Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About karn
karn
Path Finder
Member since:
07-02-2018
06-24-2025
Community Statistics
| Posts | 21 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 07-02-2018 |
Activity Feed
- Posted Re: add/modify kvstore column in search head cluster environment on Deployment Architecture. 06-25-2025 03:15 AM
- Posted Re: add/modify kvstore column in search head cluster environment on Deployment Architecture. 06-25-2025 02:13 AM
- Posted add/modify kvstore column in search head cluster environment on Deployment Architecture. 06-24-2025 09:50 PM
- Posted Re: Change initial date then stop ingestion on Getting Data In. 04-03-2025 05:57 AM
- Posted Change initial date then stop ingestion on Getting Data In. 04-03-2025 05:30 AM
- Posted How do I check multiple license key installed on Splunk SOAR & Splunk UBA? on Splunk SOAR. 01-01-2025 07:03 PM
- Tagged What happened if Splunk SOAR license expired? on Splunk SOAR. 12-26-2024 10:23 PM
- Tagged What happened if Splunk SOAR license expired? on Splunk SOAR. 12-26-2024 10:23 PM
- Tagged What happened if Splunk SOAR license expired? on Splunk SOAR. 12-26-2024 10:23 PM
- Posted What happened if Splunk SOAR license expired? on Splunk SOAR. 12-26-2024 10:21 PM
- Got Karma for SC4S, how do I write raw message into a directory?. 12-21-2024 07:39 AM
- Posted SC4S, how do I write raw message into a directory? on Getting Data In. 07-07-2023 01:58 AM
- Tagged SC4S, how do I write raw message into a directory? on Getting Data In. 07-07-2023 01:58 AM
- Posted Cannot drilldown VMs from Infrastructure Overview Dashboard of IT Essentials Work App? on All Apps and Add-ons. 03-26-2023 08:55 PM
- Tagged Cannot drilldown VMs from Infrastructure Overview Dashboard of IT Essentials Work App? on All Apps and Add-ons. 03-26-2023 08:55 PM
- Tagged Cannot drilldown VMs from Infrastructure Overview Dashboard of IT Essentials Work App? on All Apps and Add-ons. 03-26-2023 08:55 PM
- Got Karma for Re: How do I rename column name with javascript?. 06-05-2020 12:50 AM
- Posted Need Index vmware performance data certain time on All Apps and Add-ons. 10-08-2019 08:00 AM
- Tagged Need Index vmware performance data certain time on All Apps and Add-ons. 10-08-2019 08:00 AM
- Tagged Need Index vmware performance data certain time on All Apps and Add-ons. 10-08-2019 08:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-25-2025
03:15 AM
it works. curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/storage/collections/config/mykvstore -d "field.my_new_column=string" Thanks
... View more
06-25-2025
02:13 AM
I can't see editing menu on lookup editor app , please guide me. Karn
... View more
06-24-2025
09:50 PM
I have a question about modify kvstore configuration in search head cluster environment. I have created kvstore with lookup editor app from a search head instance. Now, I would like to add a new column. So, I have to modify from collections.conf right?. However, the configuration is not on SHC but search head instances. What is the best way to add a new column of kvstore? Thank you
... View more
Labels
- Labels:
-
search head
-
search head clustering
04-03-2025
05:30 AM
I have disabled input (generic S3) of aws add-on for a year. After I enable it, it ingests old data so I disable it and change initial date in inputs.conf. After restarting splunk serevice, I enable it but no data coming. I tried clone and changed only the name. No data coming also. I don't know how to check it. Is it checkpoint issue or somethings? Please help me to check it. Thanks for Advance
... View more
Labels
- Labels:
-
data
-
heavy forwarder
-
inputs.conf
01-01-2025
07:03 PM
Hi, I have three license keys for Splunk SOAR and Splunk UBA, each valid for one year. While I am able to install the keys on both SOAR and UBA, I would like to verify all the keys I have installed, identify which key is currently active, and check their expiration dates. Thank you
... View more
Labels
- Labels:
-
administration
-
using SOAR ⁄ Phantom
12-26-2024
10:21 PM
What happened if Splunk SOAR license expired? I cannot find a document to explain it.
... View more
Labels
- Labels:
-
administration
07-07-2023
01:58 AM
1 Karma
Hi, I want to sc4s to receive syslog and I want sc4s to write raw message into a directory. However, it doesn't write the raw message. There are only export messages (json) write into archive folder. What is my mistake? And which the directory was written to. Thank you ########### env_file ############ SPLUNK_HEC_URL=https://xx.xx.xx.xx:8088 SPLUNK_HEC_TOKEN=xxxxxxxxxxxxxxxxxxxxx SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no #SC4S_USE_REVERSE_DNS=yes SC4S_LISTEN_FORTINET_UDP_PORT=514 SC4S_GLOBAL_ARCHIVE_MODE=compliance SC4S_ARCHIVE_GLOBAL=yes SC4S_SOURCE_STORE_RAWMSG=yes SC4S_DEST_GLOBAL_ALTERNATES=d_hec_debug,d_archive,d_rawmsg
... View more
- Tags:
- SC4S
Labels
- Labels:
-
HTTP Event Collector
-
Linux
-
syslog
03-26-2023
08:55 PM
Hi,
I add windows, linux and vmware input to the IT Essentials Work App. I can drilldown to the detail of each windows, linux, vcenter, datastore from Infrastructure Overview Dashboard. Except the vms, when I click drilldown any vms, it shows blank page. How do I solve this issue?
Thank you
... View more
Labels
- Labels:
-
troubleshooting
10-08-2019
08:00 AM
Since Splunk Add-on for VMware pull a lot performance data from vCenter, I need to index performance data 1 minute at the minute 0,15,30,45 However, there is no time data in _raw to filter out the data. Please help!
... View more
04-01-2019
02:12 AM
How do I export events or logs from Splunk Insight for Infrastructure? I noticed that I only export number of events? The version I test is 1.2.3.
Thank you
... View more
03-12-2019
09:15 PM
I would like to improve search performance by preload data into csv or kv-store with sparkline. How do I display sparkline back when I use command inputlookup ?
Thank you
... View more
- Tags:
- splunk-enterprise
03-03-2019
07:53 PM
1 Karma
I found the solution at https://answers.splunk.com/answers/624857/how-to-avoid-alphabetical-sorting-on-xyseries-comm.html
... View more
03-02-2019
04:26 AM
I have a search with generate dynamic the column name with pattern "Month - Year" eg. "October - 2018" "November - 2018" "December - 2018". However, splunk orders the column by alphabet. So, I have an idea to convert them to unix time and then convert the column name back with javascript. How do I rename column name with javascript?
... View more
- Tags:
- splunk-enterprise
02-26-2019
07:14 PM
I tried remove all rows from a target user but I cannot. It seems to need at least one role.
... View more
02-25-2019
12:04 AM
I would like to disable some local accounts temporary. I cannot find disable or suspend button in access controls settings menu. Is there a way to disable the account?
... View more
- Tags:
- splunk-enterprise
08-28-2018
12:18 AM
I found the cause. It is because while generating rsa key, I use root. That's the problem. I have to use nasadmin user.
... View more
08-27-2018
11:56 PM
I change IP Address of vnx file stanza to Control Station IP Address in inputs.conf. No error in ta_vnx.log. However splunk does not receive the vnx file log (sourcetype vnx:file*).
... View more
08-27-2018
09:37 PM
I could retrieve VNX Block Data except VNX File Data. I found error in ta_vnx.log.
How do I fix this issue.
2018-08-28 11:18:35,830 INFO 140323441321728 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance
2018-08-28 11:18:35,831 INFO 140323451811584 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance
2018-08-28 11:18:35,844 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer
2018-08-28 11:18:35,844 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer
2018-08-28 11:18:35,855 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer
2018-08-28 11:18:35,855 INFO 140323441321728 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance
2018-08-28 11:18:35,856 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer
2018-08-28 11:18:35,856 INFO 140323451811584 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance
... View more
08-21-2018
07:16 PM
I setup splunk insights for infrastructure more than 2 months. I notice that I cannot change time older than 30 days. I need to search the metric and logs older than 30 days. What should I do?
... View more
07-02-2018
07:59 PM
I have logs that send from syslog server, so there are 2 timestamps. I would like to use 2nd timestamp to be _time by using TIME_PREFIX. However, it doesn't match if the log come from syslog. It's match if using monitor file.
Jun 15 10:06:58 10.226.48.229 Jun 15 10:06:59 111.111.111.111 1 2018-06-15T10:06:51.424243+07:00 node01 kernel - - - [9079188.370611] RULE 0 -- ACCEPT IN=eth1 OUT=eth2 MAC=00:50:56:a0:e4:fa:00:50:56:b6:0a:53:08:00 SRC=10.60.0.3 DST=10.99.2.198 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=13091 DF PROTO=TCP SPT=55646 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
Jun 15 10:06:58 10.226.48.229 Jun 15 10:06:51 111.111.111.111 haproxy[3645]: 1.46.134.132:2195 [15/Jun/2018:10:06:51.292] https-web~ https-backend/www01 116/0/12/3/131 404 424 - - ---- 3/3/0/0/0 0/0 "GET /favicon.ico HTTP/1.1"
My props.conf is
[syslog]
TIME_PREFIX = ^\w+\s\d+\s\d+\:\d+\:\d+\s\d+\.\d+\.\d+\.\d+\s
MAX_TIMESTAMP_LOOKAHEAD = 16
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-24-2025
09:41 PM
|
