Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About raju4244
raju4244
Explorer
Member since:
11-13-2014
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 11-13-2014 |
Activity Feed
- Got Karma for Re: How to search unique values in field1 after removing duplicates and common values found in field2?. 06-05-2020 12:47 AM
- Got Karma for VMware app on Search head cluster environment. 06-05-2020 12:47 AM
- Posted In deploymentclient.conf, how can we use a variable to mention the hostname of the machine for the clientname entry? on Getting Data In. 09-09-2015 03:58 AM
- Tagged In deploymentclient.conf, how can we use a variable to mention the hostname of the machine for the clientname entry? on Getting Data In. 09-09-2015 03:58 AM
- Tagged In deploymentclient.conf, how can we use a variable to mention the hostname of the machine for the clientname entry? on Getting Data In. 09-09-2015 03:58 AM
- Tagged In deploymentclient.conf, how can we use a variable to mention the hostname of the machine for the clientname entry? on Getting Data In. 09-09-2015 03:58 AM
- Posted How to create a drilldown for specific dynamic values on a table? on Splunk Search. 08-20-2015 01:00 AM
- Tagged How to create a drilldown for specific dynamic values on a table? on Splunk Search. 08-20-2015 01:00 AM
- Tagged How to create a drilldown for specific dynamic values on a table? on Splunk Search. 08-20-2015 01:00 AM
- Posted Re: How to place the results of multiple unrelated searches into a table? on Splunk Search. 08-20-2015 12:10 AM
- Posted Re: How to place the results of multiple unrelated searches into a table? on Splunk Search. 08-16-2015 09:53 PM
- Posted How to place the results of multiple unrelated searches into a table? on Splunk Search. 08-13-2015 10:17 PM
- Tagged How to place the results of multiple unrelated searches into a table? on Splunk Search. 08-13-2015 10:17 PM
- Tagged How to place the results of multiple unrelated searches into a table? on Splunk Search. 08-13-2015 10:17 PM
- Posted Re: How to compare field3 with common and unique values from field1 and field2? on Splunk Search. 08-12-2015 10:36 PM
- Posted How to compare field3 with common and unique values from field1 and field2? on Splunk Search. 08-10-2015 11:00 PM
- Tagged How to compare field3 with common and unique values from field1 and field2? on Splunk Search. 08-10-2015 11:00 PM
- Tagged How to compare field3 with common and unique values from field1 and field2? on Splunk Search. 08-10-2015 11:00 PM
- Posted Re: How to search unique values in field1 after removing duplicates and common values found in field2? on Splunk Search. 08-10-2015 10:52 PM
- Posted Re: How to search unique values in field1 after removing duplicates and common values found in field2? on Splunk Search. 08-09-2015 10:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
09-09-2015
03:58 AM
Dear All,
In our environment, we are planning to push a splunkforwarder to a Windows server. Part of that, we are copying deploymentclient.conf file to each and every machine.
My requirement is,
In deploymentclient.conf, there is a entry for clientname=<hostname>.
How can we use a variable to mention the hostname of the machine for clientname entry.
Thanks
... View more
08-20-2015
01:00 AM
Dear Everyone,
I need some input for creating a drilldown on a table.
My Table will look like the image below
The table was created using multiple searches (used append and join commands), and the values are dynamic.
For Ex: Total Number of Computers is 200, AV is installed only on 102.
Now, my requirement is when we click 200, i should get a list of 200 hostnames. If I click on 102, I should get a list of 102 hostnames.
We created the list of hostnames on different dashboards, so we want to know how to use drilldown for this kind situation.
PS: All data comes from different sources. The searches we used to to make table don't have any relation with other.
... View more
08-20-2015
12:10 AM
Thanks, i used mix of join and append command to make it in single table
... View more
08-16-2015
09:53 PM
other append or join, do we have any other??
... View more
08-13-2015
10:17 PM
Dear All,
I have multiple searches with its results. Now I want to put values in a single table and that to be in particular column. Searches don't have any relationship to each other.
... View more
08-12-2015
10:36 PM
no, thats in diiferent source
... View more
08-10-2015
11:00 PM
Dear All,
I have one question. I have the data like below:
field1:
itema
itemb
itemb
itemc
itemd
iteme
iteme
field2:
itemc
itemd
itemd
iteme
mainfield
itemf
itemc
itemz
I used the search below to get common items and unique items on each fields (field1 and field2).
index=foo source=* | eval commonfield=coalesce(field1,field2) | stats values(source) as source by commonfield | table commonfield
Now I want to compare the common values from field1 and field2 with mainfield. I want to know what are the common items and unique items on commonfield and main field
All the data is in same index and sourcetype.
Thanks.
Raj
... View more
08-10-2015
10:52 PM
1 Karma
this worked after some modification, thanks to you.
... View more
08-09-2015
10:41 PM
it is only listing common items, not an unique items present in field1
... View more
08-07-2015
08:36 AM
They are from different sourcetype, i m trying to club them into one list.
Thanks.
... View more
08-07-2015
04:39 AM
Dear All,
I have one question. I have the data like below:
field1:
itema
itemb
itemb
itemc
itemd
iteme
iteme
field2:
itemc
itemd
itemd
iteme
I want to get the following in my search results:
Unique Items which are present in field1 (after removing duplicates and after removing common items present in both fields)
... View more
07-03-2015
06:09 AM
Dear All,
We have configured alert with Inline as table, when we see the mail in big monitor what ever the tables in the mail displays properly. When we see the same mail in smaller screen, the events that are in tables gets shrink and we are unable to read it properly. It is look like, it is happening because of responsive nature of the mail.
How do i disable responsive nature on the mail alert ??.
... View more
07-01-2015
08:18 AM
Hi Masa,
So, we have to use our dedicated SH ( scheduler) for both data collection and for all our dashboards??
... View more
07-01-2015
08:01 AM
I saw the video of installing VMware app, wherein it is saying VMware app can be installed on dedicated search head and can configure the app to get a API logs of VMware vCenter
We can use clustered SH only for dash board purpose.
This is my plan, what will be your input on this
... View more
07-01-2015
03:11 AM
1 Karma
In our environment, we have Search Head cluster and indexer clustering with Master Server/deployment server. We referred the documentation, but we did not find any topic wherein it is showing deploying vmware apps on Search Head clustering, rather there was document on deploying app on Search Head pooling, which is not applicable to us.
Appreciate if any one can provide any configuration guide or any steps.
... View more
06-11-2015
01:16 AM
Hi,
i can not uses second table options, as i require raw event.
First can be used, i need to try out.
I feel no issue with search result, as we are getting alert properly when the bad login happens.
Only thing is the report that comes in the mail does not have all raw event.
If there is a 5 bad login event, im expecting raw event of 5 line in the mail.
FYI, The following is my search queries, i have search queries with required fields, nothing more than that.
my_base_search_with_fields
It runs every 5 min, and Alert condition is If number of event is greater than 2 . Alert mode is once per result with throttling of 5 min and Field throttling with my fields (User,Server,IP).
When i use these throttling field i get only one raw event in mail when bad login happens and at the same time when i see the result it shows all the events properly.
I just want to know how do i get a all raw event in mail when throttling field is used???
... View more
06-10-2015
09:12 PM
Hi,
I have created an alert with a per result throttling field enabled. This is to get an alert in case of any bad login attempts by the same user, from the same desktop, and to the same destination for more than two times.
In the alert, i have chosen to get a raw event in my email. Whenever a bad login happens, i get an alert with the one line of raw event instead of three or more.
How do i get a all raw event data related to this alert by email?? or do we have any other option to get an email with all raw events whenever a bad login happens which suffices my requirement??
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
