About snigdhasaxena

snigdhasaxena · ‎08-17-2020

I had to thaw data from index abc from 1 Dec 2019-30 Dec 2019 Steps performed: 1. Copied buckets into thaweddb folder 2. splunk rebuild bucket_name 3. Rolling restart indexer cluster I reviewed the data in index=abc and noticed only 1 sourcetype events got thawed. However, there are 4 more sourcetype listed in SourceType.data file bucket after rebuilding it. Any suggestions why not all sourcetypes data got thawed ?

snigdhasaxena · ‎06-03-2020

@gcusello Thanks for responding. The query that I have built is generating status report for all other Splunk components (indexer, search heads, deployment server) but is not fetching events for Cluster master and deployer. I am looking for a field value parameter in internal logs that could help me determine the status of CM and deployer.

snigdhasaxena · ‎06-03-2020

I am trying to monitor deployer and search head service status using _internal logs. Which fields should I consider to monitor whether Splunk service on deployer and SH are up and running? Note: I am building a dashboard to monitor splunk service status

snigdhasaxena · ‎04-22-2020

I tried but still not all events are exported in csv

snigdhasaxena · ‎04-21-2020

When search query for report is run in Splunk, it shows 15000 events for last 7 days (example 4/14-4/21) but when I export results in csv, it exports events only for 4/21. I have reset dispatch.max_count to 0 but still it doesn't retrieve all events in csv when report runs.

snigdhasaxena · ‎02-06-2020

We have to configure Akamai logs into Splunk. As per the cloud team's recommendation , use of S3 buckets in mandatory. How can we send akamai logs to S3 buckets ? Once S3 buckets receive the logs, they are pulled by heavy forwarder.

snigdhasaxena · ‎01-26-2020

Hi, we have on-premise Splunk deployment and we are planning to migrate Splunk to AWS Cloud. We are looking forward to propose the hybrid deployment, means , forwarders lying on-prem and other Splunk components moving to Cloud. Can someone please suggest how can we achieve this with one license ? Thank you !

snigdhasaxena · ‎09-12-2019

This is a dependent dropdown. since the token in query,ac_domain has value, customer_name. index has fields aws_account_id and Account_Name. Lookup has fields customer_name and aws_account_id. We want our dropdown to populate values for field Account_Name. Hence, we used join command. query: index=abc* | table aws_account_id Account_Name |join type=left aws_account_id [|inputlookup aws_customer_lookup |fields aws_account_id customer_name ] |table aws_account_id customer_name Account_Name | where customer_name=$ac_domain$ | mvexpand Account_Name |dedup Account_Name | table Account_Name Field for label = Account_Name Field for Value=Account_Name It shows error as "Could not create search"

snigdhasaxena · ‎09-05-2019

@richgalloway What I found is if my search doesn't retrieve any events it doesn't show trend settings and says "No result found" while if it shows events , it shows the trend, sparkline,etc. What can we do to fix "No result found" and get indicators for 0 events as well ?

snigdhasaxena · ‎09-05-2019

Query for the panel that doesn't show trend indicator settings : index=xyz EventCode=4624 OR EventCode=4625 |timechart span=24h count by user Query for the panel that shows trend indicator settings: index=xyz (sourcetype=linux_secure eventtype="sshd_authentication" ) OR (eventtype=wineventlog_security AND EventCode=4625) |timechart span=4h values(src_ip) by user| timechart span=24h count

snigdhasaxena · ‎09-05-2019

I have added timechart and span in my query for dashboard panel (single value visualization). While panel shows trend settings for other panels with similar query, the 2 panels do not get it

snigdhasaxena · ‎09-02-2019

@nanachu change trigger alert when to "once per result" and this will enable field "Per result throttling field" and there you can put your field value pairs for throttling

snigdhasaxena · ‎08-28-2019

@theodorel earliest = -7d@w1 (looks at the first day of the week) latest = now | sort by earliest, latest try using this

snigdhasaxena · ‎08-28-2019

@mik990 using the search as told by solarboyz1 , | bin span=15m your_time_field | chart count over your_time_field by hostname, in the vizualization tab you can pick line chart and you'll get it as per the _time

snigdhasaxena · ‎08-27-2019

@bhavneeshvohra raise the priority of your alert, disable the jobs are that running on regular basis and no longer needed or kill the jobs that are already running that have been in queue for long.

snigdhasaxena · ‎08-26-2019

When I look at constraints, it has macro that has definition , index=NULL, I was suspecting that's the error.. so I had changed the constraint to index=* but it still doesn't work

snigdhasaxena · ‎08-26-2019

I have Email datamodel that ships alongwith Splunk ES. It's in building status and it's accelerated too. How to troubleshoot it ? Does it depends on any lookups ? after checking constraints, I can see macros and tags.. and no lookups.

snigdhasaxena · ‎07-23-2019

Hi @MedralaG , Refer below: http://dev.splunk.com/view/event-collector/SP-CAAAE6Q http://docs.splunk.com/Documentation/Splunk/latest/Data/Usepersistentqueues

snigdhasaxena · ‎07-23-2019

Hi @ashutoshab, Is it possible to make your query generic and share ?

snigdhasaxena · ‎07-23-2019

Hi @christianubeda , I believe data is rolled on the size basis from warm to cold. So you can estimate the per day data traffic and then for 90 days and set the parameter, maxWarmDBCount accordingly and data will start rolling automatically from warm to cold depending on size. Also, yes data reduction/compression happens while data retention. Please refer below link : https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Configureindexstorage#Attributes_that_affect_index_buckets https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf https://docs.splunk.com/Documentation/Splunk/7.3.0/admin/Indexesconf

snigdhasaxena · ‎07-23-2019

Hi @edwardrose , I think you should use a TA for the type of log you're ingesting in order to get the timestamp and log content in right format. Are you using a TA already ? Regards, Snigdha

snigdhasaxena · ‎07-19-2019

Is there a way to ingest data in Splunk using API (and without universal forwarder) if data is captured by native agent for source. *Note this is for Splunk Cloud

snigdhasaxena · ‎07-02-2019

Hi @christianubeda When you run alert in real time, alerts are skipped/ do not get triggered because of the alerts in queue. Suppose there's a huge traffic while splunk generates alert for current event, there may be several other alerts in queue since it is running for real time. this in turn leads splunk to not to generates alerts due to too many searches in pipeline (skipped searches). My suggestions : 1. Run alert as scheduled search using cron schedule. 2. Pick a wider time range 3. You can use throttle to avoid duplicate alerts

snigdhasaxena · ‎07-02-2019

Hi @tariqazeem123 , There are 2 ways: 1. You can run your command and use sort command index=main sourcetype=app | sort program_name by _time 2.You can use top command and you can limit it to no. of events you want index=main sourcetype=app | top limit=0 program_name

snigdhasaxena · ‎07-02-2019

Hi, Since | stats count as "<85%" this will create a field named ,"<85%" and field name should not start with a relational operator hence it doesn't work. Try naming the count field as something "Lessthan85" and it will work

Posts	49
Solutions	2
Karma Given	10
Karma Received	3
Member Since	‎07-18-2018

Online Status	Offline
Date Last Visited	‎08-18-2020 07:39 AM

All sourcetypes not getting thawed

Check Deployer and search head status in internal ...

Report not exporting all events

Sending Akamai logs via S3 buckets to Heavy forwar...

On-premise Splunk to AWS Cloud migration

Dropdown: Could not create search

Format vizualisation not showing trend settings

Datamodel status building since long

Splunk Cloud: How to ingest data using API?

Why is there an error in base search of dashboard?

All sourcetypes not getting thawed

Re: Check Deployer and search head status in inter...

Check Deployer and search head status in internal ...

Re: Report not exporting all events

Report not exporting all events

Sending Akamai logs via S3 buckets to Heavy forwar...

On-premise Splunk to AWS Cloud migration

Dropdown: Could not create search

Re: Format vizualisation not showing trend setting...

Re: Format vizualisation not showing trend setting...

Format vizualisation not showing trend settings

Re: How to write throttle alert?

Re: How to sort search and get rid of the count fr...

Re: How to create a line chart without timestamp f...

Re: Why are skipped alerts appearing?

Re: Datamodel status building since long

Datamodel status building since long

Re: What is an HTTP Event Collector persistent que...

Re: Alert Triggering only once even if set to 'Per...

Re: How can I make my data go from warm to cold af...

Re: Time/Date Stamp errors

Splunk Cloud: How to ingest data using API?

Re: How to create an alert scheduled in realtime a...

Re: how to find most popular field over time ?

Re: help for changing the label of a pie chart