Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About PowerPacked
PowerPacked
Builder
Member since:
02-14-2018
05-19-2022
Community Statistics
| Posts | 161 |
| Solutions | 19 |
| Karma Given | 2 |
| Karma Received | 34 |
| Member Since | 02-14-2018 |
Activity Feed
- Got Karma for Re: How to install splunk app through Linux terminal?. 01-08-2025 12:59 PM
- Got Karma for Re: Splunk Restart Tracking. 04-27-2024 08:31 PM
- Got Karma for Re: Is there a way to list all the Services and its KPI's in ITSI Box. 01-11-2024 02:12 AM
- Got Karma for Re: How to install splunk app through Linux terminal?. 02-05-2023 10:13 AM
- Got Karma for Re: creating a new field using Regex. 08-01-2022 08:38 AM
- Got Karma for Re: How to populate fields from two indexes that share one field. 03-29-2022 04:16 PM
- Got Karma for Re: Is there a way to list all the Services and its KPI's in ITSI Box. 01-28-2022 12:59 PM
- Got Karma for Re: Do we need props.conf on the indexer when indexing a csv file?. 07-12-2021 09:17 AM
- Got Karma for Re: Splunk Restart Tracking. 06-14-2021 12:44 AM
- Got Karma for Re: Is there a way to list all the Services and its KPI's in ITSI Box. 03-17-2021 12:12 AM
- Got Karma for Re: How to control the default in a dropdown menu. 02-04-2021 07:06 PM
- Got Karma for Re: Splunk Restart Tracking. 10-06-2020 02:09 PM
- Got Karma for Re: Can I get Splunk user activity alerts that include dashboard used?. 06-05-2020 12:50 AM
- Got Karma for Re: How to get field count rather than stats count?. 06-05-2020 12:50 AM
- Karma Re: Create new ITSI Glass Table through - Rest API call for hjauch_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: Is it possible to list out empty index. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk ITSI configuration. 06-05-2020 12:49 AM
- Got Karma for Re: Why am I not able to access the Splunk web server?. 06-05-2020 12:49 AM
- Got Karma for Re: How to execute a script and display results on a search page?. 06-05-2020 12:49 AM
- Got Karma for What is this (search_startup_time) field in _audit index ?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
05-22-2018
09:18 AM
Hi @EricLloyd79
Can you give this search a try
index=_internal source=*license_usage.log type=Usage earliest=-1d@d latest=-0d@d | bucket _time span=1d | stats sum(eval(b/1024/1024/1024)) as GB by _time
Thanks
... View more
05-21-2018
04:19 PM
can you try this search, for some reason this page is trying to take out the wildcards mentioned in the below search
sourcetype="audit" subject=abcd | eval SUB1=(split(resource," ")),baseurl=mvindex(SUB1,0) | eval URL="https://".baseurl.requestUri | transaction subject| sort _time | streamstats list(timestamp) as time_stamp,list(proxyRoundTripMS) as Application_Responsetime ,list(applicationName) as application,list(URL) as URL_Path by subject, applicationName | table subject, time_stamp, application, URL_Path, Application_Responsetime | search URL_Path!=*.css AND URL_Path!=*.gif
Thanks
... View more
05-21-2018
02:50 PM
Hi @rakeshyv0807
If the results are extracted into a field called URL --- use the below search
your search | search URL_Path! = *.css AND URL_Path! = *.gif
Thanks
... View more
05-17-2018
03:00 PM
Approve the answer, if this helps you.
Thanks
... View more
05-17-2018
02:59 PM
Splunk URL is the URL on which Insights is installed.
HEC Port --- default port is 8088
HEC Token --- you will find this in --- Insights installed Host --- etc/apps//splunk_app_infrastructure/local/inputs.conf
Approve the answer if this helpfull for you.
Thanks
... View more
05-16-2018
05:02 PM
4 Karma
Hi @vicky05ssr
Please use this search, it will list all the Service and KPI's associated with it.
| inputlookup service_kpi_lookup | rename title as ServiceTitle kpis.title as KPITitle | stats count by ServiceTitle, KPITitle | mvcombine KPITitle
Thanks
... View more
05-16-2018
04:53 PM
Hi @Siva
You can download collectd manually as well.
https://s3-us-west-2.amazonaws.com/ittm-agentscript/unix-agent-0.9.0-0.tgz
curl -sL -o unix-agent-0.9.0-0.tgz https://s3-us-west-2.amazonaws.com/ittm-agentscript/unix-agent-0.9.0-0.tgz && tar -xzf unix-agent-0.9.0-0.tgz && cd unix-agent && bash install_agent.sh && bash install_uf.sh && cd .. && rm -rf unix-agent
you need to configure collectd by editing collectd.conf
write HttpPlugin in collectd.conf should have information about the Host on which Insights is installed.
... View more
05-09-2018
03:32 PM
Hi @darsimendy
I didn't understand your requirement properly but give this a try.
Your Search | timechart span=1m values(FieldA) values(FieldB)
Thanks
... View more
05-09-2018
02:36 PM
Hi @Amandeepsin
The _introspection index data is splunk's internal metrics regarding HEC performance and connection.
You need to check the own index into which the data is coming in.
Here is the sample event.
Thanks
... View more
05-09-2018
02:26 PM
4 Karma
Hi @mbasharat
Please use these searches
index=_audit action=restart_splunkd | stats c by user
index=_audit action=splunkStarting
index=_audit action=splunkShuttingDown
for UI restart its writes in Splunkd_stdout.log
index=_internal sourcetype=splunkd_stdout
Thanks
... View more
05-03-2018
10:49 AM
Hi @wilcoxj
Please see this Regex & also i think you need to break this event properly into mutiple events.
Thanks
... View more
05-01-2018
07:01 PM
You can also delete data from KVstore using REST API
Please look at this doc.
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
Delete the record with the key ID " 5410be5441ba15298e4624d1":
curl -k -u admin:changeme -X DELETE \
https://localhost:8089/servicesNS/nobody/kvstoretest/storage/collections/data/kvstorecoll/5410be5441ba15298e4624d1
if you don't have permissions to the box - then use the Rest command in UI
... View more
05-01-2018
06:48 PM
| Inputlookup 123.csv --- for to look into the csv file
| lookup 123.csv host as hostname output Ipaddress ------ for to update the events with similar fields in both csv and events.
To update the CSV file - | inputlookup 123.csv | changes | outputlookup 123.csv append=(true or false)
append = true will keep the common fileds in file and search results & also extra fields in CSV file.
append = false will keep the common fileds in file and search results & remove extra fields from CSV and add extra fields from Search Results.
& also refer to this doc
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Outputlookup
Thanks
... View more
04-30-2018
02:30 PM
1 Karma
Hi mr_t2083
Please use this REX,
am uploading pic as this page will try to remove some characters from REX if directly posted.
& if you want to apply Rex to field itself, refer to this second pic
Thanks
... View more
04-12-2018
09:17 AM
Please use trim command to remove the ms in the field values.
sourcetype="somesourcetype" search phase | eval Newf1=trim(f1,"ms") | stats avg(Newf1) as Average
& and do this for Alert
sourcetype="somesourcetype" search phase | eval Newf1=trim(f1,"ms") | stats avg(Newf1) as Average | where Average > 100
Thanks
... View more
04-11-2018
06:47 PM
Please check with the Regex you wrote & there can be chances of failure in the earlier query as well.
Like check if index=test host=rider2*58* APP=TEST is populating any events.
& it would be helpfull, if you provide us a sample event which contains all the field values.
Thanks
... View more
04-11-2018
06:43 PM
Use this Rex to extract
This splunk answers page will replace the fieldname in between REX, so adding up the image
Thanks
... View more
04-11-2018
04:45 PM
Hi All
Below are the Errors I see in Splunkd.log of Forwarder and Indexer.
& trying to figure out how to fix these.
Indexer:
04-11-2018 23:17:41.461 +0000 ERROR TcpInputProc - Error encountered for connection from src=FORWARDERIP:xxxx. error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate
Forwarder:
04-11-2018 16:23:44.127 -0700 ERROR TcpOutputFd - Read error. Connection reset by peer
04-11-2018 16:23:44.137 -0700 ERROR TcpOutputFd - Read error. Connection reset by peer
04-11-2018 16:23:44.137 -0700 WARN TcpOutputProc - Applying quarantine to ip=INDEXERIP port=9997 _numberOfFailures=2
04-11-2018 16:24:26.550 -0700 WARN TcpOutputProc - Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group splunk-app-infra-autolb-group has been blocked for 100 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.
04-11-2018 16:25:13.704 -0700 INFO TcpOutputProc - Removing quarantine from idx=INDEXERIP:9997
Thanks All
... View more
04-06-2018
11:33 AM
Can you explain what do you mean by all data in the above question ?
... View more
04-06-2018
09:57 AM
add this to Dashboard XML to get the Hostname values as dropdown
<label>Select a hostname :</label>
<choice value="null">Choose hostname</choice>
<query>Your search | stats count by hostname | sort hostname</query>
</search>
<fieldForLabel>hostname</fieldForLabel>
<fieldForValue>hostname</fieldForValue>
</input>
... View more
04-06-2018
09:50 AM
Hi @cyler
You can show values of only one field not all the fields & in your scenario its Hostname Values.
The Box your are showing in the dashboard is Input Tab where you give the Input and Dashboard or Form populates based on the Input you given in that tab.
Thanks
... View more
04-06-2018
09:43 AM
1 Karma
Possible Reasons
- different timezones
- Field Extractions, or some other knowledge Objects not shared with you.
... View more
04-05-2018
04:01 PM
Use this search
Your search | rex field=dst "(?P\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}):" | stats count by IP_Only
... View more
04-05-2018
01:32 PM
Thanks Again @splunker12er
I am not looking at how much time it took for a search to complete.
I am looking at if any searches got queued and whats the que time
for example: this search shows what is the execution latency (Que Time) of Scheduled Searches
index=_internal sourcetype=scheduler (status="completed" OR status="skipped" OR status="deferred")
| eval window_time = if(isnotnull(window_time), window_time, 0)
| eval execution_latency = max(dispatch_time - (scheduled_time + window_time), 0)
| timechart span=1h partial=f avg(execution_latency) AS avg_exec_latency, count(eval(status=="completed" OR status=="skipped")) AS total_exec, count(eval(status=="skipped")) AS skipped_exec
| eval skip_ratio = round(skipped_exec / total_exec * 100, 2)
| eval avg_exec_latency = round(avg_exec_latency, 2) | fields _time, avg_exec_latency
But am not able to find one similar for Ad Hoc searches
... View more
04-05-2018
09:31 AM
Use this REX to extract only IP from it.
| rex field=_raw "(?P\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}):"
Thanks
... View more
- « Previous
- Next »
