Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ayushchoudhary
ayushchoudhary
Path Finder
Member since:
07-20-2015
12-27-2021
Community Statistics
| Posts | 30 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 22 |
| Member Since | 07-20-2015 |
Activity Feed
- Posted Log Source volume calculator on Getting Data In. 08-05-2021 02:54 AM
- Tagged Best way to search source IP in the events with a lookup table of IP ranges. on Splunk Search. 11-16-2020 09:01 PM
- Posted Best way to search source IP in the events with a lookup table of IP ranges. on Splunk Search. 11-16-2020 08:59 PM
- Posted Resilient add-on configuration error - Error while posting to url=/servicesNS/nobody/SA-Resilient/admin/sa_resilientconf on Getting Data In. 11-09-2020 06:20 AM
- Got Karma for How to send logs from Splunk Indexer to Qradar. 06-05-2020 12:50 AM
- Karma Migrating hot/warm and cold buckets to separate drives for ejharts2015. 06-05-2020 12:48 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
- Got Karma for Why am I getting "homePath='/opt/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem." while starting Splunk on an indexer?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-05-2021
02:54 AM
Hi everyone, I am looking for any document which can help to calculate log source volume. I have 10 different type of log sources i only have their log source description and quantity. Now i have told to calculate the estimated total volume per day. If someone can help me to get the Log source volume calculator.
... View more
Labels
- Labels:
-
source
-
sourcetype
11-16-2020
08:59 PM
Hello all, can some one suggest me the best method to compare the source_ip in events to the lookup table which have the list of all the permitted IP ranges. Then to show the events for which the source_ip is not matched lookup table senario: index=abc source_ip=x.x.x.x lookup ip_ranges (have only one column with details of ip ranges x.x.x.x/x)
... View more
- Tags:
- query
11-09-2020
06:20 AM
I am getting following error when i am trying to configure Resilient app on Splunk. Error while posting to url=/servicesNS/nobody/SA-Resilient/admin/sa_resilientconfig/config Please help
... View more
Labels
- Labels:
-
other
01-20-2020
12:46 AM
i tried using below 2 types and with each i got different results. can you help to let me know why?
transaction user startswith="(EVENT_TYPE=Login)" endswith="(EVENT_TYPE=Logout)" maxspan=* - i got 725 results over 24 hours
transaction user startswith="(EVENT_TYPE=Logout)" endswith="(EVENT_TYPE=Login)" maxspan=* . - i got 282 results over 24 hours.
same data set used
... View more
01-20-2020
12:23 AM
I need to take out the duration between login and logout of a user from an application.
there are two senario for the same:
1. user a login at 9 AM log out at 9:15 AM then login at 10AM and logout at 10:30 AM
2. user b login at 8 AM and close the browser after few mins then login back at 9:30 AM and logout at 10AM.
Now when i use transaction command i got below results:
index=abc sourcetype="abc" EVENT_TYPE=Login OR EVENT_TYPE=Logout user=* | transaction user Event_TYPE ((for 24 hours))
type1, straight forward:
2020-01-20T06:42:07.861+0000, EVENT_TYPE=Login, user a
2020-01-20T06:44:07.456+0000, EVENT_TYPE=Logout, user a
type2, misleading (required help on this)
2020-01-20T06:15:13.103+0000, EVENT_TYPE=Login
2020-01-20T06:16:55.685+0000, EVENT_TYPE=Login
2020-01-20T06:29:07.445+0000, EVENT_TYPE=Logout
2020-01-20T06:29:07.446+0000, EVENT_TYPE=Logout
2020-01-20T06:41:22.856+0000, EVENT_TYPE=Login
2020-01-20T06:44:07.457+0000, EVENT_TYPE=Logout
2020-01-20T06:48:24.815+0000, EVENT_TYPE=Logout
2020-01-20T06:59:07.383+0000, EVENT_TYPE=Logout
Also when i had done this
index=abc sourcetype="abc" | stats count by EVENT_TYPE (for 24 hours)
Login - 5099
Logout - 1799
PLEASE HELP
... View more
01-12-2020
06:59 PM
I need to write a search to detect the long duration of data transfer between a src and dest. can some one help me on the same.
... View more
11-07-2019
06:31 PM
Can some one please help if you have any document on how to integrate the IBM X-force Threat intelligence feed with Splunk ES.
... View more
11-05-2019
12:10 AM
Hello,
Can anyone help me to understand more on the new Splunk License Model:
Predictive Pricing
Infrastructure-Based Pricing
Rapid Adoption Packages
I have gone through the Splunk sites, but required some more detailed understanding, if any can help with any url/link please.
... View more
- Tags:
- licenses
08-19-2019
12:35 AM
I want to achieve HA for Splunk Heavy forwarder.
I have to deploy 2 Heavyforwarder in HA. The UF can send the load balanced data, for syslog i will use external load balancer.
But i am stuck on 1 thing. How the logs/events will be load balanced is i install Splunk App on the Heavyforwarder? Is there any solution if i want to use any Splunk App on Heavyforwarder in HA.
If i install same splunk App on both the heavyforwarder then the data will be duplicated?
... View more
- Tags:
- splunk-enterprise
08-18-2019
09:59 PM
Please help me to know which is better clustered Indexers and non-clustered indexers?
Key differences between clustered Indexers and Non-clustered Indexers?
When to deploy clustered Indexers and when to deploy non-clustered indexers?
I have checked a lot of sites but the above questions are still not answered.. Please help.
... View more
- Tags:
- splunk-enterprise
05-30-2019
06:53 PM
Thanks @wyfwa4 , but can you please let me know the data will be in raw format, and how to read the data as it was already compressed by Splunk.
... View more
05-29-2019
03:21 AM
Hello kemnean2001,
join command is used to join to searches having atleast one same field.
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Join
this link might help you.
... View more
05-29-2019
03:10 AM
Is it possible to have old archived (indexed) logs from Splunk to send to
any other third party solution ensuring that the log keeps their original raw format and timestamps?
... View more
12-20-2018
07:42 PM
1 Karma
Hello All,
I want to send the logs from Splunk Indexer to Qradar.
We want to send some specific events from Splunk to Qradar.
Please help.
... View more
08-27-2018
09:54 PM
The below document will help you to configure Qualys
https://www.qualys.com/docs/qualys-ta-for-splunk.pdf
... View more
08-27-2018
09:35 PM
I have not enabled any certificate for Qualys, but still i got the below error
Please help on the same.
8/28/18 11:35:05.000 AM
TA-QualysCloudPlatform: 2018-08-28 11:35:05 PID=21248 [MainThread] INFO: TA-QualysCloudPlatform [host_detection] - Request failed with SSLError, Retrying: https://qualysapi.qualys.com/api/2.0/fo/asset/host/vm/detection/ with params={'action': 'list', 'show_igs': 1, 'vm_processed_after': '1999-01-01T00:00:00Z', 'status': 'New,Active,Fixed,Re-Opened', 'truncation_limit': 5000, 'show_results': 0}. Retry count: 1
8/28/18 11:35:05.000 AM
TA-QualysCloudPlatform: 2018-08-28 11:35:05 PID=21248 [MainThread] ERROR: TA-QualysCloudPlatform [host_detection] - SSLError
... View more
08-10-2018
12:22 AM
I am Answering my question myself.
there are two things we need to check.
1. firewall, Is the splunk able to connect to Qualys cloud.
2. make sure not to use http:// in the proxy entry.
I sorted both of them and the first time credentials worked.
... View more
08-01-2018
06:08 PM
I an trying to set the Credentials for the first time.
Also there is no local directory under TA-QualysCloudPlatform
... View more
07-31-2018
08:35 PM
Got below error while Entering Credential for the first time for Qualys Technology Add-on in Splunk:
Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-QualysCloudPlatform/qualys/qualys_configure/setupentity
... View more
04-18-2017
12:09 AM
Hello,
I want to know that is all the buckets are rolled every time we restart the indexer and is it safe.?
Is there any specific time a bucket can be rolled.?
will the restart of indexer will effect the buckets/indexes/searches?
... View more
11-05-2016
03:37 AM
Everything working fine now, thanks all.
All the logs having INFO are now stopped to be indexed.
Just out of curiosity can any one help on what parameters we can apply conditional logging i.e. we can apply using hostname and source but we apply conditional logging using index ??
... View more
11-02-2016
03:49 AM
I have added these files in the indexer as the forwarder is a Universal forwarder. Yes i do have INFO strings in the events coming from the source.
After applying the conditional logging i can see the INFO events.
... View more
11-02-2016
12:42 AM
I have configured transforms.conf and props.conf on below path
/opt/splunk/etc/apps/search/local
transforms.conf
[setnull]
REGEX = INFO
DEST_KEY = queue
FORMAT = nullQueue
props.conf
[source::/opt/assays/log/assays.stdout.log]
TRANSFORMS-null= setnull
But still i'm getting logs from source = /opt/assays/log/assays.stdout.log.
Please Help.
... View more
03-15-2016
09:28 AM
You can use below search and schedule it to run in every 30 days and set email alert to your email id. Then you can easily store the report and compare.:
index=_internal source=*license_usage.log type="RolloverSummary" earliest=-30d@d | dedup slave, date_mday | eval _time=_time - 43200 | timechart span=1d sum(b) AS volume fixedrange=false | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-27-2021
04:58 AM
|
Karma from
