Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About ips_mandar
ips_mandar
Builder
Member since:
02-02-2018
07-02-2024
Community Statistics
| Posts | 294 |
| Solutions | 5 |
| Karma Given | 34 |
| Karma Received | 14 |
| Member Since | 02-02-2018 |
Activity Feed
- Karma Re: TA-webtools disable multiple alerts/reports for jkat54. 07-11-2022 07:46 PM
- Posted Re: How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-11-2022 07:45 PM
- Posted Re: How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-11-2022 07:44 PM
- Posted How to use TA-webtools to disable multiple alerts/reports? on Knowledge Management. 07-07-2022 10:33 PM
- Got Karma for Re: use of streamstats over transaction command. 05-11-2022 02:52 PM
- Posted Re: Deployment Server Connection Errors on Deployment Architecture. 04-22-2021 01:10 AM
- Posted index time extracted field vs summary index field on Splunk Enterprise. 02-08-2021 10:20 AM
- Got Karma for report cannot be accelerated. 01-30-2021 09:32 AM
- Posted get response time of spl query on Splunk Enterprise. 01-19-2021 02:24 AM
- Posted Re: transition from local splunk authentication to saml authentication on Splunk Enterprise. 01-08-2021 06:38 AM
- Posted transition from local splunk authentication to saml authentication on Splunk Enterprise. 01-07-2021 11:14 PM
- Karma Re: can batch_search_max_pipeline increase on standalone server for richgalloway. 01-05-2021 04:10 AM
- Posted Re: report cannot be accelerated on Reporting. 01-04-2021 06:58 AM
- Posted report cannot be accelerated on Reporting. 01-04-2021 02:52 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 10:46 PM
- Karma Re: get max value before becoming zero and last value for renjith_nair. 12-17-2020 10:44 PM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 02:53 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-17-2020 12:21 AM
- Posted Re: get max value before becoming zero and last value on Splunk Enterprise. 12-16-2020 11:57 PM
- Posted get max value before becoming zero and last value on Splunk Enterprise. 12-16-2020 10:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-10-2019
09:00 AM
Thanks a lot @FrankVI
If I create local drive as suggested then does it will impact performance?
I will test and keep you posted.
thanks.
... View more
07-10-2019
07:50 AM
Hi @adonio @gcusello ,
System has permission and I can view all files from network drive..it is network shared drive and it is not present in same system where splunk is installed. Network>abcstorage>xyz
... View more
07-10-2019
04:48 AM
I have one server A which is network connected to Server B where Splunk is installed, and I want to monitor a few folders present in Server A without installation of universal forwarder due to some restrictions.
I am on Windows OS and I can browse to that folder and can read folder files from file explorer by following path- \\abcstorage\xyz
Now to monitor this in Splunk what path needs to be mentioned in splunk inputs.conf?I tried below inputs, but am still unable to monitor.
[monitor:////abcstorage\xyz\*.zip]
disabled = false
index = xyz
sourcetype = abc
ignoreOlderThan = 1d
Thanks.
... View more
Labels
- Labels:
-
universal forwarder
-
Windows
07-09-2019
12:21 AM
Thanks @woodcock
It will work if I use |reverse before streamstats command since i see latest event first but I want to see it in reverse order since all data inserted in log file in that manner.
Is there any other way by which I can avoid |reverse command since it has performance impact. below query currently I am running.
...|reverse| streamstats last(name) AS name BY source
... View more
07-07-2019
11:52 PM
Thanks @woodcock but I want this filldown to work per source
I tried | filldown name by source but it won't work.
... View more
07-07-2019
11:52 PM
Thanks @niketnilay but I want this filldown to work per source
I tried | filldown name by source but it won't work.
... View more
07-05-2019
04:32 AM
Below result I was expecting
7/5/2019 04:24:00 name=test
7/5/2019 04:24:00 dcsdc ,name=test
7/5/2019 04:24:00 dsac,z="121",name=test
7/5/2019 04:24:00 asdc,name=test
7/5/2019 04:24:00 name=sample
7/5/2019 04:24:00 uujy,name=sample
7/5/2019 04:24:00 yuujj,z="156",name=sample
7/5/2019 04:24:00 ujyku,name=sample
... View more
07-05-2019
04:11 AM
I have below sample events-
7/5/2019 04:24:00 name=test
7/5/2019 04:24:01 dcsdc
7/5/2019 04:24:02 dsac,z="121"
7/5/2019 04:24:03 asdc
7/5/2019 04:24:04 name=sample
7/5/2019 04:24:05 uujy
7/5/2019 04:24:06 yuujj,z="156"
7/5/2019 04:24:07 ujyku
So here I want to apply name=test field value to below event till new name field will found then similarly I want to apply name=sample to below event till next name field will find.What is the best way to do this currently I am using transaction command.
so that I can get value of z for which what is name by grouping ...is there any other way?
I want to apply this per source field
... View more
- Tags:
- splunk-enterprise
06-28-2019
12:29 AM
Thanks @niketnilay
Similarly I was checking in our prod server which is in EDT timezone
and I selected dropdown value 26 June 2019 08:00 and check epoch time which was "1561516200"
then converted time and i see as-
06/25/2019 22:30:00Eastern Daylight Time
But difference between UTC and EDT is 4 hours so if I try to add 4 hours then it will not give 26 June 2019 08:00 ?
So the epoch value got from input time is in which timezone?
To get required results i.e. 26 June 2019, I have to add 9 hours 30 min i.e. 34200 to epoch value
... View more
06-27-2019
09:46 PM
@niketnilay any pointers here please.. I really unable to understand ..
... View more
06-27-2019
09:23 PM
@amitm05 I made below sample xml where I am selecting by default time and input time it will show as Since 26 Jun 2019 08:00
and I parsed this epoch time using strftime to make it readable format and checking in field- reflectedtime but it shows different time instead of same 26 June 2019 08:00..please see screen shot
<form>
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="time_tok" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>1561536000</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>token=$time_tok.earliest$</title>
<table>
<search>
<query>| makeresults
| eval reflectedtime=$time_tok.earliest$
| eval reflectedtime=strftime(reflectedtime, "%Y-%m-%d %H:%M:%S.%N%Z")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
... View more
06-27-2019
06:19 PM
Thanks @amitm05 ..Did you tried exact my xml which I pasted here since in that, token is getting updated in title just retested again...
basically in my actual query I am not trying to use in earliest and latest tag since I want to use earliest epoch value to compare with one field which is other than _time field so I am using epoch value but the problem is if I convert this epoch value I am not getting exact date and time set in time token...
... View more
06-27-2019
10:11 AM
Hi, I am facing a timestamp issue.
I have created one sample dashboard below
<form>
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="time_tok" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>token=$time_tok.earliest$</title>
<table>
<search>
<query>index=_internal |stats count by host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
and I have selected time range from input->Date and Time Range-> Since 26 Jun 2019 08:00
and I have copied it's epoch value from panel title where this value is set.
Then I run below sample search:
| makeresults
| eval time="1561536000.000"
| eval time=strftime(time, "%Y-%m-%d %H:%M:%S.%N%Z")
Please change time value as per dashboard token value from panel title.
Now I was expecting the result to be the same as time input set (i.e. 26 Jun 2019 08:00) but that it's giving a different time...
I tested in Splunk version 7.2 and 7.3 still the same issue...
Is this bug or I am misunderstanding it. Please guide.
... View more
06-17-2019
02:14 AM
Thanks @richgalloway I will give this try and will keep posted.
... View more
06-17-2019
02:13 AM
Thanks @woodcock
For example I have below props.conf
SEDCMD-aremoveheader = s/^\<\?xml[^\>]*\>\n*//g
Then What I need to write in script to run above in script(will it by .py ?).
Note: the above props.conf is in Indexer and if I run only |sed "" using script it will not fetch the data from remote server. Since I want to fetch data from remote server.
... View more
06-14-2019
06:47 AM
Thanks @richgalloway Can you please help me with sample script like python . for example I have csv file in which I want only field 2 ,field 3 ,field 5 to be extracted... Since I never written any script can you please help to provide sample script which will work like mentioned above.
... View more
06-14-2019
03:41 AM
I want to discard few fields from monitoring input so not increase license usage
What will be best way to do it
It can be possible with SEDCMD but I am trying to know using scripted input
I am newbie in script writing ..can anyone guide me to write python script to take only required data in splunk.
What are the stepsto follow?
Thanks in advance. I am using Splunk 7.3 on Windows server.
... View more
06-12-2019
05:36 AM
Hi
This would be better way to regex
|rex field=url ".*(zip|doc|docx|xls|xlsx|pdf)$"
Assuming this url is stored in url fieldname
... View more
06-12-2019
05:08 AM
1 Karma
I am Splunk version 7.3.0 and splunk DB connect app version 3.1.4 . Does This version is compatible with Splunk Version? and I am using mysql server from which I am fetching data.
Since I have created identity and connection and now when I try to create input I tried below query for rising column input
SELECT * FROM `sakila`.`address` WHERE last_update > ? ORDER BY last_update ASC
But When I tried below query for Batch input it works fine
SELECT * FROM `sakila`.`address` WHERE last_update > 0 ORDER BY last_update ASC
For rising input I am considering checkpoint value as 1/1/1970 00:00:00.000 and when I try to execute query it gives error as- java.sql.SQLException: No value specified for parameter 1
What could be an issue Please help me.
... View more
06-12-2019
12:54 AM
My bad
I need to give hostname as localhost and updated driver version .
Now I am able to save connection.
... View more
06-12-2019
12:31 AM
Hi
I have installed mysql server database on server where splunk is installed.
In Splunk DB connect I have created identity and saved it . Now I was created new connection where
Connection Type - MySQL
Host - local
Port - 3306 (by default)
Default Database- Here What I need to give since I tried giving schema name but when I tried to save it gives me error
that connection is invalid
https://imgur.com/2BxpSQD
What I am missing here...
... View more
06-11-2019
02:24 AM
but below query will not give desired result of _time as yesterday
|makeresults
| eval source="dffgfXYLog09229190611.txt"
| eval _time="1560136057",a=substr(source,len(source)-9,6),inputDate= substr(source,len(source)-9,6),inputDateEpoch=strptime(inputDate,"%y%m%d"),dateFromEvent=strftime(_time,"%y%m%d"),dateFromEventEpoch=strptime(dateFromEvent,"%y%m%d"),inputDateDelta=dateFromEventEpoch-inputDateEpoch,_time=_time-inputDateDelta
... View more
06-11-2019
01:47 AM
also how _time will automatically picks timestamp as in event only day of month is mentioned.
basic concept is file is copied in one folder where the files will contain data of yesterday/day before yesterday and this folder is monitored in splunk.
exact day only can be identified from each event and in event only day is mentioned and no month or year.
... View more
06-11-2019
01:43 AM
Thanks @DavidHourani Appreciate your answer..
Does it will satisfy all condition ? As I checked another example
|makeresults
| eval source="dffgfXYLog09229190611.txt"
| eval _time="1560136057",a=substr(source,len(source)-9,6),inputDate= substr(source,len(source)-9,6),inputDateEpoch=strptime(inputDate,"%y%m%d"),dateFromEvent=strftime(_time,"%y%m%d"),dateFromEventEpoch=strptime(dateFromEvent,"%y%m%d"),inputDateDelta=dateFromEventEpoch-inputDateEpoch,_time=_time-inputDateDelta
Here I considered source field as today's date and event _time as yesterday then it should give me manipulated _time as yesterday but it won't.
Basic understanding is in file name 1-5 days above in name while event will always be behind 1 -5 days .
so basically I want event time as _time .
... View more
06-10-2019
06:56 PM
Hi
my events looks like-
31,04:56:47:928, abc:0xabc, 49.716720, -59.271553,197
30,04:56:47:928, abc:0xabc, 49.716720, -59.271553,197
where 31 OR 30 is day of month
and source field looks like - D:\\abc\\def\\XYLog09229190601.txt.zip:.\\XYLog09229190601.txt
from source- XYLog09229190601.txt I can know 190601 i.e. 01 June 2019
So by which way I can get _time as for first event as 31 MAY 2019 and for second event as 30 May 2019?
where day is extracted from event and month is manipulated as the events are always of previous 1-5 days than it shows date in source field.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
03:02 PM
|
Karma given to
