Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About 90509
90509
Engager
Member since:
04-16-2018
02-10-2021
Community Statistics
| Posts | 40 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-16-2018 |
Activity Feed
- Posted How to fetch mathed fileds values from index with lookup table ? on Splunk Search. 06-23-2020 04:47 PM
- Tagged How to fetch mathed fileds values from index with lookup table ? on Splunk Search. 06-23-2020 04:47 PM
- Posted Re: why different timezone showing in scheduled searches for my user ? on Splunk ITSI. 05-19-2020 11:15 PM
- Posted why different timezone showing in scheduled searches for my user ? on Splunk ITSI. 05-19-2020 03:24 AM
- Tagged why different timezone showing in scheduled searches for my user ? on Splunk ITSI. 05-19-2020 03:24 AM
- Posted why i am unable to add search head member after restart search head member restart ? on Splunk ITSI. 05-18-2020 06:00 AM
- Tagged why i am unable to add search head member after restart search head member restart ? on Splunk ITSI. 05-18-2020 06:00 AM
- Tagged why i am unable to add search head member after restart search head member restart ? on Splunk ITSI. 05-18-2020 06:00 AM
- Posted Re: How to change time zone from EST to CET on schedule searches ? on Getting Data In. 05-16-2020 11:59 PM
- Posted Re: Dispatch Alert Question on Splunk Search. 05-16-2020 09:14 AM
- Posted Re: How to enable master node on all indexers ? on Splunk Enterprise Security. 04-18-2020 04:02 AM
- Posted Re: How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 08:16 AM
- Posted Re: How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 08:03 AM
- Posted Re: How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 07:01 AM
- Posted Re: How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 03:46 AM
- Posted How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 03:45 AM
- Tagged How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 03:45 AM
- Tagged How to change time zone from EST to CET on schedule searches ? on Getting Data In. 04-17-2020 03:45 AM
- Posted Re: Saved search failing with gen_id mistmatch on Splunk Search. 04-16-2020 08:28 AM
- Posted How to enable master node on all indexers ? on Splunk Enterprise Security. 04-16-2020 05:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-23-2020
04:47 PM
Hi Team, I tried all possibilities to extract the data from index which are matched field values with lookup table . the requirement is to pull the existing fields in index=xxxxxx sourcetype=yyyy, I can see many fields but would like path: /vol/xxxxxx/xxxxxxxx-lun0_xxxxxxxx/uswilo60-00.lun. we have number events but we only need 300 lunid along the some other filelds, like the highlighted part we have a lot but we need to pull the data of only 300-requored Lun. I have created lookup table for those 300 lun but how to extract based on only these 300, we should pull path,volume,host,name….those exist in index but in lookup we are having only one column that lun. could any one help on this
... View more
- Tags:
- join
05-19-2020
11:15 PM
Thanks for the Support but please let me know the path how to set the user time zone as EST instead CEST as a admin.i have tried the above one bye going to access controls---users---timezone but still the user able to see EST only as a admin if i check my end i can see in CEST is it possible to sync user(system) time zone with server time zone ?
... View more
05-19-2020
03:24 AM
Hi Team, I have verified the props.conf and access controls---users---timezone for my user all kept correctly . Actually for my user the Time zone showing EST but as a admin if try to open all the scheduled searches about the user i can see CEST. i am not sure , why it's showing for the user differently. any guess why it's showing different for user how to resolve it
... View more
Labels
- Labels:
-
administration
-
configuration
05-18-2020
06:00 AM
Hi Team,
I have performed ./splunk restart on one of the search head ..after that when try to add the member to the cluster i am unable to add .
when i check the status in CLI
it was generating a message in CLI """search head cluster not enabled on this node. REST end point is not available.
for adding :./splunk add shcluster-member current_member_uri="......":8089
to check status./splunk show shcluster-status
i have verified the server.conf i can see stanza for the host which i restarted like
[shclusring]
.......
.......
mgmt_uri=my host along with :8089
......
....
could you please let me know how to resolve it.
... View more
05-16-2020
11:59 PM
Actually for my user the Time zone showing EST but as a admin if try to open all the scheduled seatches about the user i can see CEST. i am not user why it's showing for the user differently. any guess why it's showing different for user how to resolve it .
... View more
05-16-2020
09:14 AM
could you please let me know where should i clean is it in indexer or search head ? i got message on one of the dev search head saying that "search peer has following message " . so , where should i run the below command if clean dispatch is it impacts anything ?
... View more
04-18-2020
04:02 AM
could you please let me know the reason why it happened . all are in cluster environment with master node if we check from master node to all indexers are in state UP condition but if we check from indexer master node not enabled why this was coming .
one more question i would like to ask , if we ping from master node to indexer the data packets are sending but we check from indexer to master node showing "unknown host" , is it bidirectional or single direction....
... View more
04-17-2020
08:16 AM
i am i have i have found CEST /CET in splunkd.log but if e run schedule searches related to one particular user , the searches are running in EST timezone instead of CET.
Even i have verified the user Settings » Access Control » Users , the timezone set to CET only . iam not sure where is the problem.
... View more
04-17-2020
08:03 AM
I have checked the Settings » Access Control » Users. the user timezone set to CET only. but the person run any schedule searches identified that EST time zone instead of CET
... View more
04-17-2020
07:01 AM
I have checked the splunkd.log , all are running on CEST timezone on that particular host.
... View more
04-17-2020
03:46 AM
Sorry TZ=UTC small correction.
... View more
04-17-2020
03:45 AM
Hi all,
I have found all schedule searches are running on EST instead of CET timezone, if i go and props.conf in /system/local
the Timezone showing TZ=UST .
could you please help me how to set CET time zone instead of EST.
... View more
04-16-2020
08:28 AM
Hi All ,
I got the same issue . if i tried to ping from master node to indexer1 or indexer2 it is pinging but if tried from indexer1 or indexer2 to master node getting error like """ unknown host".
could you please let me know the reason how to resolve this issue.
... View more
04-16-2020
05:44 AM
Hi All ,
I am working in cluster environment with 16 prod indexers, and one separate cluster master node.
if I run /opt/splunk/bin/splunk list cluster-peers
if i run the above command in master node command prompt which showing all indexers in the cluster but if run same command on any of the indexers showing master node not enabled.
how to enable master node on each indexer . this case came while synch or pairing indexer with master node.
How to enable master node on all indexers with command line prompt.
... View more
01-23-2020
04:32 AM
from according your query if there is no src_ip for any eventcodes which is not populating but I want all event codes who is having same Logon_ID will be assigned with same src_ip.
... View more
01-23-2020
04:16 AM
I appreciate your help but I need want the table like
suppose if take one logon_ID for that Logon_ID having number of event codes like EventCode=4624 or 4625 0r 4672 or 4648, so in this scenario all the events codes having same Logon_Id but for EventCode=4624 only having src_ip. so need to fetch the results along with src_ip assigning the Events or EventCodes having same Logon_ID.
... View more
01-23-2020
03:44 AM
Do I need to perform any join operations
I have tried this but it's not working
index=wineventlog EventCode=*
| where Logon_ID !="0x0"
|stats count by src_ip,Logon_ID,EventCode
|join
[ search index="wineventlog" EventCode=4624
| where Logon_ID !="0x0"
|stats count by src_ip,Logon_ID,EventCode]
... View more
01-23-2020
03:42 AM
yes but some events having only Logon_Id so for those need to assign src_ip as well
... View more
01-23-2020
02:53 AM
I would like to assign src_ip to all events who is having same logon_id. but the src_ip coming only to EventCode=4624.
could you please let me know
... View more
- Tags:
- splunk-enterprise
11-20-2019
12:10 AM
Thank you . your function is working ,I apologies for not accepting your answer because he has sent first. I hope you have great journey.
... View more
11-18-2019
02:15 AM
Hi,
could you please help me with below info:
user service name device
abc123 baadmin Brahma Louwps121
bcx123 admin siva louwps123
bxc111 admin Brahma Louwps123
abc123 backup vijay Louwps101
cxz123 backup Brahma Louwps123
cxz123 backup raghu Louwps001
czx101 DM1 Brahma Louwps111
from this if I need to find out "Brahma" with that field value the remaining filed values that are associated with remaining field values in another fields.
... View more
- Tags:
- splunk-enterprise
07-03-2019
05:55 AM
| stats count last(hourDay) as timestamp by user, HourDay, EventCode, Account_Domain, Account_Name, dvc_owner,dvc_bunit,dvc_ip, subject, dvc
if I move |stats to last line then I am getting statistics.so please suggest me best way.
... View more
07-03-2019
05:54 AM
one more thing if keep
| stats count last(hourDay) as timestamp by user, HourDay, EventCode, Account_Domain, Account_Name, dvc_owner,dvc_bunit,dvc_ip, subject, dvc
I am not able to see any statistics if I keep |fields -HourDay. if I remove |fields -HourDay and keep |stats as it is I am not able to see any statistics as well.
If I move |stats to last line and remove |filelds -HourDay then I am getting statistics.so please suggest me how to do this.
... View more
07-03-2019
05:41 AM
Thanks for your assistance but the code only showing <6 failed attempts and which is only showing 4625 I am not able to see remaining event codes, so how could we overcome this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-10-2021
12:07 AM
|
