01-24-2022 06:19 AM
- Posted Re: Splunk DB connect connection to AWS Athena on Splunk Enterprise. 01-20-2022 01:39 AM
- Posted Splunk DB connect connection to AWS Athena on Splunk Enterprise. 01-19-2022 08:04 AM
- Got Karma for Re: Renewing server.pem certificate. 01-08-2022 08:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-27-2019
03:57 AM
Hello @davidhourani
yes
For Indexes searched by default
it is having All Non Internal indexes
& for indexes search one has both All Non Internal Indexes & All Internal Indexes
... View more
06-27-2019
03:32 AM
Hello @niketnilay
Nope it is not like that, in the roles i have mentioned by default access to All non Internal indexes
But still it is not running
So some other issue it is.
... View more
06-27-2019
03:31 AM
Hello @DavidHourani
Nope it is not like that, in the roles i have mentioned by default access to All non Internal indexes
But still it is not running
So some other issue it is.
... View more
06-27-2019
12:22 AM
Hello All
I am not sure, why i am not able to use search like
host=*
but if i search like
index=* host=*
then it will work.
Not sure why. I need to use more fields to start searching but some are working some are not.
... View more
06-24-2019
04:53 AM
Hello All,
I need to define checkpoint at two positions
like
select * from table_one where timestamp> checkpoint
UNION ALL
select * from table_two where timestamp > checkpoint
I can't use single timestamp as the one table is very huge in size.
... View more
06-04-2019
02:51 AM
Hello @DavidHourani
I have applied Lookahead for that particular transforms stanza only. so i dnt think it will affect the line breaking.
Also, It is not working, tried with below stanza
06/04/2019 02:55:06 AM
LogName=abccccccccccc
SourceName=fjdjhfjhjdjhjdhfhfjhjd
EventCode=hdfhdfjd
EventType=fdfdfdfd
Type=Error
ComputerName=dfdfdfdfdf.dfdfd.dfdf
dfdfd
jajhsjhdjjdhjhjsjhjujjfjhhsjhjhfjjhjjdghjjfhjjdhjjdhjfhhhhdhdhdhhhhdhhhdhhhhhhdg
jdhjdjfhjdhjdfhjdjdfjdhfjdjhfdjfh
kfkkjkfhdfkdfhkfhkfhdf
Severity: debug
Still the above regex is accepting debug log which is at more than 300 characters away.
... View more
06-04-2019
01:06 AM
Solved the issue by Using LOOKAHEAD option available in transforms.conf
https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Transformsconf
[route_to_index]
LOOKAHEAD=300
... View more
06-04-2019
01:04 AM
Like if there is debug word there in event but in first 300 characters only , then the event should go to debug index ,not the normal one .
... View more
06-04-2019
12:57 AM
I need to do it at index time. based on a word on first 300 charters of event we need to change the index. Like debug or error logs.
... View more
06-04-2019
12:57 AM
Need to do it index time. And we need to match a specific word only
I need to do it at index time. based on a word on first 300 charters of event we need to change the index. Like debug or error logs.
... View more
06-04-2019
12:56 AM
Hello @FrankVI
I need to do it at index time. based on a word on first 300 charters of event we need to change the index. Like debug or error logs.
... View more
06-03-2019
11:47 PM
Hello,
I need to check the regex condition only on first 300 characters, if the regex condition available after than then it should ignore the event.
Is it possible?
... View more
05-29-2019
03:28 AM
1 Karma
@kemnean2001
Below query will help you:
| inputlookup ad_identities |search sAMAccountName=unetho |table sAMAccountName, displayName, userPrincipalName | rename sAMAccountName as user_id
| join user_id
[search index=pan_logs rule="VL-PROD_VL-LAPTOPS-no-log" src_user=*unetho
|eval user_id=substr(src_user , 9, len(src_user ))
|table user_id, app | dedup user_id] | table user_id, displayName, userPrincipalName , app
... View more
05-29-2019
03:17 AM
@davel1333: If you don't want to consume licence or store data, then you can use dbquery command.
... View more
05-28-2019
11:44 PM
Hello @LukeMurphey
For me it is happening even splunk is running.
... View more
05-21-2019
03:26 AM
I am getting the below error with inputs configured:
ERROR Unable to find the app configuration for the specified configuration stanza=default error="splunkd connection error", see url=http://lukemurphey.net/projects/splunk-website-monitoring/wiki/Troubleshooting
2019-05-21 02:40:00,361 ERROR Unable to find the app configuration for the specified configuration stanza=default error="splunkd connection
Could you please help what is this error? and how to fix it?
... View more
- Tags:
- Website Monitoring
05-08-2019
05:29 AM
@arpitpropay : Could you please accept the answer to close the conversation.
... View more
05-08-2019
12:51 AM
Otherwise:
props.conf
[your_sourcetype]
REPORT-appname1= appname
transforms.conf
[appname]
REGEX= ^.+\x5C(?(.+))\x5C[^\x5C]*$
SOURCE_KEY = source
... View more
05-08-2019
12:48 AM
2 Karma
Hello @arpitporpay
The best way to do this is:
Go to Splunk Web > Settings > Fields > Fields Extractions > Add new
then add the below attributes:
app_name: <your app name>
name: source_app_name
sourcetype : < as per your requirement> --- the above mentioned source is incorrect as it is asking for which source it need to apply so it is better to use sourcetype.
Type: uses trasform
extraction: appname
Go to Splunk Web > Settings > Fields > Field transformations > Add new
destination_app: <your app name>
name : appname
type: regex-based
regular expression: ^.+\x5C(?<appname>(.+))\x5C[^\x5C]*$
source_key : source
Thanks!
... View more
04-30-2019
07:30 AM
@bshega: it worked?
... View more
04-30-2019
06:56 AM
Hello @bshega
Did you add the users to role : db_connect_user
Check this out:
https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Configuresecurityandaccesscontrols
... View more
04-29-2019
07:50 AM
if you want that dashboard should be open by default while opening the , them you need to make changes in the nav file
Please find the link below:
http://dev.splunk.com/view/quickstart/SP-CAAAFDG
... View more
04-29-2019
07:38 AM
@aalaa
If you have created a app, then you can directly clone the dashboard.
... View more
04-29-2019
05:10 AM
@swmishra_splunk
is it possible to share the screenshot?
... View more
04-29-2019
03:46 AM
Hello @wailoont
The best approach I can think of is a lookup in this. You have to create two searches.
1. One which will add the result to lookup table.
2. To compare result with lookup table.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-20-2022
01:06 PM
|
