About karn

karn

Hi, I add windows, linux and vmware input to the IT Essentials Work App. I can drilldown to the detail of each windows, linux, vcenter, datastore from Infrastructure Overview Dashboard. Except the vms, when I click drilldown any vms, it shows blank page. How do I solve this issue? Thank you

karn · ‎10-08-2019

Since Splunk Add-on for VMware pull a lot performance data from vCenter, I need to index performance data 1 minute at the minute 0,15,30,45 However, there is no time data in _raw to filter out the data. Please help!

karn · ‎04-01-2019

How do I export events or logs from Splunk Insight for Infrastructure? I noticed that I only export number of events? The version I test is 1.2.3. Thank you

karn · ‎03-12-2019

I would like to improve search performance by preload data into csv or kv-store with sparkline. How do I display sparkline back when I use command inputlookup ? Thank you

karn · ‎03-03-2019

I found the solution at https://answers.splunk.com/answers/624857/how-to-avoid-alphabetical-sorting-on-xyseries-comm.html

karn · ‎03-02-2019

I have a search with generate dynamic the column name with pattern "Month - Year" eg. "October - 2018" "November - 2018" "December - 2018". However, splunk orders the column by alphabet. So, I have an idea to convert them to unix time and then convert the column name back with javascript. How do I rename column name with javascript?

karn · ‎02-26-2019

I tried remove all rows from a target user but I cannot. It seems to need at least one role.

karn · ‎02-25-2019

I would like to disable some local accounts temporary. I cannot find disable or suspend button in access controls settings menu. Is there a way to disable the account?

karn · ‎08-28-2018

I found the cause. It is because while generating rsa key, I use root. That's the problem. I have to use nasadmin user.

karn · ‎08-27-2018

I change IP Address of vnx file stanza to Control Station IP Address in inputs.conf. No error in ta_vnx.log. However splunk does not receive the vnx file log (sourcetype vnx:file*).

karn · ‎08-27-2018

I could retrieve VNX Block Data except VNX File Data. I found error in ta_vnx.log. How do I fix this issue. 2018-08-28 11:18:35,830 INFO 140323441321728 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance 2018-08-28 11:18:35,831 INFO 140323451811584 - Start vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance 2018-08-28 11:18:35,844 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,844 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.102,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,855 ERROR 140323441321728 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,855 INFO 140323441321728 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_sys_performance 2018-08-28 11:18:35,856 ERROR 140323451811584 - platform=Vnx File,ip=172.30.114.103,cmd=export NAS_DB=/nas;echo "<<CABINET_INFO>>"; /nas/bin/nas_xml -info:; echo "<</CABINET_INFO>>";echo "<<STORAGE_ARRAY>>"; /nas/bin/nas_storage -query:* -fields:serial -format:'%s,'; echo ""; echo "<</STORAGE_ARRAY>>";,reason=ssh_exchange_identification: read: Connection reset by peer 2018-08-28 11:18:35,856 INFO 140323451811584 - End vnx_data_loader://sf_vnx_file. Metric=vnx_file_nfs_performance

karn · ‎08-21-2018

I setup splunk insights for infrastructure more than 2 months. I notice that I cannot change time older than 30 days. I need to search the metric and logs older than 30 days. What should I do?

karn · ‎07-02-2018

I have logs that send from syslog server, so there are 2 timestamps. I would like to use 2nd timestamp to be _time by using TIME_PREFIX. However, it doesn't match if the log come from syslog. It's match if using monitor file. Jun 15 10:06:58 10.226.48.229 Jun 15 10:06:59 111.111.111.111 1 2018-06-15T10:06:51.424243+07:00 node01 kernel - - - [9079188.370611] RULE 0 -- ACCEPT IN=eth1 OUT=eth2 MAC=00:50:56:a0:e4:fa:00:50:56:b6:0a:53:08:00 SRC=10.60.0.3 DST=10.99.2.198 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=13091 DF PROTO=TCP SPT=55646 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Jun 15 10:06:58 10.226.48.229 Jun 15 10:06:51 111.111.111.111 haproxy[3645]: 1.46.134.132:2195 [15/Jun/2018:10:06:51.292] https-web~ https-backend/www01 116/0/12/3/131 404 424 - - ---- 3/3/0/0/0 0/0 "GET /favicon.ico HTTP/1.1" My props.conf is [syslog] TIME_PREFIX = ^\w+\s\d+\s\d+\:\d+\:\d+\s\d+\.\d+\.\d+\.\d+\s MAX_TIMESTAMP_LOOKAHEAD = 16

Posts	13
Solutions	2
Karma Given	0
Karma Received	1
Member Since	‎07-02-2018

Online Status	Offline
Date Last Visited	Monday

Cannot drilldown VMs from Infrastructure Overview ...

Need Index vmware performance data certain time

How do I export events from Splunk Insight for Inf...

I would like show sparkline from outputlookup tabl...

How do I rename column name with javascript?

Disable user account temporary

Why can I not retrieve vnx file data from EMC VNX ...

Can we see metric chart and logs older than 30 day...

Please help me Time_PREFIX