Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About abhishekkalokhe
abhishekkalokhe
Explorer
Member since:
07-06-2018
07-29-2024
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 07-06-2018 |
Activity Feed
- Posted Re: Splunk started complaining "Script execution failed for external search command 'runshellscript'." after 9 on Alerting. 02-01-2023 07:18 AM
- Posted Does DensityFunction use partial_fit ? on Splunk Search. 05-04-2021 05:20 AM
- Tagged Does DensityFunction use partial_fit ? on Splunk Search. 05-04-2021 05:20 AM
- Tagged Does DensityFunction use partial_fit ? on Splunk Search. 05-04-2021 05:20 AM
- Karma Re: How to determine working duration of user on Change or Authentication datamodel? for tscroggins. 03-19-2021 04:07 AM
- Posted Re: How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-19-2021 04:06 AM
- Posted How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-04-2021 05:29 AM
- Tagged How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-04-2021 05:29 AM
- Tagged How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-04-2021 05:29 AM
- Tagged How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-04-2021 05:29 AM
- Tagged How to determine working duration of user on Change or Authentication datamodel? on Splunk Search. 03-04-2021 05:29 AM
- Posted Re: Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:29 PM
- Tagged Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:27 PM
- Tagged Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:27 PM
- Tagged Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:27 PM
- Tagged Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:25 PM
- Posted Getting error foe External lookup, Script execution failed for external search command on Installation. 08-26-2020 02:20 PM
- Karma Re: How to pass value in token after clicking on bubble/piechart MAP for niketn. 06-24-2020 12:45 PM
- Posted Re: How to pass value in token after clicking on bubble/piechart MAP on Dashboards & Visualizations. 06-24-2020 06:05 AM
- Karma Re: How to pass value in token after clicking on bubble/piechart MAP for niketn. 06-24-2020 06:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-01-2023
07:18 AM
Hey, I am facing exact same issue We have perl script running as alert action and getting same error. Did you manage to do work around for this?
... View more
05-04-2021
05:20 AM
Hi, I am using MLTK's DensityFunction on my datamodel fields, I want to use Partial_Fit=true. But Im getting below error : "Error in 'fit' command: Algorithm "DensityFunction" does not support partial fit" In splunk docs it is stated that DensityFunction supports partial_fit link My query : "| some tstats....... | `drop_dm_object_name(Authentication)` | fit DensityFunction "activity_count" by "vendor_account" dist=auto show_density=true partial_fit=true into vendor_account_auth"
... View more
03-19-2021
04:06 AM
@tscroggins I agree its difficult to find duration based on Authentication logs. Ill try working with Change DM, can you provide me any general logic to identify duration/working time by User.
... View more
03-04-2021
05:29 AM
Hello, Right now I am struggling to identify the working hours of user by Application based on Change or Authentication datamodel. the main objective is to determine the standard working time of each user, and if that user perform any activities outside of that working time then alert will trigger. Below are the queries :- | tstats `summariesonly` c as changes_count earliest(_time) as et latest(_time) as lt from datamodel=Change by All_Changes.user All_Changes.vendor_product index _time span=1d | `drop_dm_object_name(All_Changes)` | eval time_diff=((lt-et)/60/60) | search time_diff!=0 | convert ctime(et) ctime(lt) | tstats `summariesonly` values(Authentication.signature) as signature values(sourcetype) as sourcetype latest(_time) as lt earliest(_time) as et from datamodel=Authentication.Authentication where (Authentication.is_Successful_Authentication=1) by Authentication.user Authentication.app index _time span=1d | `drop_dm_object_name("Authentication")` | eval time_diff=((lt-et)/60/60) | convert ctime(lt) ctime(et) | dedup user Now real challenge is time, some user works in different timezones and some might be working overnight.
... View more
Labels
- Labels:
-
tstats
08-26-2020
02:29 PM
I am using below transforms.conf [new] allow_caching = 0 case_sensitive_match = 1 external_cmd = new.py clientip fields_list = clientip,fraud_score,country_code,success And getting this error - Script execution failed for external search command '/opt/splunk/etc/apps/TA-test/bin/new.py'.
... View more
08-26-2020
02:20 PM
Hi I am working on External lookup, below is my code new.py import csv
import os,sys
import subprocess
import requests
import sys
import json
infile = sys.stdin
outfile = sys.stdout
r = csv.DictReader(infile)
result = 0
new_fieldnames = ["clientip", "fraud_score", "country_code", "success"]
w = csv.DictWriter(outfile, fieldnames=new_fieldnames)
w.writeheader()
apiURL = "my-api"
clientip = sys.argv[1]
URL = apiURL + clientip
r = requests.get(URL)
data = r.json()
result = {"clientip":str(data["host"]),"fraud_score": str(data["fraud_score"]), "country_code":str(data["country_code"]), "success":str(data["success"])}
w.writerow(result) Above code is giving output as below:- /opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/TA-test/bin/new.py 172.168.0.2 clientip,fraud_score,country_code,success 172.168.0.2,75,US,True
... View more
06-24-2020
06:05 AM
@niketn what do you mean by fixed no of slices. if we can pass value if slices are fixed , then may be i will tweak my query a little bit do that.
... View more
06-23-2020
12:07 PM
i want to pass value in token, from the point we select on the MAP. I am using geostats command to generate results. Eg, if we click on green bubble on MAP, i want to pass the value "Blue Water" in my token. I tried all the option from custom drilldown, but none of them worked.
... View more
- Tags:
- map
Labels
- Labels:
-
drilldown
-
form
-
javascript
-
panel
-
single value
-
token
06-10-2020
06:46 AM
I want to set or pass value to the token , after clicking on image in HTML panel Here is my panel code: <form script="my.js">
<row>
<panel>
<html>
<a id="mydivId">
<img src="/static/app/My_app/bck_city.png"/>
</a>
</html>
</panel>
</row>
</form> And after clicking on the image of above panel the below token should set with value (I want to set token="mytoken", with some value after clicking on the image above) <row>
<panel>
<title>mypanel</title>
<event>
<search>
<query>|makeresults
|eval result=$mytoken$
|table result</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row> I also tried setting token value by .js require(['underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/utils',
'splunkjs/mvc/tokenutils',
'splunkjs/mvc/simplexml/ready!'], function ($) {
var utils = require("splunkjs/mvc/utils");
$(document).ready(function () {
$("#mydivId").on("click", function (){
var tokens = mvc.Components.get("default");
var tokenValue = tokens.get("mytoken");
tokens.set("mytoken", "cheese");
});
});
});
... View more
Labels
- Labels:
-
form
-
javascript
-
other
-
panel
-
simple XML
-
token
05-04-2020
08:23 AM
Yes, you can
This app is moduler, you just have to change the sourcetype entry from eventtypes. And you are good to go.
There is a link in Home page of app to change the configuration.
... View more
02-10-2020
08:59 AM
Date=2020-02-10|StrtTime=09:56:08|EndTime=09:56:08|Duration=7|EvntType=MSG|UUID=
props that i am using :
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = Date=\d+-\d+-\d+
TRUNCATE = 9999
SHOULD_LINEMERGE = false
CHARSET=UTF-8
disabled=false
can i use TIME_FORMAT = %Y-%m-%d OR do i have to use TIME_FORMAT = %Y-%m-%d|StrtTime=%H:%M:%S
... View more
05-06-2019
10:07 AM
i have following stored procedure in SYBASE database
create procedure sp__cpu_busy_thread_test
as
begin
select @@servername,@@version
end
return(0)
and i tried calling it as :-
CALL sp_cpu_busy_thread_test
EXEC spcpu_busy_thread_test
EXEC sp_cpu_busy_thread_test();
after that i am getting following errors:-
SybSQLException: Execute cursur 'jconnect_implicit_1' is declared on a procedure which contains a non SELECT or a SELECT with a compute clause. for declaration of this cursor to be legal it should i have a single SELECT statement without a COMPUTE clause.
and
No results found for this query.
... View more
07-25-2018
06:29 AM
Can you please explain me what really CLICK-JACKING is ?
and how it is associated with embedding dashboard into external website ?
what could go wrong if we do this ?
Thanx
... View more
07-11-2018
06:49 AM
How to Do this on Windows ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-29-2024
09:44 AM
|
