Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vasanthmss
vasanthmss
Motivator
Member since:
12-06-2013
04-28-2022
Community Statistics
| Posts | 286 |
| Solutions | 55 |
| Karma Given | 407 |
| Karma Received | 358 |
| Member Since | 12-06-2013 |
Activity Feed
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 03-27-2025 10:52 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 11-22-2024 11:07 PM
- Got Karma for Re: How to convert a timestamp field to epoch format?. 10-31-2024 05:53 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 07-06-2023 04:04 AM
- Got Karma for Re: How to add and parse XML data in Splunk?. 12-28-2022 07:24 AM
- Got Karma for Re: How to replace line breaks with delimiters?. 08-15-2022 12:49 PM
- Karma Re: Checklist before installing Splunk for sayaksplunk. 04-28-2022 12:17 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 04-15-2022 12:13 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 04-07-2022 04:49 AM
- Got Karma for Re: Is it possible to divide all individual values in field1 by the column total of field1?. 02-06-2022 06:07 PM
- Got Karma for Re: How to freeze ONLY first column in table when scrolling the table to right or left. 02-04-2022 08:05 AM
- Got Karma for Re: How to delete events from a summary-index?. 02-03-2022 06:40 AM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 01-07-2022 12:09 PM
- Got Karma for Re: Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?. 09-30-2021 10:21 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 07-01-2021 06:46 AM
- Got Karma for Re: case and isnull for multiple fields. 02-19-2021 03:42 AM
- Karma Re: Help getting multiple columns from a chart for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for woodcock. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for somesoni2. 06-05-2020 12:51 AM
- Karma Re: List of top URLs with hourly count > 50 for somesoni2. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 2 |
02-01-2017
04:00 PM
2 Karma
Seems like an issue from 6.3.x upgrade to newer version after 6.4.x would fix the issue.
... View more
02-01-2017
10:43 AM
1 Karma
use the where class to find your matching records, something like this,
|stats count, avg(concurrent_user) as user_count by date_minute, date_second |trendline sma10(user_count) as user_count_moving_average | where user_count_moving_average <=count
in the saved search schedule it when more than one events presents.
Hope this will helps you.
... View more
02-01-2017
10:10 AM
14 Karma
Hi Praveenbandi
Below rest command will help you to get all secheduled searches, to list all the searches run the second search
| rest /servicesNS/-/-/saved/searches | search is_scheduled=1 | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
Search to get all saved searches.
| rest /servicesNS/-/-/saved/searches | table title, cron_schedule next_scheduled_time eai:acl.owner actions eai:acl.app action.email action.email.to dispatch.earliest_time dispatch.latest_time search *
to know all the users and their scheduled searches.
| rest /servicesNS/-/-/saved/searches | search is_scheduled=1 | stats values(eai:acl.app) as application c by title, eai:acl.owner | fields - c
... View more
01-24-2017
01:10 PM
2 Karma
Hi,
save the below code as html, replace parameters with your search string
add the basic authorization, mypostrequest.setRequestHeader("Authorization", "Basic <>");
<html>
<head>
<title>Ajax POST HTTP Request to Splunk Rest</title>
<SCRIPT TYPE="text/javascript" LANGUAGE="JavaScript">
function ajaxRequest(){
var activexmodes=["Msxml2.XMLHTTP", "Microsoft.XMLHTTP"]; //activeX versions to check for in IE
if (window.ActiveXObject){ //Test for support for ActiveXObject in IE first (as XMLHttpRequest in IE7 is broken)
for (var i=0; i<activexmodes.length; i++){
try{
return new ActiveXObject(activexmodes[i]);
}
catch(e){
//suppress error
}
}
}
else if (window.XMLHttpRequest) // if Mozilla, Safari etc
return new XMLHttpRequest();
else
return false;
}
function schedule_job(){
var mypostrequest=new ajaxRequest();
mypostrequest.onreadystatechange=function(){
if (mypostrequest.readyState==4){
if (mypostrequest.status==200 || window.location.href.indexOf("http")==-1){
document.getElementById("result").innerHTML = mypostrequest.responseText;
}
else{
alert("An error has occurred making the request");
}
}
}
var parameters="search=search index=_internal|table source,sourcetype,host"
mypostrequest.open("POST", "https://localhost:8089/services/search/jobs", true);
mypostrequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded;charset=utf-8");
mypostrequest.setRequestHeader("Authorization", "Basic <>");
mypostrequest.send(parameters);
}
function getJob(){
var mypostrequest=new ajaxRequest();
mypostrequest.onreadystatechange=function(){
if (mypostrequest.readyState==4){
if (mypostrequest.status==200 || window.location.href.indexOf("http")==-1){
document.getElementById("result").innerHTML = mypostrequest.responseText;
}
else{
alert("An error has occurred making the request");
}
}
}
var jobId = encodeURIComponent(document.getElementById("jobs").value);
var parameters="search=search index=_internal|head 10|table hose, source,sourcetype"
mypostrequest.open("GET", "https://localhost:8089/services/search/jobs/"+jobId+"/results?output_mode=json", true);
mypostrequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded;charset=utf-8");
mypostrequest.setRequestHeader("Authorization", "Basic <>");
mypostrequest.send();
}
</SCRIPT>
</head>
<body>
<form method="get" action="">
<table>
<tr>
<td>Job ID</td>
<td><input type="text" id="jobs" name="jobs" size="30" />
</td>
</tr>
<tr>
<input type="button" value="Schedule_Job" onClick="schedule_job()" />
<input type="button" value="getJob" onClick="getJob()" />
</td>
</tr>
</table>
</form>
<div id="result"></div>
</body>
</html>
... View more
01-18-2017
08:57 AM
Check this,
https://answers.splunk.com/answers/494555/is-there-any-way-to-list-all-the-saved-searches-in-1.html#answer-494559
check the below query
| rest /services/saved/searches | where is_scheduled=1
for historical scheduled searches use the below query,
index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count *
... View more
11-30-2016
09:04 AM
$SPLUNK_HOME/etc/users///lookups
Check this http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Usefieldlookupstoaddinformationtoyourevents
... View more
11-28-2016
05:52 PM
Go to physical server and replace the file.
... View more
11-28-2016
04:37 PM
check the other indexers, etc/system/* and etc/apps/*
Seems like other stanza overriding your bundle priority.
... View more
11-28-2016
12:16 PM
7 Karma
Use sub query to build your query string, there you can use any macros.
something like this...
|dbxquery connection=mydb [|stats c | eval query="<build your query with macro / anything..>" | return query]
Hope this will helps you!!!!
... View more
11-28-2016
12:04 PM
3 Karma
Hope you noticed or missed, while restarting splunk should through some exception on the props.conf malformed or something because of Extract class name? Since your first extract failed after the confs will be ignored.
I would suggest keep the Extract class name as small and meaningful. class name is a unique literal string. So simple change the below,
from
EXTRACT-agentId,agentVersion,excluded_from_containment,stats_acqs,stats_alerting_conditions,stats_alerts,stats_exploit_alerts,hostname,domain,gmt_offset_seconds,timezone,src_ip,last_audit_timestamp,last_poll_timestamp,last_poll_ip,url,last_alert_id,last_alert_timstamp,os_product_name,os_patch_level,os_bitness,src_mac,md5=
To
EXTRACT-sourcefields
Hope this will helps you!!!!
... View more
11-28-2016
11:55 AM
hope the below debugging steps will helps you,
run this on cluster master, /opt/splunk/bin/splunk show cluster-bundle-status and validate the bundle status. all indexers should have the same bundle id and time.
keep the cluster master in maintenance mode /opt/splunk/bin/splunk enable maintenance-mode and restart all the indexers. hopefully this will fix the issue. then disable the maintenance mode /opt/splunk/bin/splunk disable maintenance-mode
Cheers!!
... View more
11-28-2016
11:46 AM
create a saved search with the below search query. and schedule it for required threshold like 1 hr / 1 day. rename the outputlookup name as per your requirement. (First run it for all time, then schedule it based on your above threshold).
Search :
|tstats c where index=* sourcetype=* by index, sourcetype | fields - c | outputlookup index_sourcetype_lookup.csv
Run the search and confirm you want index / not? I have added sourcetype and index. if you dont like index remove it from group by.
Hope this will helps you!!!
... View more
11-28-2016
10:38 AM
3 Karma
please check the below steps to debug further,
check your connection and entity have access to app level / global?
Are you running as administrator? if not please add the roles the db_connect_user / db_connect_admin
Check the per-configured apps have the correct permission to dbxquery / any functionality provided by db_connect app,
Please post some further logs to assist further.
... View more
11-28-2016
10:32 AM
1 Karma
use the below one,
| sort 0 - "Number of days Logged in"
while using sort you can mention the limitation, zero means there will not be any limits applied. 😉
... View more
11-28-2016
10:21 AM
4 Karma
try something like this..
Once you are grouping the error type use the event stats to find the column total. so the total will be available for your further calculations.
BASESEARCH
| stats count(eval(success)) as CompletedTransactions by errorType
| eventstats sum(CompletedTransactions) as columntotal
| eval percent_failure=round(CompletedTransactions*100/columntotal , 2)
| sort -percent_failure
| table errorType CompletedTransactions percent_failure total true false percent
| addcoltotals labelfield=errorType label=TOTAL
Newly added or modified pipes are
| eventstats sum(CompletedTransactions) as columntotal
| eval percent_failure=round(CompletedTransactions*100/columntotal , 2)
Description:
Use the eventstats to calcualte the column total and name it as columntotal.
use the columntotal field in the percentage calculation.
Hope this will helps you!!!
... View more
10-31-2016
01:19 PM
Thanks, by increasing the open file size the issue was fixed.
... View more
10-27-2016
01:52 PM
1 Karma
try something like this,,
base search | timechart span=1h mean(user) as mean, stdev(user) AS std | where std>10 AND mean>10
... View more
09-07-2016
03:33 PM
3 Karma
go thorough the below answer.
https://answers.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server.html
... View more
09-07-2016
02:00 PM
syntax for the sort is sort <count> <sort by class>
something like this index=blah | stats count by field1 | sort 0 field1 Here field1 has the values of your ball, square etc. If you need to sort by ascending you need to use | sort 0 field1 for decending | sort 0 -field1 .
Note: If no number is specified for count, the default limit of 10000 is used. If the number 0 is specified, all results are returned
Hope this will help you.
... View more
09-07-2016
10:02 AM
you can use the same lookup by adding separate column to keep date values as suggested in the above comment. In-case your lookup has more records and still you want to handled by name then you can try something like this,,
| lookup [|stats c | eval l=strftime(now(),"mylookup_%Y_%m_%d.csv")] primary_key OUTPUT field1, field2 ..
here lookup will be like this,
mylookup_2016_09_06.csv
mylookup_2016_09_07.csv
By changing the date variable you can create your lookup name in sub search and pass ...
hope this will help you.
... View more
09-07-2016
09:49 AM
3 Karma
try to provide the time range - earliest and latest.
edit your dashboard - edit search - enter your search
edit your dashboard - edit search - Time Range Scope - Explicit Selection - Advanced -> -1w@w to @w+2h@h
meaning you can define time range of your search & reporting based on the earliest and latest.
... View more
09-07-2016
07:06 AM
These logs are from forwarder ?? Seems like indexer and forwarder communication failed in 9997 port. forwarder unable to connect to indexer with 9997 port using SSL. Are you using 3rd party ssl / self sign ssl? anyhow could you please share the configs?
Check the communication by:
telnet
telnet x.x.x.x 997
These are the few steps you can proceed to debug.
remove your ssl and validate the connection.
if the step 1 works you have issue with your SSL configurations.
My wild guess is your configurations on SSL is applied in forwarder but not indexer. since you are forcing forwarder to use SSL to the indexer communication. Have you done anything in indexer??
http://wiki.splunk.com/Community:Splunk2Splunk_SSL_SelfSignedCert_NewRootCA
above is some old wiki page.. still you can refer the configurations.
... View more
09-06-2016
09:46 AM
check the below items,
splunk forwarder to indexer connection: if yes .... then look the internal logs of the forwarder you can find the issue else fix the connection problem.
if there is no issue with the forwarder indexer communication - check for the dbconnect app's validate the connection details.
post some more detail to answer further
... View more
09-02-2016
01:45 PM
1 Karma
Concept:
1. run a scheduled search to identify you have received data / not.
2. if you have received data call the script
3. Using CURL handle whatever you want in the script like run a saved search that can generate /update lookup like that.
Steps,
First Create a search to identify your data has been received or not .. then your search looks something like, |tstats count where index=_internal by source | eventstats dc(source) as total_source | where count>1 AND total_source >4
timeframe: @mon to now
cron: Based on your requirement like once a day / once per hour
Alert condition: if number of events - is equal to - 4
Scheduled a script by clicking "Run a script" - provide the script name - "sc_enable_other_reports.sh"
description of above search: find the number of source received and find source shoud greater than one event (you can change based on your request)
Lets say your scheduled saved search "search/my_search" is sends email / generate lookups.. what ever.. first remove the schedules, here the idea is to trigger from command line.
Sample script: /opt/splunk/etc/apps/search/bin/scripts/sc_enable_other_reports.sh (if required you can add logging and butify the script) ... curl -k -u admin:changeme https://localhost:8089/services/search/jobs/ -d "search=savedsearch my_search" -d max_count=5000000
Handle the monthly export log or state in a file .. So that you don't want to send the same report again. All can be handled in the script. I have used internal index and search app to validate, you can try yours. I suggest first try this example then try to do with real data. Let us know how it goes....
Hope this will helps you !!!!!!!!!!
... View more
09-01-2016
01:29 PM
Updating the answer,
Splunk light trail / free : you can check the add-on by accessing the below link,
http://localhost:8000/en-US/manager/search/apps/local
But I guess the application details were not available. Let me leave this to others to answer...
... View more
