Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Murali2888
Murali2888
Communicator
Member since:
12-15-2014
03-23-2023
Community Statistics
| Posts | 56 |
| Solutions | 4 |
| Karma Given | 10 |
| Karma Received | 11 |
| Member Since | 12-15-2014 |
Activity Feed
- Posted Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map comman on Splunk Search. 03-23-2023 04:44 PM
- Karma Re: Is there a way to instruct Splunk to not add quotes when passing searches stored in a lookup table to the map command? for sjaworski. 03-23-2023 04:43 PM
- Posted Re: Custom Alert Action UI JQuery on Alerting. 04-21-2021 12:07 AM
- Karma Custom Alert Action UI JQuery for rigoreatigax. 04-21-2021 12:06 AM
- Karma Re: Problems with SSL JNDI Lookup against Tibco EMS for Damien_Dallimor. 06-05-2020 12:48 AM
- Karma Re: Problem with SAML cert: "ERROR UiSAML - Verification of SAML assertion using the IDP's certificate provided failed. Error: Failed to verify signature with cert :/opt/splunk/etc/auth/idpCerts/idpCert.pem" for rphillips_splk. 06-05-2020 12:48 AM
- Karma Is there a way to use a wildcard in field names when running a search? (ex: field*_name=X for field1_name, field2_name, etc) for splunknewbie05. 06-05-2020 12:47 AM
- Karma Re: How to split a json array into multiple events with separate timestamps? for Gilberto_Castil. 06-05-2020 12:47 AM
- Karma Re: How to join two search events that have a common field without using Join? for dturnbull_splun. 06-05-2020 12:47 AM
- Got Karma for MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?. 06-05-2020 12:47 AM
- Got Karma for MetaData Values: Is there a difference between DEST_KEY = _MetaData:Index versus DEST_KEY = MetaData:Index?. 06-05-2020 12:47 AM
- Got Karma for How to disable REST API access for a user. 06-05-2020 12:47 AM
- Got Karma for How to disable REST API access for a user. 06-05-2020 12:47 AM
- Got Karma for Re: How to create or update KV Store via REST endpoints?. 06-05-2020 12:47 AM
- Got Karma for Re: How to create or update KV Store via REST endpoints?. 06-05-2020 12:47 AM
- Got Karma for Re: How to create or update KV Store via REST endpoints?. 06-05-2020 12:47 AM
- Got Karma for How to disable 'Export Results' for specific users or roles?. 06-05-2020 12:47 AM
- Got Karma for How to disable 'Export Results' for specific users or roles?. 06-05-2020 12:47 AM
- Got Karma for Re: how do I use regular expression search results from one index search and use it in another?. 06-05-2020 12:47 AM
- Got Karma for Re: can PYTHONPATH for splunk be expanded to point to another python lib directory?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
03-23-2023
04:44 PM
Smart and easier solution for a complex problem. Thank you very much
... View more
04-21-2021
12:07 AM
I am after a similar approach. Have you managed to find an answer for this?
... View more
02-04-2019
03:04 PM
I have a multivalue field in my events and I want to do a lookup against a multivalue field in kvstore field. Event field can either have all values of kvstore mv field or a subset of it. Existing lookup command matches at least one of the values. I want to enforce a match only if all values are present in the kvstore field.
kvstorefieldA
A1 A2 A3
B1 B2 B3 B4 B5
event fieldX
A1 A2 A3
A1 A4
How can I enforce that only the first value of fieldX matches and the second does not?
... View more
08-06-2018
06:33 PM
@jwhubbard - I tried this already on 7.1.0 Build: 2e75b3406c5b, but did not work. I can't upgrade to 7.1.1 now unfortunately though.
@runner724 - Thanks for your help. I am able to retain date range and date-time range panel using below.
div[data-test-panel-id^='advanced'],
div[data-test-panel-id^='presets'],
div[data-test-panel-id^='relative'],
div[data-test-panel-id^='real'] {
display: none !important;
}
Could you please let me know how do you inspect the CSS components? In that way, I can make any changes required for future splunk releases.
... View more
08-06-2018
05:18 AM
@runner724 Can you let me know how we can remove Advanced and Relative tab? I am looking to retain only "Date Range panel". I tried above method which only works for Presets tab columns.
... View more
06-18-2018
07:34 PM
Hi All,
I need to lookup a value on three different kvstore fields based on its regex format. Is it possible to pass dynamic field name to kvstore lookup?
Lets say, I have three field lookup - userid, mail, secondaryids. I want to achieve something like below.
| lookup records_lookup $arg$
- where arg would be mail if value is of email id format
- where arg would be userid if value is of aXXXXXX
- where arg would be secondaryids if value is of bXXXXXX
I am trying to avoid multiple lookup statements into my search as the lookup value can only be of one format.
... View more
06-28-2017
04:05 PM
Hi swaro_ck,
Did we happen to get details on what the issue is?
... View more
04-04-2016
06:17 PM
I have an existing jmx_ta app on the forwarder which connects to jboss 5.1.2 version via rmi protocol and polls all the jmx data. We now have few more jboss 6.3 jvms added to the same host which uses remoting-jmx protocol.
<jmxserver host="127.0.0.1" jvmDescription="ABC_1" jmxServiceURL="service:jmx:remoting-jmx://127.0.0.1:9404" jmxuser="xxxx" jmxpass="xxxx" >
However, the jmx.py scripts throws the error systemErrorMessage="Unsupported protocol: remoting-jmx" for the new jvm. I have tried placing jboss-client.jar into the lib directory but still no luck.
Could someone point me to the right direction? I am not sure if I am missing something very obvious.
Thanks for your help.
... View more
03-31-2016
08:59 PM
Did this issue got resolved? I am experiencing the same for jboss 6.3
... View more
02-18-2016
03:07 PM
3 Karma
I don't think there is an update function to insert/update records in KV Store with that level of intelligence.
As you said, you can handle this by two way approach in your script using the respective REST End Points.
Query the KV Store for the existence of the Key
If present, use the storage/collections/data/{collection}/{id} end point to update the record
else, use storage/collections/data/{collection}/ to insert a new record
Please refer the links for more details / examples
http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTkvstore
http://docs.splunk.com/Documentation/Splunk/6.3.3/RESTREF/RESTkvstoreExamples
... View more
02-14-2016
03:03 PM
Hi ssievert,
We have two set of user profiles as per our Client's standard. One profile is for users to access the UI and run searches, create reports and dashboards etc. The other profile is for application user accounts to access SPLUNK REST API from specific application to search for data.
However, we have few UI users accessing REST API programatically and are running hundreds of searches which we want to restrict. Also, we want to allow only the application user accounts to access the REST API.
Hope I have provided enough details on what we are trying to do
... View more
02-13-2016
05:25 PM
yes. I have checked the capabilities. Disabling the search capability restricts the user from accessing REST API but that also blocks the UI search capability.
I am interested in blocking the REST API access alone.
... View more
02-10-2016
04:50 PM
2 Karma
I want to disable REST API access for a user. In other words, he/she should be able to log in to Splunk Web and run searches where as they should not have provision to run searches via API calls.
I tried disabling the below capability for the user in authorize.conf , but it does not block the user from accessing REST API
rest_properties_get
rest_properties_set
Is there any way we can configure these capability for the user?
... View more
02-06-2016
06:27 PM
Thanks ppablo. I will post the it in the answer section
... View more
02-06-2016
06:27 PM
1 Karma
import sys
sys.path.append('LOCAL_PYTHON_PATH')
Add the above to your python script. I have few python scripts that uses local python libraries (redis). I was able to include the libraries with the above.
If this has resolved your problem, please accept it as answer.
... View more
02-04-2016
09:42 PM
If this has resolved your issue, can you accept it as answer and close it?
... View more
02-02-2016
09:34 PM
that is epochtime.
I have checked the query and there is no issue with that and I am able to see the Duration field with value 0.010000 when I ran the same.
Can you post your output?
... View more
02-02-2016
09:18 PM
Can you accept if either of the answers worked for you?
... View more
02-02-2016
09:17 PM
If any of the answers worked for you, can you accept it so that the thread can be closed?
... View more
02-02-2016
09:05 PM
Are you able to get correct values for other fields? StartTime EndTime CapturedStartTime and CapturedEndTime.
... View more
02-02-2016
09:01 PM
Can you post the query with transaction command that you are using?
Is your main task table and subtask table are different files?
... View more
02-02-2016
03:12 PM
Can you try the below in your python script?
import sys
sys.path.append('LOCAL_PYTHON_PATH')
I have few python scripts that uses local python libraries (redis). I was able to include the libraries with the above.
Let me know how you go with this.
... View more
02-02-2016
02:59 PM
Are you sure you have the required jar files? A quick search shows that the fscontext.jar is required.
Can you try adding that?
... View more
02-01-2016
04:04 PM
Hi Jhoang,
You can use the below
| eval timeVariable=tostring(totalVariable,"duration") | eval TimeTaken = replace(timeVariable,"(\d*)\+(\d*)\:(\d+)\:(\d+)\.(\d+)","\1Days \2Hours \3Minutes \4Seconds")
... View more
01-28-2016
07:52 PM
you can use eval and searchmatch
| eval location= if(searchmatch("MMK"),"LiteralString1",if(searchmatch("RTP"),"LiteralString2","DEFAULTStr"))
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-23-2023
10:09 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
