Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About akarivaratharaj
akarivaratharaj
Communicator
Member since:
07-11-2017
01-06-2025
Community Statistics
| Posts | 186 |
| Solutions | 1 |
| Karma Given | 21 |
| Karma Received | 4 |
| Member Since | 07-11-2017 |
Activity Feed
- Got Karma for Re: How to fetch only the top x rows for each category in the same search query?. 09-23-2025 06:23 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 01-05-2025 08:45 PM
- Posted How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:24 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:02 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:53 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:41 AM
- Posted Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 02:10 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-08-2024 03:17 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-06-2024 04:24 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-05-2024 10:08 PM
- Posted why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-03-2024 04:24 AM
- Posted How to extract a field value which have combination of number and special characters? on Splunk Search. 01-17-2024 12:26 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-18-2023 03:29 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 10:09 PM
- Posted How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 02:25 AM
- Posted Re: How to forward the data from AWS S3 to Splunk Enterprise? on Splunk Enterprise. 11-22-2023 02:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-15-2018
12:15 AM
In one of the search queries, I am displaying the Latest and Oldest value of a field. Please refer the below sample query:
index=main source = xyz earliest=-6mon
| stats last(size) as "Latest", first(size) as "Old"
In the above query, I am considering the last 6 months of data and trying to get the latest & oldest value of the field 'size'. I would like to display these values with their respective date or timestamp.
Could anyone please help me on this.
... View more
05-10-2018
11:04 AM
I have a report 'X' which is scheduled to run at a certain interval of time. According to the search query used in the report 'X', it returns the respective results. The summary indexing is also enabled to Index the data events whenever the report 'X' search query runs.
Now I would like to know how my report 'X' behaves if I just directly open it to view. Because my report is set to Index under Summary indexing. So if I open my Report 'X' to view the results of their respective search, will it gives me the result or the results can be seen only when I traverse through the Summary index (and its respective source/sourcetype).
Could anyone please clarify the above?
... View more
04-24-2018
10:50 PM
Is there any concept called "Explain" type function in Splunk for searching queries?
... View more
04-10-2018
12:56 AM
I have used streamstats only. Thankyou!
... View more
04-10-2018
12:55 AM
1 Karma
sure!! Thankyou!!
... View more
04-09-2018
10:46 PM
Thankyou so much for everyone's help
... View more
04-09-2018
10:49 AM
Actually Data_Growth field is nothing but delta of two consecutive sizes. But why that needs to be added or subtracted to/from Size field.
I am not clear on that part. Can anyone please explain me.
... View more
04-09-2018
05:08 AM
@p_gurav & @niketn,
Thanks both for the quick response.
I have tried both the query, I can see there is little difference between both the results. Because one is just dividing the data_growth by total size and multiplying with 100 to get the percentage and the other one is dividing the data_growth by sum of total size & data_growth and then multiplying with 100.
Can I know the difference between both the queries and which gives me the effective/accurate results.
... View more
04-09-2018
03:53 AM
I have a requirement to show the monthly growth percentage of an object. Basically need to find out the growth of an object in percentage when compared to the previous month.Below is the query which I am using
index=main
|timechart span=1mon sum(OBJECT_SIZE_GB) as Size
|delta Size AS Data_Growth p=1
So first I am displaying the total size of my object as "Size" and then displaying the size difference between consecutive months with the help of delta. Below is the sample how the results look like (added '|' for more clarity):
_time | Size | Data_Growth
2018-01 | 2429833.14 |
2018-02 | 2511015.66 | 81182.52
2018-03 | 2571432.37 | 60416.71
Now I need to find the Growth percentage of each month. I am not sure how to achieve this.
Could anyone please help me on this.
... View more
01-31-2018
09:27 PM
Hi,
I am currently working on JMX app for one of our projects' requirement. I am able to install the application and work on that without any issues in my standalone environments. But if I try to install on my clustered environment, it is not working.
Is there any differences in installing the JMX application in standalone and clustered environment? If there are different procedures for the clustered environment, can I know the link of the document for reference please.
Could anyone please help me on this.
... View more
12-21-2017
10:48 PM
Hi,
I have my Splunk Add-on for Java Management Extensions installed on a Linux machine. I have to monitor a JMX remote server which is also in Linux. As suggested for Windows to check the connection through jconsole, how can I check the connection between these two Linux servers.
Could anyone please help me on this.
... View more
12-04-2017
11:20 PM
Hi,
I have changed only the inputs.conf, jira.conf and config.ini as they mentioned in the manual.
Provide all the details of your Jira server and try by changing the option 'disabled' into 0 in the inputs.conf file.
... View more
11-29-2017
03:22 AM
Hi @Damien,
I have reinstalled the complete setup once again and updated only the config.xml file with the hostname and port details. Now I am getting the below error as failed to initialize the stanza.
ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SPLUNK4JMX\bin\jmx.py"" The root config object(JMXPoller) failed to initialize, stanza : jmx://helloworld
Could you please help me on this. Due to this I am unable to proceed further on this setup.
... View more
11-27-2017
09:37 PM
@Damien,
I have tried with 127.0.0.1, still I am getting the same error on splunkd log.
11-28-2017 11:05:30.541 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SPLUNK4JMX\bin\jmx.py"" host=127.0.0.1, jmxServiceURL=, jmxport=0, jvmDescription=test, processID=0,stanza=jmx://testjmx,systemErrorMessage="Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: 127.0.0.1; nested exception is:
11-28-2017 11:05:30.541 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SPLUNK4JMX\bin\jmx.py"" java.net.ConnectException: Connection refused: connect]"
I have also made the below changes but no luck.
mbean domain="" properties="" dumpAllAttributes="true"
Could you please help me on this.
... View more
11-27-2017
09:18 PM
Hi,
I am very new to this topic. I want to work on collecting the AWS data into Splunk for our projects.
Could you anyone please let me know the difference between Splunk App for AWS and Splunk Add-On for Amazon Web Services. So that we can use the app in our project according to their features.
... View more
11-27-2017
01:29 AM
Hi @Damien,
I have turned off the windows firewall completely in my system. But still throwing the below error;
11-27-2017 14:55:39.385 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SPLUNK4JMX\bin\jmx.py"" host=localhost, jmxServiceURL=, jmxport=0, jvmDescription=test, processID=0,stanza=jmx://testjmx,systemErrorMessage="Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: localhost; nested exception is:
11-27-2017 14:55:39.385 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SPLUNK4JMX\bin\jmx.py"" java.net.ConnectException: Connection refused: connect]"
... View more
11-26-2017
11:37 PM
Hi,
I am very new to the application 'Monitoring of Java Virtual Machines with JMX' and also to JMX concept. For installation and other configuration steps, I go through the below site:
https://splunkbase.splunk.com/app/668/#/details
I have done modifications only in the config.xml file with my localhost as hostname and its corresponding port details. Then created a data input through 'JMX' by entering necessary details. When I check for the index or sourcetype which I specified in the data input, no results are returned. When I check in the splunkd.log, it is writing the error as "java.net.ConnectException: Connection refused:"
I am able to connect to the host through jconsole without any issues. But when I configure the same details in the config file, it is unable to connect to the host.
Note: I have made changes only on config.xml file only added hostname and its port.
Could you let me know if anything I am missing to configure. Please help on this.
... View more
11-08-2017
03:26 AM
Okay. The application is mainly used to connect the JIRA and Splunk and fetch the data from jira using the JQL query in the splunk itself. So how can we search those using the query.
So in this case, do we need to use the search app only for writing our JQL queries?
... View more
11-04-2017
08:54 AM
Hi @rpille,
Thanks for your help for making me to understand about the working of CIM app.
I have installed the "Add-on for Jira" app on Splunk. The same situation which I faced for CIM app, is same I am facing for add-on for jira also. Whenever I launch the application it is showing "page not found". This is also the case as like CIM app without home page?
... View more
11-02-2017
10:12 PM
Hi @rpille,
Yeah I can understand the context. As you said, we are going to use only the data models from CIM app. so we can achieve it through settings or setup option.
I have tested this by installing the CIM app in my local. When I click on the CIM app, it is taking me to the default home page with a search bar and a time range picker.
How come it is showing home page if it is installed in local but showing page not found if we done on cluster.
... View more
11-02-2017
07:30 AM
Hi @rpille,
Thanks for your response. I am able to access the setup menu as you said above.
But what I am expecting is , the home page with search bar as like other apps. For instance, Search & Reporting app: if we click on the application we will get the default home page with a search bar and the menus in it.
So is it possible to have that home page setup with CIM app?
... View more
11-01-2017
10:21 PM
I have installed the CIM app 4.3.1 on Splunk 6.4.1 version. When I launch the application it is showing the error as below:
"404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 59faaaf5d67fd087d85f50) in Search"
Could anyone please help me in this case.
... View more
10-30-2017
11:06 PM
Hi Gupta,
Thanks for the information. When I am scheduling my report, I need the alert actions to be carried out as logging events. So as per your suggestion I have enabled the Summary index option.
So the Summary index is logging those events in it with the default source and sourcetype. In my case, by default I am getting the sourcetype as "stash". I have tried to edit the sourcetype through the "Searches, reports, and alerts ->MyReport->Advanced Edit" option. The change does not work in the Splunk version 6.4.1 but it is working in the current version 7.0.0
So how can I change it in my Splunk 6.4.1
... View more
10-29-2017
10:35 PM
Yeah I have that option under Alert actions. I have selected the summary index also, but when it creates the new events in the summary index, what are the host, source and sourcetype details it uses for the new events. If at all I need to modify the source and sourcetype details how can I achieve it according to my project requirements.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-06-2025
05:52 AM
|
