About PowerPacked

PowerPacked · ‎04-22-2019

Hi If you extracted those fields by eval, its not gonna work as there is a sequence in search time operations. - field alias comes before eval ( calculated fields) Please take a look at this sequence of search time operation, which means every search ran in UI go through these operations in order. https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence Thanks

PowerPacked · ‎04-18-2019

Hi for dashboard usage activity Please use this search, the results also gives user name as well in the above search "my_test" is dashboard's name which you see in URL when you open the dashboard. Thanks

PowerPacked · ‎02-22-2019

Hi Give this a try INDEXED_EXTRACTIONS = JSON TIMESTAMP_FIELDS = date Thanks

PowerPacked · ‎02-20-2019

Thanks for reply Please take a look at this lines in documenation which is confusing. If you want to forward fields that you extract from structured data files to another Splunk instance, you must configure the props.conf settings that define the field extractions on the forwarder that sends the data. This includes configuration of INDEXED_EXTRACTIONS and any other parsing, filtering, anonymizing, and routing rules. Performing these actions on the instance that indexes the data will have no effect, as the forwarded data must arrive at the indexer already parsed. https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Extractfieldsfromfileswithstructureddata#Field_extraction_settings_for_forwarded_structured_data_must_be_configured_on_the_forwarder Thanks

PowerPacked · ‎02-20-2019

@ddrillic Did you put this props on universal forwarder ? Does universal forwarder can handle "SHOULD_LINEMERGE", TIME_FORMAT attributes ? Thanks

PowerPacked · ‎02-18-2019

Hi Try this index="blabla-bla3" | search container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" if above doesn't work you need to add below stanza to fields.conf on search head, [container_name] INDEXED_VALUE = false Thanks

PowerPacked · ‎02-18-2019

Hi Try this | eval new_time = strftime(yourtimefield, "%d %b %Y")

PowerPacked · ‎02-05-2019

Thanks for the answer If you go through the above doc in the question, it says Splunk will extract default fields like host,timestamp,source etc. & Internal fields like _time,_raw, etc. for every event at index time I can see _time, linecount,punct all other internal & default field value for every event but i dont see timestamp field value for any event. & i am trying to understand diff between _time and timestamp field value for any event. Can you explain me this or provide sample image which shows _time and timestamp field value for any event.

PowerPacked · ‎02-05-2019

Yes they are indexed extractions default fields - but i would like to know diff between them

PowerPacked · ‎02-05-2019

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Aboutdefaultfields

PowerPacked · ‎02-05-2019

https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Aboutdefaultfields

PowerPacked · ‎02-04-2019

Guys I cant find the difference between _time internal field and timestamp default field in docs anywhere, Can someone help me with this or are they same ? Here is the link to Splunk doc which shows them differently. https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/Aboutdefaultfields Thanks

PowerPacked · ‎01-22-2019

Hi kchaitanya If you are looking for "Pass4SymmKey" option on indexer clustering. yes it needs to be same on cluster master, peer nodes & search heads under Clustering stanza in server.conf Thanks

PowerPacked · ‎11-01-2018

Hi sterlingteks Am not sure, if i understood your question correctly. If you want custom icons in Glass table, you can upload them Please go through this doc http://docs.splunk.com/Documentation/ITSI/4.0.2/User/BuildGlassTable#Upload_custom_icons Thanks

PowerPacked · ‎11-01-2018

Hi Guys, I would like to create new glass tables through Rest API calls. But, I am failing as I'm not able to pass proper arguments needed for POST action of API call of ITSI glass table. for example: curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/itoa_interface/entity -H "Content-Type: application/json" -X POST -d '{"component": ["PerProcess"],"informational": {"fields": ["info"],"values": ["field"]},"_version": "3.0.0","title": "PerProcess","object_type": "entity","_type":"entity","identifier": {"fields": ["component"],"values": ["PerProcess"]}}' This above call creates a new Entity in ITSI through Rest API call which is given in this doc: http://docs.splunk.com/Documentation/ITSI/3.0.1/RESTAPI/ITSIRESTAPIreference i would like to create a new Glass Table in this way. End point still not working in updated & new ITSI v 4.0 Help is appreciated Thanks

PowerPacked · ‎11-01-2018

Hi hjauch This issue was not fixed & end point is not working in new and updated ITSI 4.0 version. Please guys can you look and fix this issue at least in next release. Thanks

PowerPacked · ‎08-23-2018

Hi @nikita_p, did you try deleting and recreating the service,

PowerPacked · ‎08-20-2018

Hi @spharisha I think you are trying to send the whole file using curl command, & i feel like you should consider it by configuring inputs and send it to HEC index on indexer. Thanks

PowerPacked · ‎08-13-2018

Hi @ddrillic You can also forward the Introspection logs of forwarders forwarded to indexers. You will find info related to swap space usage in index=_introspection sourcetype=splunk_resource_usage component="hostwide" | rename data.* as * | fields swap swap_used Thanks

PowerPacked · ‎08-06-2018

Hi Please find the following image

PowerPacked · ‎08-06-2018

Hi @faizolsaidin Am not sure, if i understood your question correctly But you can give multiple eval statements in single eval like below, | eval a = case(Name LIKE "abc%efg%123" AND State="Running",1,Name LIKE "abc%efg%123" AND State!="Running",0), b = case(Name LIKE "abc%efg%456" AND State="Running",1,Name LIKE "abc%efg%456" AND State!="Running",0), c = case(Name LIKE "abc%efg%789" AND State="Running",1,Name LIKE "abc%efg%789" AND State!="Running",0) Thanks

PowerPacked · ‎07-27-2018

Hi @premranjithj There are actually number of considerations to implement ITSI, what is the system requirements ? Java to be installed on search heads as Anomaly Detection & Notable Events require it. Search Heads & Indexers to have good amount of RAM & CPU cores. Search Heads to be higher in version > 6.5. Forward Data from Search heads to indexers as ITSI data is stored in summary indexing. refer this doc for deployment planning, https://docs.splunk.com/Documentation/ITSI/3.1.1/Configure/DeploymentPlanning what all data will be needed to configure? You need to create Services and Entities. You need to create KPI'S which runs in Services and on Entities, which are used to calculate the Service Health Score of these Services. you can look at these series of docs to configure the Services, Entities & kpi's. https://docs.splunk.com/Documentation/ITSI/3.1.1/Configure/CreateService Thanks

PowerPacked · ‎07-26-2018

Hi @itbetter Can be a possibility that the field values are having invisible spaces, remove those spaces in the field values by index="kubernetes" | eval pod=trim(pod) | search pod="podname-3220973768-tr295" give a try with above search, hope it helps Thanks

PowerPacked · ‎07-26-2018

Hi @vin02 Splunk only writes about changes made to user & its roles, But it dont write what changes were made. index=_audit "action=edit_user" user=yourusername Thanks

PowerPacked · ‎07-26-2018

Hi @vin02 You can find info about password change in, index=_audit user=username "action=password change" & after password change, you can see info about login in index=_audit user=username action="login attempt" info=succeeded Thanks

Posts	161
Solutions	19
Karma Given	2
Karma Received	34
Member Since	‎02-14-2018

Online Status	Offline
Date Last Visited	‎01-31-2026 11:19 AM

InsecureRequestWarning in splunkd.log from Splunk ...

Difference between (_time) internal field and (tim...

In Splunk IT Service Intelligence(ITSI), how do I ...

use of eval statement in tokens evaluation

Create new ITSI Glass Table through - Rest API cal...

SSL Error for Connection between Forwarder and Ind...

What is this (search_startup_time) field in _audit...

How to measure Execution Latency of Ad-hoc Searche...

Where or into which System Index - Does Splunk wr...

Where are Glass tables Tables saved location which...

Re: How to define field alias on extracted fields?

Re: Can I get Splunk user activity alerts that inc...

Re: How do you extract a timestamp from JSON logs ...

Re: Do we need props.conf on the indexer when inde...

Re: Do we need props.conf on the indexer when inde...

Re: splunk won't find fields with hyphens

Re: How do I convert the date format in a custom f...

Re: Difference between (_time) internal field and ...

Re: Difference between (_time) internal field and ...

Re: Difference between (_time) internal field and ...

Re: Difference between (_time) internal field and ...

Difference between (_time) internal field and (tim...

Re: While setting up indexer clustering ... Do we ...

Re: ITSI Glass Tables

In Splunk IT Service Intelligence(ITSI), how do I ...

Re: Create new ITSI Glass Table through - Rest API...

Re: ITSI: Why does service created show N/A in ser...

Re: Send JSON file/txt file using HEC - stuck on c...

Re: Can we monitor the swap space usage on the for...

Re: How to create a rex for search?

Re: How to combine a few eval cases to a single se...

Re: Splunk ITSI configuration

Re: Splunk search fails with content that contains...

Re: How to track if assigned role has been changed...

Re: user changed his password and successfully log...

Join the Conversation