Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ips_mandar
ips_mandar
Builder
Member since:
02-02-2018
07-02-2024
Community Statistics
| Posts | 294 |
| Solutions | 5 |
| Karma Given | 34 |
| Karma Received | 14 |
| Member Since | 02-02-2018 |
Activity Feed
- Karma Re: TA-webtools disable multiple alerts/reports for jkat54. 07-11-2022 07:46 PM
- Posted Re: How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-11-2022 07:45 PM
- Posted Re: How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-11-2022 07:44 PM
- Posted How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-07-2022 10:33 PM
- Got Karma for Re: use of streamstats over transaction command. 05-11-2022 02:52 PM
- Posted Re: Deployment Server Connection Errors on Deployment Architecture. 04-22-2021 01:10 AM
- Posted index time extracted field vs summary index field on Splunk Enterprise. 02-08-2021 10:20 AM
- Got Karma for report cannot be accelerated. 01-30-2021 09:32 AM
- Posted get response time of spl query on Splunk Enterprise. 01-19-2021 02:24 AM
- Posted Re: transition from local splunk authentication to saml authentication on Splunk Enterprise. 01-08-2021 06:38 AM
- Posted transition from local splunk authentication to saml authentication on Splunk Enterprise. 01-07-2021 11:14 PM
- Karma Re: can batch_search_max_pipeline increase on standalone server for richgalloway. 01-05-2021 04:10 AM
- Posted Re: report cannot be accelerated on Reporting. 01-04-2021 06:58 AM
- Posted report cannot be accelerated on Reporting. 01-04-2021 02:52 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 10:46 PM
- Karma Re: get max value before becoming zero and last value for renjith_nair. 12-17-2020 10:44 PM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 02:53 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 12:21 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-16-2020 11:57 PM
- Posted get max value before becoming zero and last value on Splunk Enterprise. 12-16-2020 10:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-13-2019
10:30 AM
Yes @FrankVl I have Splunk setup on on-premise as well on azure cloud . And I am integrating on-premise data with splunk on azure so that I will get consolidated view on azure cloud.i.e. both on-prem and cloud data in one place. that's what my final goal is.
as of now I want all on-prem data to be feed in cloud irresoecive of it is indexed in on-prem as in future on-prem splunk solution may closed.
... View more
02-13-2019
06:58 AM
Thanks @FrankVl .
lets suppose some data I want in on-premise Splunk and same data over cloud then if I make sendCookedData=false then it will not send cooked data isn't it?
also is there anything which I need to consider?
... View more
02-12-2019
02:34 AM
Hi @sylbaea ,
How can I get data from Syslog server into splunk? Can you please help me ..
... View more
02-11-2019
03:55 AM
How can I integrate on-premise Splunk data with splunk on azure cloud.I just wanted High level view like if I can get data from on-premise by installing universal forwarder or need HF in on-prem as well. On Azure cloud I have multisite splunk architecture.
is there any latency which I need to consider etc.
Thanks,
... View more
- Tags:
- splunk-enterprise
02-11-2019
03:50 AM
Thanks @sylbaea
... View more
02-10-2019
10:11 PM
1 Karma
Hi
I want to integrate Microsoft Cloud app security with Splunk, is there any add-on available?
Which fields are required to integrate with Splunk and how?
Thanks,
... View more
02-08-2019
07:25 AM
Thanks for comment @woodcock
But I am not using cluster environment and using distributed environment and set props.conf in Heavy forwarder
... View more
02-08-2019
07:17 AM
great!! Now I can able to see data..Thanks @thambisetty
I checked again on splunk base for endpoint url but it was up till api/alert- https://wdatp-alertexporter-eu.windows.com/api/alerts I think this needs to be updated .
once again thanks a lot.
... View more
02-08-2019
06:39 AM
@thambisetty sorry for tagging different add-on (updated in question)and yes I am using the same addon which is developed by you-
https://splunkbase.splunk.com/app/4128
I did followed the instruction ..could you please answer above questions and help me to understand if I am missing something
thanks.
... View more
02-08-2019
03:02 AM
Hi
I already have Log Analytics add-on installed and it is working fine and able to get oms logs. and now new requirement has came to get Windows defender ATP logs in splunk and I have configured input in it but unable to receive data in splunk.
1. Is it due to log analytics is using port 443 and same port is trying to use by TA for Microsoft Windows Defender? If yes then how can I change port ?
2. Is it required to set proxy?
3. Is it required to set SSL connection ON? when it is required to set as by default SSL is set to true?
4. I am getting below log -
2019-02-08 11:02:39,280 DEBUG pid=15232 tid=MainThread file=connectionpool.py:_make_request:400 | https://wdatp-alertexporter-eu.securitycenter.windows.com:443 "GET /api/Alerts//api/alerts?sinceTimeUtc=2019-02-01%2011:02:39.097000 HTTP/1.1" 404 1245
From here I thought might be it is trying to use same port 443? also does 404 here means not found?
also Endpoint url which i am using is slightly different-https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts
@thambisetty could you please give me insight here..
Thanks,
... View more
02-04-2019
10:22 PM
thanks for comment @woodcock
Yes I have already changed DateTime_config to this -
DATETIME_CONFIG = /etc/system/local/datetime.xml
and placed datetime.xml file in system/local path.
but still unable to parse timestamp from source file.
... View more
02-04-2019
07:26 AM
Thanks @woodcock.. But My source file is for ex. 20190128T06:14:25.json .It is in format %Y%m%dT%H:%M:%S so I removed - as below but still it won't work.Not sure whats the issue.
<datetime>
<define name="_timeAndDateFromFilename_date" extract="year, month, day">
<text><![CDATA[source::.*?(\d{4})(\d{2})(\d{2}T)]]></text>
</define>
<define name="_timeAndDateFromFilename_time" extract="hour, minute, second">
<text><![CDATA[source::.*?T(\d{2}):(\d{2}):(\d{2})]]></text>
</define>
<timePatterns>
<use name="_timeAndDateFromFilename_time"/>
</timePatterns>
<datePatterns>
<use name="_timeAndDateFromFilename_date"/>
</datePatterns>
</datetime>
... View more
01-31-2019
07:18 AM
It seems to be bug to parse %Y%m%dT%H:%M:%S this format timestamp from source value
... View more
01-31-2019
07:16 AM
@sowings Thanks and I agree with you ..
i have already fixed props.conf with /etc/system/local/datetime.xml
and regarding regex I tried various combination but unable to succeed with any regex could you please help me to write regex to extract from source.
recently I tried below regex but unable to get success
<text><![CDATA[(?:source::).*?(?<!\d|\d\.|-)(?:20)?([901]\d)(0\d|1[012])([012]\d|3[01])(?!\d|-| {2,})[.T]?([01]\d|2[0123])[:]([0-6]\d)[:]([0-6]\d)(?:\.?(\d+))?]]></text>
... View more
01-31-2019
06:19 AM
here for example I shown Build but there can be Build and Deploy under Type
... View more
01-31-2019
06:03 AM
Thanks for comment @jkat54
but if I try this |stats values(Time) as Time by _time Type|mvexpand Time
i will get below result
_time Type Time
29/01/2019 12:01 Build 2
29/01/2019 12:01 Build 3
29/01/2019 12:01 Build 4
29/01/2019 12:12 Build 5
and If i plot line chart it will have legend as Time and Type instaead of value of Type i.e. Build
I want result as-
_time Build
29/01/2019 12:01 2
29/01/2019 12:01 3
29/01/2019 12:01 4
29/01/2019 12:12 5
... View more
01-30-2019
11:59 PM
Thanks for comment @petom . But it won't help to populate Timestamp from source..I also tried below but it also won't help-
<text><![CDATA[(?:source::).*?(?<!\d|\d\.|-)(?:20)?([901]\d)(0\d|1[012])([012]\d|3[01])(?!\d|-| {2,})[.T]?([01]\d|2[0123])[:]([0-6]\d)[:]([0-6]\d)(?:\.?(\d+))?]]></text>
I tried various combination but none of them help to populate timestamp from source .
... View more
01-30-2019
09:43 PM
So Type is fieldname and it's value can be Build or Deploy or both .
After Running this query-
index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type
I got below results-
_time Build
29/01/2019 12:01 2
3
4
29/01/2019 12:12 5
But I want to have seggregated result like
_time Build
29/01/2019 12:01 2
29/01/2019 12:01 3
29/01/2019 12:01 4
29/01/2019 12:12 5
This can be achieved using mvexpand Build but Build value is not fixed. so is there any other way..
... View more
01-28-2019
10:26 PM
Hi I am trying below query to plot line chart-
index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type
Here there can be multiple Type values.
my problem is some _time field has multivalue Time field due to which it is not plotted on graph and I am not able to use mvexpand on Type because Type value is not fixed .
my output looks like below
_time Build
29/01/2019 12:01 2
3
4
29/01/2019 12:12 5
from above only 5 value is getting plotted and others are not seen due to multivalue and here I can not apply mvexpand Build as this value can change
... View more
- Tags:
- splunk-enterprise
01-28-2019
08:21 AM
Hi @lakshman239,
INGEST_EVAL is for recent version but my version is 7.1.2 where it is not applicable.
Also I tried below-
<datetime>
<!-- [2012/06/01 8:54:21.599] 20190128T06:14:25.json-->
<define name="_datetimeformat2" extract="year, month, day, hour, minute, second">
<text><![CDATA[(?:^|source::)^(\d{4})(\d{2})(\d{2})T(\d{2}):(\d{2}):(\d{2})]]</text>
</define>
<timePatterns>
<use name="_datetimeformat2"/>
</timePatterns>
<datePatterns>
<use name="_datetimeformat2"/>
</datePatterns>
</datetime>
but still I am getting error as-
Uncaught exception in Aggregator, skipping an event: Error parsing regex XML file: F:\Splunk\etc\apps\search\default\datetime.xml - Couldn't find 'timePatterns' in config data for AggregatorProcessor. - data_source="20190128T16:15:23.json
... View more
01-28-2019
05:52 AM
Hi everyone,
Can someone tell me what I'm suppose to edit in my datetime.xml file for my custom date and time to be recognized in Splunk?
I want to extract date and time from my source field which is like this- 20190128T06:14:25.json IT is in format %Y%m%dT%H:%M:%S
I tried below but it won't help-
<define name="_masheddate4" extract="year, month, day">
<text><![CDATA[(?:^|source::)^(\d{4})(\d{2})(\d{2})]]></text>
</define>
<define name="_mashedtime4" extract="hour, minute, second">
<text><![CDATA[(?:^|source::)^.{9}(\d{2})]]></text>
<use name="_hour"/>
<text><![CDATA[(?:^|source::)^.{12}(\d{2})]]></text>
<use name="_minute"/>
<text><![CDATA[(?:^|source::)^.{15}(\d{2})]]></text>
<use name="_second"/>
</define>
in props.conf
[mysourcetype]
DATETIME_CONFIG = F:\Splunk\etc\apps\search\default\datetime.xml
My Splunk version is 7.1.2 and windows OS.
... View more
01-21-2019
11:17 PM
Hi all
I want to encrypt my Password using splunk.secret key for IMAP mailbox app for windows OS.I already gone through this post-
https://answers.splunk.com/answers/215283/how-to-use-encrypted-passwords-in-imap-mailbox-app.html but it won't help me.
Anyone knows how to encrypt password in Windows OS to use in imap.conf file for IMAP app..
or is there any other app to get email messages in splunk. My Splunk version is 7.1.2
Thanks.
... View more
01-08-2019
03:15 AM
HI,
I have dedicated serach head for ITSI on windows OS. I have ITSI version 4.0.4 and I have installed Java SE Development Kit 8. But when itry to create notable event aggregation policies then multiple java instance are running which in turn CPU utilization goes to 100.
so what can be issue due to which multiple java process are running?
I would appreciate any ideas?
it seems hardware is enough but not understand about multiple java instance..
Thanks
... View more
12-24-2018
03:16 AM
thanks @whrg
it is working at search time..
also to work at indextime if I remove all strange symbols before and after json data then simple spath command also might work.
Can you please help me to remove all strange symbols before indexing so it can parse the json data at indextime
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
03:02 PM
|
Karma given to
