Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About ahmedhassanean
ahmedhassanean
Explorer
Member since:
06-07-2015
06-05-2020
Community Statistics
| Posts | 61 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 06-07-2015 |
Activity Feed
- Karma Re: How to create indexes to be replicated in an indexer clustering environment? for Steve_G_. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk App for Stream: How to troubleshoot error "Unable to ping server"?. 06-05-2020 12:47 AM
- Posted How do you reload inputs configuration file changes without a restart? on Security. 02-26-2019 08:40 AM
- Posted Re: Splunk integration to parse Logs of BMC remedy SAAS on Splunk Dev. 07-30-2018 04:59 AM
- Posted Splunk integration to parse Logs of BMC remedy SAAS on Splunk Dev. 07-29-2018 01:55 PM
- Posted Re: splunk handling csv file with each line have different format on Getting Data In. 05-19-2018 03:18 PM
- Posted splunk handling csv file with each line have different format on Getting Data In. 05-19-2018 02:16 PM
- Posted Why is the splunk multisite cluster memory utilization is very high? on Splunk Enterprise Security. 01-25-2018 11:26 PM
- Tagged Why is the splunk multisite cluster memory utilization is very high? on Splunk Enterprise Security. 01-25-2018 11:26 PM
- Posted Splunk Enterprise Security: How to constrain data models to certain sourcetypes/indexes? on Splunk Enterprise Security. 01-24-2018 09:52 AM
- Tagged Splunk Enterprise Security: How to constrain data models to certain sourcetypes/indexes? on Splunk Enterprise Security. 01-24-2018 09:52 AM
- Tagged Splunk Enterprise Security: How to constrain data models to certain sourcetypes/indexes? on Splunk Enterprise Security. 01-24-2018 09:52 AM
- Tagged Splunk Enterprise Security: How to constrain data models to certain sourcetypes/indexes? on Splunk Enterprise Security. 01-24-2018 09:52 AM
- Posted Re: splunk kaspersky integration on All Apps and Add-ons. 01-02-2018 11:11 AM
- Posted Configuration for heavy forwarder to store events locally when indexer is unavailable? on Getting Data In. 10-30-2017 03:59 PM
- Tagged Configuration for heavy forwarder to store events locally when indexer is unavailable? on Getting Data In. 10-30-2017 03:59 PM
- Posted Re: How to use iframe to include a Splunk dashboard in a third party software? on Dashboards & Visualizations. 10-05-2017 11:23 AM
- Posted splunk kaspersky integration on All Apps and Add-ons. 10-05-2017 08:43 AM
- Posted Re: How do you increase retention time of Splunk monitoring console reports? on Getting Data In. 09-27-2017 11:13 AM
- Posted Re: How do you increase retention time of Splunk monitoring console reports? on Getting Data In. 09-27-2017 09:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-12-2016
07:20 AM
Dears,
May i know please if it's possible to send ALL AppDynamics Business transactions to Splunk
thanks in advance
... View more
10-03-2016
02:21 PM
Dears,
i have scenario where i have three nodes
node one master and indexer and searh head
node two indexer and search head
node three heavy forwarder
all three node are configure as license slave for node 1
now i have configure node three heavy forwarder to forwardandindex locally then send data to node one and two
but in license i can see that license count double is that normal
?
... View more
10-01-2016
03:56 PM
Many thanks for your support
... View more
10-01-2016
12:10 PM
So why are there default Indexes in Enterprise Security?
... View more
10-01-2016
11:50 AM
you are talking about default index name in case there is no APP but the case here is that Security APP has default indexers and we must insert data in Correct Indexer to be able for dashboards to populate Data
... View more
10-01-2016
09:22 AM
Dears,
i would like to know how can i choose which index i forward data to it from my devices
for example if i would like to ingrate Active Directory Cisco Juniper Logs
which index i should choose from default indexes that came with Security Enterprise APP
... View more
09-22-2016
05:49 AM
Dears,
may i know if there is any way to configure Splunk to insert Data into Database in real time using Db connect or any other method
thanks in advance
... View more
05-05-2016
05:23 PM
no it's not what i want
i would like to normalize all fireld/value pair of each transaction but with time for each field/value in row
i was thinking in command like mvzip but it will be hard to obtain because of large number of key/value pairs
... View more
05-05-2016
05:08 PM
sample example:
TransactionID=15647|10:01:01|Customernumber=51|10:01:02|agentID=13|10:01:02|agentID=13
one line for each transaction
... View more
05-05-2016
05:00 PM
if i run below spl:
index=default | table TransactionID "Customer number" agentID viewduration "number of requests" "Server URL"
i will get below output:
time TransactionID Customer number agentID viewduration number of requests Server URL
10:01:01 15647 51
10:01:02 15647 13 2
10:01:03 15647 7
10:01:03 18333 google.com
10:01:04 15647
10:01:05 15647 google.com
10:01:06 15647
10:01:07 15647 69
10:01:08 15647
10:01:09 15647 74
10:01:10 15647 10
10:01:11 15647 13
10:01:12 15647
10:01:13 15647 14 yahoo.com
10:01:14 15647
10:01:15 15647
10:01:16 15647 14
10:01:17 15647
10:01:18 15647 10 yahoo.com
11:01:18 18333 17
12:01:18 18333 13
13:01:18 18333
... View more
05-05-2016
03:36 PM
transaction command collect events at one big multi values event instead i want to have single value event in row
... View more
05-05-2016
01:06 PM
not it's tabular format i would like it be raw event time field value .....etc
... View more
05-05-2016
12:49 PM
new events as below:
time1,field1=value1:time1: field2=value2:time2 ,field1=value2,time2:field3=value3 and so on
to summarize it i want to collect each field/value with time for all same filed/value of same transactionID to new one event
... View more
05-05-2016
12:07 PM
events1: time1 field1=value1 field2=value2
events2: time2 field1=value2 field3=value3
event3: time3 field4=value4
event4: time4
event5: time5 event1=value1 field6=value6
... View more
05-05-2016
10:27 AM
I have logs that contain different Key/value in different logs, but with same transaction.
I would like to summarize all this key/value pairs with time in events as below.
time1:key1:value1:time2:key2:value2:....
Is there is any way to achieve that?
thanks in advance
... View more
04-13-2016
01:19 PM
i dont know if you solve this issue or not but i think to monitor idrac you can do that using two inputs module
first syslog for logs of physical servers
and snmp input to monitor for specific OIDs of temperature
... View more
04-04-2016
12:54 PM
what i am trying to say that i have log files of Weblogic that contain below messages and i want to know if this addon contain extraction for it or not
weblogic.kernel.Default (self-tuning)
... View more
04-04-2016
07:16 AM
Dears,
I have installed Oracle WebLogic App for Splunk and navigate to add-ons and found below
function1_weblogicserver_eventgen Function1_WLS_App Function1_WLS_Managed_win_TA SA-Eventgen
Function1_WLS_Admin_nix_TA Function1_WLS_IDX_SH_TA Function1_WLS_nix_performance_TA
Function1_WLS_Admin_win_TA Function1_WLS_Managed_nix_TA Function1_WLS_win_performance_TA
I need to know if Splunk can monitor WebLogic logs or not, and if, yes which add-on I have to use?
... View more
03-31-2016
10:42 AM
Hi ALL,
I would like to get SBR accounting logs from SBR in real time. How can I achieve that?
i found that Splunk App for Stream can understand Radius protocol, but how can I configure SBR to send logs and decrypt them?
... View more
03-12-2016
11:28 PM
ok many thanks for your support
... View more
03-12-2016
10:37 PM
mvexpand take So much memory and hard to use in large amount of logs
and regarding second SPL you here just choose count of x.b but i need to split each foo and bar in new event
... View more
03-12-2016
05:35 AM
there is command in this app that not have corresponding functionality in spath such as xmlsplit
... View more
03-10-2016
04:14 AM
i would like to know if it's possible is to execute some commands at index time .
i mean commands such as ( mvzip | mvexpand ) or any other commands
i don't want to use summary index
thanks in advance
... View more
- Tags:
- splunk-enterprise
03-08-2016
03:13 PM
yes it's the same as 5.0.3 but search query still truncate at 500 MB
... View more
03-08-2016
12:43 PM
Dears,
i have splunk 6.3.3 and i am using query that have command mvexpand but mvexpand truncate result because of exceed 500MB memory usage i have found on splunk doc of version 5 that i can edit limits.conf value of max_memory_usage to higher value than 500MB but it's not working in version 6.3 and also this option not exist in default configuration of limits.conf
please advise
... View more
- « Previous
-
- 1
- 2
- Next »
